#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly TARGET_HOST=sqjcnginx02
readonly TARGET_IP=10.2.203.103
readonly TEMPLATE_ROOT=/opt/zhct-deploy/roles/nginx/templates/nginx
readonly LIVE_ROOT=/usr/local/nginx/conf
readonly EXPECTED_NGINX_SHA256=b4905680419a0ad3d9a8ea9298dec5f4f2f5e5ef2f3ffe42d2119a1aafe9df62
readonly EXPECTED_FRONT_SHA256=f3af140b797361d01cb2bee0d518c5c3e146943c0c06d80f7c963467b5811c1f
readonly EXPECTED_ROUTES_SHA256=062ac2225baedb306778387288a7318d92af873a210e0c397d09bf0e1edec5c1
readonly AUDIT_ROOT=/root/q102-manual-upload-audit
readonly AUDIT_LOG="${AUDIT_ROOT}/q102-nginx-context-assess-$(date -u +%Y%m%dT%H%M%SZ).log"

mkdir -p "$AUDIT_ROOT"
chmod 0700 "$AUDIT_ROOT"
exec > >(tee -a "$AUDIT_LOG") 2>&1

finish() {
  rc=$?
  trap - EXIT
  printf 'Q102_NGINX_CONTEXT_ASSESS_AUDIT_LOG=%s\n' "$AUDIT_LOG"
  printf 'Q102_NGINX_CONTEXT_ASSESS_END RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'Q102_NGINX_CONTEXT_ASSESS_BEGIN\n'
printf 'Q102_TARGET_HOST=%s\n' "$TARGET_HOST"
printf 'Q102_TARGET_IP=%s\n' "$TARGET_IP"
date --iso-8601=seconds

test "$(hostname -s)" = "$TARGET_HOST"
ip -o -4 addr show scope global
ip -o -4 addr show scope global |
  awk '{print $4}' |
  cut -d/ -f1 |
  grep -Fxq "$TARGET_IP"
printf 'Q102_NGINX_CONTEXT_ASSESS_IDENTITY=PASS\n'

files=(
  "$TEMPLATE_ROOT/nginx.conf"
  "$TEMPLATE_ROOT/front.conf"
  "$TEMPLATE_ROOT/file-primary-routes.conf"
  "$LIVE_ROOT/nginx.conf"
  "$LIVE_ROOT/conf.d/front.conf"
  "$LIVE_ROOT/conf.d/file-primary-routes.conf"
)

for file in "${files[@]}"; do
  test -f "$file"
  stat -c 'ASSET=%n MODE=%a OWNER=%U:%G SIZE=%s MTIME=%y' "$file"
  sha256sum "$file"
done

printf 'Q102_EXPECTED_NGINX_SHA256=%s\n' "$EXPECTED_NGINX_SHA256"
printf 'Q102_EXPECTED_FRONT_SHA256=%s\n' "$EXPECTED_FRONT_SHA256"
printf 'Q102_EXPECTED_ROUTES_SHA256=%s\n' "$EXPECTED_ROUTES_SHA256"

printf 'Q102_NGINX_INCLUDE_LINES_BEGIN\n'
for file in "$TEMPLATE_ROOT/nginx.conf" "$TEMPLATE_ROOT/front.conf" \
  "$LIVE_ROOT/nginx.conf" "$LIVE_ROOT/conf.d/front.conf"; do
  printf 'FILE=%s\n' "$file"
  grep -nE '^[[:space:]]*include[[:space:]]+conf\\.d/' "$file" || true
done
printf 'Q102_NGINX_INCLUDE_LINES_END\n'

for unit in nginx haproxy orchestrator sentinel5 sentinel7 keepalived; do
  printf 'UNIT=%s ENABLED=' "$unit"
  systemctl is-enabled "$unit" 2>/dev/null || true
  printf 'UNIT=%s ACTIVE=' "$unit"
  systemctl is-active "$unit" 2>/dev/null || true
done

if ip -o -4 addr show | grep -Eq '10\.2\.203\.(115|116|117)/'; then
  printf 'Q102_VIP_ABSENT=FAIL\n'
  exit 1
fi
printf 'Q102_VIP_ABSENT=PASS\n'

set +e
/usr/local/nginx/sbin/nginx -t
nginx_test_rc=$?
set -e
printf 'Q102_NGINX_TEST_RC=%s\n' "$nginx_test_rc"
printf 'Q102_NGINX_CONTEXT_ASSESS_COMPLETE\n'