#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS01_Q200_REPLICATION_INGRESS_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis01
readonly EXPECTED_IP=10.2.203.112
readonly REPLICA_IP=10.2.203.113
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q200-redis-ingress-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q200-redis-ingress-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    set +e
    printf '%s\n' \
        "$([[ "$rc" -eq 0 ]] && printf 'Q200_REDIS01_INGRESS_DIAGNOSIS=PASS_READ_ONLY' || printf 'Q200_REDIS01_INGRESS_DIAGNOSIS=FAIL_STOP')" \
        'SERVICE_MUTATION=ZERO' \
        'FIREWALL_ROUTE_MUTATION=ZERO' \
        'SECRET_VALUES=NOT_READ_NOT_OUTPUT_NOT_HASHED' \
        "END|${LABEL}|RC=${rc}|AUDIT_LOG=${AUDIT_LOG}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    if grep -En 'systemctl[[:space:]]+(start|stop|restart|enable|disable)|firewall-cmd[^\n]*(--add|--remove|--reload)|nft[[:space:]]+(add|delete|flush)|iptables[^\n]*-[AI]|ip[[:space:]]+(route|rule|addr)[[:space:]]+(add|del|replace)|redis-cli|dnf[[:space:]]+(-y|install|remove)' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then return 1; fi
    printf '%s\n' 'Q200_REDIS01_INGRESS_DIAG_STATIC_VALIDATE=PASS' 'MUTATION=ZERO'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then static_validate; exit 0; fi
[[ $# -eq 0 && $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q200_REDIS01_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"

for command_name in ip ss timeout systemctl install tee awk grep; do command -v "$command_name" >/dev/null; done
install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== IDENTITY / ROUTE TO REDIS02 ==='
ip -br -4 addr show
ip -4 route get "$REPLICA_IP" 2>&1 || true
ip neigh show to "$REPLICA_IP" 2>&1 || true

printf '%s\n' '=== REDIS01 UNIT AND LISTENER STATE ==='
local_ready=1
for unit in redis5.service redis7.service; do
    enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)
    active=$(systemctl is-active "$unit" 2>/dev/null || true)
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" "$enabled" "$active"
    [[ "$enabled" == enabled && "$active" == active ]] || local_ready=0
done
for unit in sentinel5.service sentinel7.service orchestrator.service; do
    printf 'AUX_UNIT|%s|enabled=%s|active=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
for port in 6379 6387; do
    if ss -lntH "sport = :${port}" | grep -q .; then
        printf 'LOCAL_LISTENER|port=%s|PASS\n' "$port"
    else
        printf 'LOCAL_LISTENER|port=%s|FAIL_ABSENT\n' "$port"
        local_ready=0
    fi
done

printf '%s\n' '=== REDIS01 LOCAL TCP SOCKET PROBE ==='
for port in 6379 6387; do
    set +e
    timeout 5 bash -c "exec 3<>/dev/tcp/${EXPECTED_IP}/${port}" >/dev/null 2>&1
    rc=$?
    set -e
    printf 'LOCAL_TCP_CONNECT|target=%s|port=%s|rc=%s|%s\n' "$EXPECTED_IP" "$port" "$rc" "$([[ "$rc" -eq 0 ]] && printf PASS || printf FAIL)"
    [[ "$rc" -eq 0 ]] || local_ready=0
done

printf '%s\n' '=== FIREWALL READ-ONLY ==='
printf 'FIREWALLD_ACTIVE=%s\n' "$(systemctl is-active firewalld.service 2>/dev/null || true)"
if command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --get-active-zones 2>&1 || true
    firewall-cmd --list-all-zones 2>&1 || true
fi
if command -v nft >/dev/null 2>&1; then
    nft list ruleset 2>&1 | grep -Ei -C 3 'reject|drop|6379|6387|10\.2\.203\.(112|113)' || true
fi

if [[ "$local_ready" -eq 1 ]]; then
    printf 'Q200_REDIS01_LOCAL_ENDPOINT_GATE=PASS|ports=6379,6387\n'
    printf 'NEXT_ACTION=COMPARE_REDIS02_DIAG_AND_REMEDIATE_FIREWALL_OR_NETWORK_ACL\n'
else
    printf 'Q200_REDIS01_LOCAL_ENDPOINT_GATE=BLOCKED\n'
    printf 'NEXT_ACTION=REPAIR_REDIS01_LOCAL_ENDPOINT_BEFORE_NETWORK_POLICY_CHANGE\n'
fi