#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly TARGET_HOST=sqjcnginx02
readonly TARGET_IP=10.2.203.103
readonly RUNTIME_FILE=/opt/zhct-deploy/common/lib/runtime.sh
readonly UNITS_FILE=/opt/zhct-deploy/roles/nginx/manifests/systemd-units.tsv
readonly EXPECTED_RUNTIME_SHA256=4c06e4ad325de7241607b06d93c99c2f35f3422bfcbdbeeb43b530f2053f4bb6
readonly EXPECTED_UNITS_SHA256=24ce7c17d7a7cf8070d1cdd9013c54e49a445cd264a0ecafcae4ef1912811d61
readonly AUDIT_ROOT=/root/q102-manual-upload-audit
readonly AUDIT_LOG="${AUDIT_ROOT}/q102-asset-hash-assess-$(date -u +%Y%m%dT%H%M%SZ).log"

mkdir -p "$AUDIT_ROOT"
chmod 0700 "$AUDIT_ROOT"
exec > >(tee -a "$AUDIT_LOG") 2>&1

finish() {
  rc=$?
  trap - EXIT
  printf 'Q102_ASSET_HASH_ASSESS_AUDIT_LOG=%s\n' "$AUDIT_LOG"
  printf 'Q102_ASSET_HASH_ASSESS_END RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'Q102_ASSET_HASH_ASSESS_BEGIN\n'
printf 'Q102_TARGET_HOST=%s\n' "$TARGET_HOST"
printf 'Q102_TARGET_IP=%s\n' "$TARGET_IP"
date --iso-8601=seconds

test "$(hostname -s)" = "$TARGET_HOST"
ip -o -4 addr show scope global
ip -o -4 addr show scope global |
  awk '{print $4}' |
  cut -d/ -f1 |
  grep -Fxq "$TARGET_IP"
printf 'Q102_ASSET_HASH_ASSESS_IDENTITY=PASS\n'

test -f "$RUNTIME_FILE"
test -f "$UNITS_FILE"

stat -c 'ASSET=%n MODE=%a OWNER=%U:%G SIZE=%s MTIME=%y' \
  "$RUNTIME_FILE" "$UNITS_FILE"

actual_runtime_sha256=$(sha256sum "$RUNTIME_FILE" | awk '{print $1}')
actual_units_sha256=$(sha256sum "$UNITS_FILE" | awk '{print $1}')

printf 'ASSET=runtime.sh EXPECTED_SHA256=%s ACTUAL_SHA256=%s MATCH=%s\n' \
  "$EXPECTED_RUNTIME_SHA256" \
  "$actual_runtime_sha256" \
  "$([[ "$actual_runtime_sha256" == "$EXPECTED_RUNTIME_SHA256" ]] && printf YES || printf NO)"

printf 'ASSET=systemd-units.tsv EXPECTED_SHA256=%s ACTUAL_SHA256=%s MATCH=%s\n' \
  "$EXPECTED_UNITS_SHA256" \
  "$actual_units_sha256" \
  "$([[ "$actual_units_sha256" == "$EXPECTED_UNITS_SHA256" ]] && printf YES || printf NO)"

printf 'Q102_SYSTEMD_UNITS_NGINX_ROWS_BEGIN\n'
awk -F '\t' '
  NR == 1 || $1 == "nginx01" || $1 == "nginx02" {
    print
  }
' "$UNITS_FILE"
printf 'Q102_SYSTEMD_UNITS_NGINX_ROWS_END\n'

printf 'Q102_ASSET_HASH_ASSESS_COMPLETE\n'