#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

INSTANCE=${1:-}
MODE=${2:-}
EXPECTED_HOST=${3:-}
[[ "$(hostname -s)" == "$EXPECTED_HOST" ]] || { echo "ERROR: hostname mismatch" >&2; exit 1; }

case "$INSTANCE" in
  56) MYSQL=/opt/mysql/5.6.51/bin/mysql; CNF=/etc/zhct/secrets/mysql56-admin.cnf; UNIT=mysql56.service ;;
  80) MYSQL=/opt/mysql/8.0.46/bin/mysql; CNF=/etc/zhct/secrets/mysql80-admin.cnf; UNIT=mysql80.service ;;
  *) echo "ERROR: invalid instance" >&2; exit 2 ;;
esac
[[ -f "$CNF" && $(stat -c '%U:%G' "$CNF") == root:root ]] ||
  { echo "ERROR: admin consumer file missing" >&2; exit 1; }
case "$(stat -c '%a' "$CNF")" in 400|600) ;; *) echo "ERROR: unsafe admin consumer mode" >&2; exit 1 ;; esac

case "$MODE" in
  readonly)
    if [[ "$INSTANCE" == 80 ]]; then
      "$MYSQL" --defaults-extra-file="$CNF" --batch -e \
        'SET GLOBAL read_only=ON; SET GLOBAL super_read_only=ON;'
    else
      "$MYSQL" --defaults-extra-file="$CNF" --batch -e 'SET GLOBAL read_only=ON;'
    fi
    ;;
  stop) systemctl stop "$UNIT" ;;
  *) echo "ERROR: invalid fencing mode" >&2; exit 2 ;;
esac