# netem-link: applies `tc qdisc ... netem` WAN-simulation parameters to a
# modules/mesh-link bridge (D-100). Confirmed mechanism this session,
# fetched directly from OpenTofu's own official docs (opentofu.org, tag
# current as of 2026-07-09): `libvirt_network` has no netem-equivalent
# argument at all, so this has to happen as a provisioner-only side effect,
# not a libvirt resource. OpenTofu's own docs recommend `terraform_data`
# over the older `null_resource` for exactly this "provisioner with no
# logical managed resource to attach to" case -- used here, not null_resource.
#
# Runs over SSH, not a bare local-exec command: OpenTofu itself runs from
# the Office1 operator VM (D-103), not on the vcloud host where the bridge
# interfaces exist, so the command has to hop there explicitly. Assumes
# passwordless SSH + passwordless sudo to var.vcloud_host_ssh_target as this
# repo's usual jumphost-session conventions provide -- not configured here.
#
# UNVERIFIED, flagged plainly: this whole resource has not been run for
# real this session (no `tofu` binary, no live vcloud host, no bridge to
# test against). `tc qdisc replace` (not `add`) is used deliberately so a
# re-apply is idempotent rather than erroring "RTNETLINK answers: File
# exists" -- a standard, well-known tc usage pattern, not something specific
# to this repo.

resource "terraform_data" "netem" {
  triggers_replace = [var.bridge_name, var.netem_args]

  provisioner "local-exec" {
    command = "ssh ${var.vcloud_host_ssh_target} 'sudo tc qdisc replace dev ${var.bridge_name} root netem ${var.netem_args}'"
  }

  provisioner "local-exec" {
    when    = destroy
    command = "ssh ${var.vcloud_host_ssh_target} 'sudo tc qdisc del dev ${var.bridge_name} root' || true"
  }
}