#!/usr/bin/env bash

set -Eeuo pipefail

usage() {
    echo "Usage: $0 <app01|app02> <run_id> <--dry-run|--execute>" >&2
    exit 2
}

[[ $# -eq 3 ]] || usage
NODE_KEY=$1
RUN_ID=$2
MODE=$3

case "$NODE_KEY" in
    app01)
        QID=q111
        EXPECTED_HOST=sqjcapp01
        EXPECTED_IP=10.2.203.104
        EXPECTED_SUPERVISOR_SHA=40192ee93a8d609f87f5027c4b392285d136dea6933aa82b9a89bc341299bf3f
        EXPECTED_CRON_SHA=580790bf6c89ae577e3065b9d898546ee68a085e0b05516ae0e3bbfcd27a116b
        ;;
    app02)
        QID=q110
        EXPECTED_HOST=sqjcapp02
        EXPECTED_IP=10.2.203.105
        EXPECTED_SUPERVISOR_SHA=7dad2a5126f11ee186cbae9994c87724f0b2d7474617a77304a2df5b93fda2d8
        EXPECTED_CRON_SHA=17adcf8650bc229f012a6e8315acc66d59d39784f2f75c9ddd23e0665466543d
        ;;
    *) usage ;;
esac

[[ "$RUN_ID" =~ ^${QID}-[A-Za-z0-9+_.:-]+$ ]] || {
    echo "ERROR: run_id must begin with ${QID}-" >&2
    exit 2
}
[[ "$MODE" == --dry-run || "$MODE" == --execute ]] || usage
[[ $(id -u) -eq 0 ]] || { echo 'ERROR: root required' >&2; exit 1; }
[[ $(hostname -s) == "$EXPECTED_HOST" ]] || { echo 'ERROR: hostname mismatch' >&2; exit 1; }
ip -o -4 addr show scope global | grep -Eq "(^|[[:space:]])${EXPECTED_IP//./\\.}/" || {
    echo 'ERROR: expected IPv4 missing' >&2
    exit 1
}

EVIDENCE_ROOT="/var/backups/zhct-${QID}/evidence"
EVIDENCE_DIR="$EVIDENCE_ROOT/$RUN_ID"
BACKUP_ROOT="/var/backups/zhct-${QID}/files"
[[ ! -e "$EVIDENCE_DIR" && ! -L "$EVIDENCE_DIR" ]] || {
    echo "ERROR: evidence directory already exists: $EVIDENCE_DIR" >&2
    exit 1
}
install -d -m 0700 -o root -g root "$EVIDENCE_DIR"
exec > >(tee "$EVIDENCE_DIR/execution.log") 2>&1

finish() {
    rc=$?
    trap - EXIT
    set +e
    {
        echo "qid=$QID"
        echo "run_id=$RUN_ID"
        echo "node_key=$NODE_KEY"
        echo "mode=$MODE"
        echo "exit_code=$rc"
        if [[ $rc -eq 0 ]]; then echo "result=PASS"; else echo "result=FAIL"; fi
    } >"$EVIDENCE_DIR/result.env"
    chmod 0600 "$EVIDENCE_DIR/result.env"
    echo "APP_POSTCLONE_EXIT_CODE=$rc"
    if [[ $rc -eq 0 ]]; then echo APP_POSTCLONE_RESULT=PASS; else echo APP_POSTCLONE_RESULT=FAIL; fi
    echo APP_POSTCLONE_END
    exit "$rc"
}
trap finish EXIT

echo APP_POSTCLONE_BEGIN
date '+%Y-%m-%dT%H:%M:%S%z'
echo "QID=$QID NODE_KEY=$NODE_KEY EXPECTED_HOST=$EXPECTED_HOST EXPECTED_IP=$EXPECTED_IP MODE=$MODE"

while read -r expected path; do
    echo "$expected  $path" | sha256sum -c -
    [[ ! -L "$path" ]]
done <<'EOF'
ca5fa0a113739bcbe3ff51b2815bb50723cd8b1cf33dfb6d3f3f172caf2dabc6 /opt/zhct-deploy/common/scripts/post-clone.sh
e3eae16aa5c87f43b56495fc71de378a947578cabe18b507e8fed01ac1f32025 /opt/zhct-deploy/common/bin/role-action.sh
03c6b13a0def5bf3954e069581b6f9fbe0f81f24285ba2319b6279c0406d70aa /opt/zhct-deploy/roles/app/hooks.sh
83e6abb26b4af6d8a8dc74082acac73009d0d60446bd641f65b8b4e9c21e6afc /opt/zhct-deploy/roles/app/manifests/nodes.tsv
d43e179c108f6db551b452256f867d6d4f6fc9e031c1d4def2f343966af8d684 /opt/zhct-deploy/roles/app/manifests/systemd-units.tsv
EOF

for unit in nginx.service php-fpm73.service php-fpm74.service supervisor.service crond.service; do
    [[ $(systemctl is-enabled "$unit" 2>/dev/null || true) == disabled ]]
    [[ $(systemctl is-active "$unit" 2>/dev/null || true) == inactive ]]
done

args=(
    --role app
    --bundle-root /opt/zhct-deploy
    --node "$NODE_KEY"
    --expected-ip "$EXPECTED_IP"
)
if [[ "$MODE" == --dry-run ]]; then
    args+=(--dry-run)
fi

env RUN_ID="$RUN_ID" BACKUP_ROOT="$BACKUP_ROOT" \
    /opt/zhct-deploy/common/scripts/post-clone.sh "${args[@]}"

if [[ "$MODE" == --dry-run ]]; then
    echo APP_POSTCLONE_DRY_RUN_ONLY
else
    [[ -s /etc/machine-id ]]
    [[ -s /etc/ssh/ssh_host_ed25519_key ]]
    grep -Fxq 'ROLE=app' /etc/zhct/node.env
    grep -Fxq "NODE_KEY=$NODE_KEY" /etc/zhct/node.env
    grep -Fxq "NODE_IP=$EXPECTED_IP" /etc/zhct/node.env
    grep -Fxq "NODE_NAME=$EXPECTED_HOST" /etc/zhct/node.env
    echo "$EXPECTED_SUPERVISOR_SHA  /etc/supervisor/conf.d/sanquan.conf" | sha256sum -c -
    echo "$EXPECTED_CRON_SHA  /etc/cron.d/zhct-sanquan" | sha256sum -c -
    /usr/local/sbin/singleton-state-check.sh \
        --node "$NODE_KEY" \
        --config /etc/supervisor/conf.d/sanquan.conf \
        --cron /etc/cron.d/zhct-sanquan
fi

for unit in nginx.service php-fpm73.service php-fpm74.service supervisor.service crond.service; do
    enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)
    active=$(systemctl is-active "$unit" 2>/dev/null || true)
    echo "$unit enabled=$enabled active=$active"
    [[ "$enabled" == disabled && "$active" == inactive ]]
done
! ss -H -lntup | grep -Eq ':(8081|18081)([[:space:]]|$)'
! pgrep -x nginx
! pgrep -x php-fpm
! pgrep -x supervisord
! pgrep -x crond

echo APP_POSTCLONE_EVIDENCE_DIR="$EVIDENCE_DIR"