#!/bin/bash
# switch_mode.sh — change mode SafeDNS

set -euo pipefail

MODE="${1:-dot}"  # change if need doh -> dot -> udp,  default -> udp

case "$MODE" in
    auto|udp|doh|dot) ;;
    *) echo "Invalid mode: $MODE (use: auto|udp|doh|dot)"; exit 1 ;;
esac

case "$MODE" in
    udp) ENCRYPTED=false ;;
    *)   ENCRYPTED=true ;;
esac

plutil -replace UpstreamMode -string "$MODE" "/Library/Application Support/SafeDNS/config.plist"
plutil -replace StrictEncryptedDNS -bool "$ENCRYPTED" "/Library/Application Support/SafeDNS/config.plist"

# Перезапуск
killall -9 SafeDNSMacProxy 2>/dev/null || true
sleep 2
killall -9 com.safedns.agent.SafeDNSMacProxy.dnsProxy 2>/dev/null || true

echo "Switched to $MODE (StrictEncryptedDNS=$ENCRYPTED)"