#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly TARGET_HOST=sqjcnginx02
readonly TARGET_IP=10.2.203.103
readonly SOURCE=/opt/zhct-deploy/roles/nginx/templates/nginx/nginx.conf
readonly LIVE=/usr/local/nginx/conf/nginx.conf
readonly LIVE_FRONT=/usr/local/nginx/conf/conf.d/front.conf
readonly LIVE_ROUTES=/usr/local/nginx/conf/conf.d/file-primary-routes.conf
readonly OLD_LIVE_SHA256=be54d0b36f9ae5319f942f36c0f4e9681571c3210e8bd4e3382fe270ec101659
readonly NEW_LIVE_SHA256=b4905680419a0ad3d9a8ea9298dec5f4f2f5e5ef2f3ffe42d2119a1aafe9df62
readonly FRONT_SHA256=f3af140b797361d01cb2bee0d518c5c3e146943c0c06d80f7c963467b5811c1f
readonly ROUTES_SHA256=062ac2225baedb306778387288a7318d92af873a210e0c397d09bf0e1edec5c1
readonly RUN_ID="q102-nginx-context-repair-$(date -u +%Y%m%dT%H%M%SZ)"
readonly BACKUP_DIR="/var/backups/zhct-q102/files/${RUN_ID}/usr/local/nginx/conf"
readonly BACKUP_FILE="${BACKUP_DIR}/nginx.conf"
readonly AUDIT_ROOT=/root/q102-manual-upload-audit
readonly AUDIT_LOG="${AUDIT_ROOT}/${RUN_ID}.log"

mkdir -p "$AUDIT_ROOT"
chmod 0700 "$AUDIT_ROOT"
exec > >(tee -a "$AUDIT_LOG") 2>&1

mutation_started=0
rollback_status=NOT_REQUIRED

finish() {
  rc=$?
  trap - EXIT
  if test "$rc" -ne 0 && test "$mutation_started" -eq 1; then
    rollback_status=ATTEMPTED
    if cp -a "$BACKUP_FILE" "$LIVE"; then
      rollback_status=PASS
    else
      rollback_status=FAIL
    fi
  fi
  printf 'Q102_NGINX_CONTEXT_REPAIR_ROLLBACK=%s\n' "$rollback_status"
  printf 'Q102_NGINX_CONTEXT_REPAIR_BACKUP=%s\n' "$BACKUP_FILE"
  printf 'Q102_NGINX_CONTEXT_REPAIR_AUDIT_LOG=%s\n' "$AUDIT_LOG"
  printf 'Q102_NGINX_CONTEXT_REPAIR_END RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'Q102_NGINX_CONTEXT_REPAIR_BEGIN\n'
printf 'Q102_RUN_ID=%s\n' "$RUN_ID"
printf 'Q102_TARGET_HOST=%s\n' "$TARGET_HOST"
printf 'Q102_TARGET_IP=%s\n' "$TARGET_IP"
date --iso-8601=seconds

test "$(id -u)" -eq 0
test "$(hostname -s)" = "$TARGET_HOST"
ip -o -4 addr show scope global
ip -o -4 addr show scope global |
  awk '{print $4}' |
  cut -d/ -f1 |
  grep -Fxq "$TARGET_IP"
printf 'Q102_NGINX_CONTEXT_REPAIR_IDENTITY=PASS\n'

for unit in nginx haproxy orchestrator sentinel5 sentinel7 keepalived; do
  test "$(systemctl is-enabled "$unit" 2>/dev/null || true)" = disabled
  test "$(systemctl is-active "$unit" 2>/dev/null || true)" = inactive
done

if ip -o -4 addr show | grep -Eq '10\.2\.203\.(115|116|117)/'; then
  exit 1
fi
printf 'Q102_NGINX_CONTEXT_REPAIR_QUIET_GATE=PASS\n'

test -f "$SOURCE"
test -f "$LIVE"
test -f "$LIVE_FRONT"
test -f "$LIVE_ROUTES"

source_sha256=$(sha256sum "$SOURCE" | awk '{print $1}')
live_sha256=$(sha256sum "$LIVE" | awk '{print $1}')
front_sha256=$(sha256sum "$LIVE_FRONT" | awk '{print $1}')
routes_sha256=$(sha256sum "$LIVE_ROUTES" | awk '{print $1}')

printf 'SOURCE_SHA256=%s\n' "$source_sha256"
printf 'LIVE_BEFORE_SHA256=%s\n' "$live_sha256"
printf 'LIVE_FRONT_SHA256=%s\n' "$front_sha256"
printf 'LIVE_ROUTES_SHA256=%s\n' "$routes_sha256"

test "$source_sha256" = "$NEW_LIVE_SHA256"
test "$live_sha256" = "$OLD_LIVE_SHA256"
test "$front_sha256" = "$FRONT_SHA256"
test "$routes_sha256" = "$ROUTES_SHA256"
printf 'Q102_NGINX_CONTEXT_REPAIR_HASH_GATE=PASS\n'

test ! -e "/var/backups/zhct-q102/files/${RUN_ID}"
install -d -m 0750 -o root -g root "$BACKUP_DIR"
cp -a "$LIVE" "$BACKUP_FILE"
printf 'Q102_NGINX_CONTEXT_REPAIR_BACKUP=PASS\n'

mutation_started=1
install -m 0644 -o root -g root "$SOURCE" "$LIVE"
test "$(sha256sum "$LIVE" | awk '{print $1}')" = "$NEW_LIVE_SHA256"
/usr/local/nginx/sbin/nginx -t
stat -c 'REPAIRED=%n MODE=%a OWNER=%U:%G SIZE=%s' "$LIVE"

for unit in nginx haproxy orchestrator sentinel5 sentinel7 keepalived; do
  test "$(systemctl is-enabled "$unit" 2>/dev/null || true)" = disabled
  test "$(systemctl is-active "$unit" 2>/dev/null || true)" = inactive
done

if ip -o -4 addr show | grep -Eq '10\.2\.203\.(115|116|117)/'; then
  exit 1
fi

mutation_started=0
rollback_status=NOT_REQUIRED
printf 'Q102_NGINX_CONTEXT_REPAIR_PASS\n'