#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C
umask 077

readonly EXPECTED_HOSTNAME='sqjcmqtt02'
readonly EXPECTED_IP='10.2.203.109'
readonly TARGET_PORT_RE=':(1883|8083|18083|4370|5370|8883|8084)([[:space:]]|$)'
readonly AUDIT_LOG='/root/q142-emqx-start-failure-readonly-diagnose.log'
readonly ATTEMPT_SINCE='2026-07-29 18:27:00'
readonly ATTEMPT_UNTIL='2026-07-29 18:32:00'

q142_diag_finish() {
  q142_diag_rc=$?
  trap - EXIT
  printf '%s\n' 'Q142_START_FAILURE_READONLY_DIAG_END'
  printf 'Q142_START_FAILURE_READONLY_DIAG_RC=%s\n' "${q142_diag_rc}"
  exit "${q142_diag_rc}"
}
trap q142_diag_finish EXIT

test "${EUID}" -eq 0
test "$(hostname -s)" = "${EXPECTED_HOSTNAME}"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IP}"

exec > >(tee "${AUDIT_LOG}") 2>&1

printf '%s\n' 'Q142_START_FAILURE_READONLY_DIAG_BEGIN'
hostname -s
ip -br -4 addr show ens192
ip -br -4 addr show ens192 | grep -F "${EXPECTED_IP}/24"

printf '%s\n' '=== UNIT STATE AND RESULT ==='
for q142_diag_unit in emqx.service mosquitto.service; do
  printf 'UNIT=%s enabled=' "${q142_diag_unit}"
  systemctl is-enabled "${q142_diag_unit}" 2>&1 || true
  printf 'UNIT=%s active=' "${q142_diag_unit}"
  systemctl is-active "${q142_diag_unit}" 2>&1 || true
  systemctl show "${q142_diag_unit}" --no-pager \
    --property=LoadState \
    --property=ActiveState \
    --property=SubState \
    --property=Result \
    --property=UnitFileState \
    --property=ExecMainCode \
    --property=ExecMainStatus \
    --property=ExecMainPID \
    --property=NRestarts \
    --property=FragmentPath
done

printf '%s\n' '=== UNIT FILE METADATA ONLY ==='
q142_diag_fragment=$(
  systemctl show emqx.service --property=FragmentPath --value
)
if [[ -n "${q142_diag_fragment}" && -e "${q142_diag_fragment}" ]]; then
  stat -c 'UNIT_FILE=%n TYPE=%F OWNER=%U:%G MODE=%a SIZE=%s' \
    "${q142_diag_fragment}"
  sha256sum "${q142_diag_fragment}"
else
  printf '%s\n' 'EMQX_UNIT_FRAGMENT_ABSENT'
fi
find /etc/systemd/system/emqx.service.d /usr/lib/systemd/system/emqx.service.d \
  -maxdepth 1 -type f \
  -printf 'DROPIN_FILE=%p TYPE=%y OWNER=%u:%g MODE=%m SIZE=%s\n' \
  2>/dev/null | sort || true

printf '%s\n' '=== FILE AND DIRECTORY METADATA ONLY ==='
for q142_diag_path in \
  /etc/emqx \
  /etc/emqx/emqx.conf \
  /etc/emqx/base.hocon \
  /etc/emqx/acl.conf \
  /etc/zhct/secrets/emqx.cluster-cookie \
  /root/emqx.cluster-cookie.transfer \
  /var/lib/emqx \
  /var/log/emqx
do
  if [[ -e "${q142_diag_path}" ]]; then
    stat -c 'PATH=%n TYPE=%F OWNER=%U:%G MODE=%a SIZE=%s' \
      "${q142_diag_path}"
  else
    printf 'PATH_ABSENT=%s\n' "${q142_diag_path}"
  fi
done

printf '%s\n' '=== SEALED STATE BOOLEAN CHECKS ==='
if [[ -f /etc/emqx/emqx.conf ]] &&
  grep -Fq '__EMQX_CLUSTER_COOKIE__' /etc/emqx/emqx.conf; then
  printf '%s\n' 'PLACEHOLDER_CONFIG_PRESENT'
else
  printf '%s\n' 'PLACEHOLDER_CONFIG_NOT_CONFIRMED'
fi
if [[ ! -e /etc/zhct/secrets/emqx.cluster-cookie ]]; then
  printf '%s\n' 'COOKIE_ABSENT'
else
  printf '%s\n' 'COOKIE_PRESENT_METADATA_ONLY'
fi
if [[ ! -e /root/emqx.cluster-cookie.transfer ]]; then
  printf '%s\n' 'COOKIE_TRANSFER_ABSENT'
else
  printf '%s\n' 'COOKIE_TRANSFER_PRESENT_METADATA_ONLY'
fi
if [[ ! -e /etc/emqx/acl.conf ]]; then
  printf '%s\n' 'RPM_ACL_ABSENT'
else
  printf '%s\n' 'RPM_ACL_PRESENT_METADATA_ONLY'
fi
for q142_diag_runtime_dir in /var/lib/emqx /var/log/emqx; do
  if [[ -d "${q142_diag_runtime_dir}" ]] &&
    ! find "${q142_diag_runtime_dir}" -mindepth 1 -print -quit |
      grep -q .; then
    printf 'RUNTIME_DIRECTORY_EMPTY=%s\n' "${q142_diag_runtime_dir}"
  else
    printf 'RUNTIME_DIRECTORY_NOT_EMPTY_OR_MISSING=%s\n' \
      "${q142_diag_runtime_dir}"
  fi
done

printf '%s\n' '=== PROCESSES AND TARGET LISTENERS ==='
if pgrep -x beam.smp >/dev/null || pgrep -x mosquitto >/dev/null; then
  printf '%s\n' 'TARGET_PROCESSES_PRESENT'
else
  printf '%s\n' 'TARGET_PROCESSES_ZERO'
fi
if ss -lntupH | grep -E "${TARGET_PORT_RE}"; then
  printf '%s\n' 'TARGET_LISTENERS_PRESENT'
else
  printf '%s\n' 'TARGET_LISTENERS_ZERO'
fi

printf '%s\n' '=== START ATTEMPT JOURNAL REDACTED ==='
journalctl -u emqx.service \
  --since "${ATTEMPT_SINCE}" \
  --until "${ATTEMPT_UNTIL}" \
  -o short-iso --no-pager 2>&1 |
  awk '
    BEGIN { IGNORECASE=1 }
    /cookie|password|passwd|secret|token|credential|authorization/ {
      print "[REDACTED_SECRET_LIKE_JOURNAL_LINE]"
      next
    }
    { print }
  '
printf '%s\n' 'START_ATTEMPT_JOURNAL_END'

printf '%s\n' 'CONFIG_CONTENT_NOT_OUTPUT'
printf '%s\n' 'COOKIE_VALUE_NOT_OUTPUT'
printf '%s\n' 'SYSTEMD_STATE_NOT_RESET'
printf '%s\n' 'AUDIT_LOG_WRITE_ONLY'
printf '%s\n' 'REMOTE_OPERATIONAL_MUTATION=ZERO'
printf '%s\n' 'Q142_START_FAILURE_READONLY_DIAG_PASS'