#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export LC_ALL=C

EXPECTED_HOSTNAME=sqjcredis01
EXPECTED_IPV4=10.2.203.112
RUN_ID=${1:-}
[[ "${EUID}" -eq 0 ]] || { printf 'ERROR: must run as root\n' >&2; exit 1; }
[[ "${RUN_ID}" =~ ^q07[01]-[0-9]{8}T[0-9]{6}[+]0800$ ]] ||
  { printf 'ERROR: invalid run id\n' >&2; exit 1; }
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] ||
  { printf 'ERROR: hostname mismatch\n' >&2; exit 1; }
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IPV4}" || { printf 'ERROR: IPv4 mismatch\n' >&2; exit 1; }

EVIDENCE_DIR="/var/backups/zhct-q070/evidence/${RUN_ID}"
FILES_DIR="/var/backups/zhct-q070/files/${RUN_ID}"
[[ ! -e "${EVIDENCE_DIR}" && ! -e "${FILES_DIR}" ]] ||
  { printf 'ERROR: baseline run id already exists\n' >&2; exit 1; }
install -d -m 0700 "${EVIDENCE_DIR}" "${FILES_DIR}"

paths=(
  /opt/redis/5.0.14 /opt/redis/7.2.14 /etc/redis
  /data/redis5 /data/redis7
  /var/lib/redis-sentinel5 /var/lib/redis-sentinel7
  /var/log/redis5 /var/log/redis7
  /var/log/redis-sentinel5 /var/log/redis-sentinel7
  /var/lib/orchestrator /var/log/orchestrator /etc/orchestrator.conf.json
  /etc/zhct/templates/redis
  /etc/sysctl.d/99-zhct-redis.conf
  /etc/systemd/system/zhct-redis-thp.service
  /etc/systemd/system/redis5.service /etc/systemd/system/redis7.service
  /etc/systemd/system/sentinel5.service /etc/systemd/system/sentinel7.service
)
printf 'path\tstate\n' >"${EVIDENCE_DIR}/path-state-before.tsv"
for path in "${paths[@]}"; do
  if [[ -e "${path}" || -L "${path}" ]]; then
    printf '%s\tPRESENT\n' "${path}" >>"${EVIDENCE_DIR}/path-state-before.tsv"
    target="${FILES_DIR}/${path#/}"
    install -d -m 0700 "$(dirname "${target}")"
    cp -a "${path}" "${target}"
  else
    printf '%s\tABSENT\n' "${path}" >>"${EVIDENCE_DIR}/path-state-before.tsv"
  fi
done

printf 'account\tstate\n' >"${EVIDENCE_DIR}/account-state-before.tsv"
for account in redis orchestrator; do
  if getent passwd "${account}" >/dev/null || getent group "${account}" >/dev/null; then
    printf '%s\tPRESENT\n' "${account}" >>"${EVIDENCE_DIR}/account-state-before.tsv"
  else
    printf '%s\tABSENT\n' "${account}" >>"${EVIDENCE_DIR}/account-state-before.tsv"
  fi
done

printf 'vm.overcommit_memory\t%s\n' "$(sysctl -n vm.overcommit_memory)" \
  >"${EVIDENCE_DIR}/sysctl-state-before.tsv"
tr -d '\n' </sys/kernel/mm/transparent_hugepage/enabled \
  >"${EVIDENCE_DIR}/thp-enabled-before.txt"
printf '\n' >>"${EVIDENCE_DIR}/thp-enabled-before.txt"

rpm -qa | sort >"${EVIDENCE_DIR}/rpm-before.txt"
dnf history list >"${EVIDENCE_DIR}/dnf-history-before.txt" 2>&1
dnf history list 2>/dev/null | awk 'NR > 2 && $1 ~ /^[0-9]+$/ {print $1; exit}' \
  >"${EVIDENCE_DIR}/dnf-history-id-before.txt"
systemctl list-unit-files >"${EVIDENCE_DIR}/unit-files-before.txt"
systemctl --failed --no-pager >"${EVIDENCE_DIR}/failed-units-before.txt"
ss -lntup >"${EVIDENCE_DIR}/listeners-before.txt"
df -B1 / >"${EVIDENCE_DIR}/df-before.txt"
findmnt -no SOURCE,FSTYPE,OPTIONS / >"${EVIDENCE_DIR}/root-mount-before.txt"

{
  printf 'baseline=PASS\n'
  printf 'run_id=%s\n' "${RUN_ID}"
  printf 'install_execution=NOT_PERFORMED\n'
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
} >"${EVIDENCE_DIR}/baseline-result.env"
printf 'REDIS01_BASELINE_CAPTURE_OK\n'