#!/usr/bin/env bash
set -euo pipefail

# Post-install checks for OwnGit topology:
# - Gitea runs on current host
# - HAProxy may be external and checked over SSH

SERVER_DOMAIN="${SERVER_DOMAIN:-git.papatramp.ru}"
GITEA_LOCAL_URL="${GITEA_LOCAL_URL:-http://127.0.0.1:3000}"
CHECK_REMOTE_HAPROXY="${CHECK_REMOTE_HAPROXY:-true}"
REMOTE_HAPROXY_HOST="${REMOTE_HAPROXY_HOST:-192.168.128.65}"
REMOTE_HAPROXY_PORT="${REMOTE_HAPROXY_PORT:-22}"
REMOTE_HAPROXY_USER="${REMOTE_HAPROXY_USER:-papatramp}"
REMOTE_HAPROXY_PASSWORD="${REMOTE_HAPROXY_PASSWORD:-}"
SSH_TEST_USER="${SSH_TEST_USER:-git}"
SSH_TEST_PORT="${SSH_TEST_PORT:-2222}"

PASS_COUNT=0
WARN_COUNT=0
FAIL_COUNT=0

log()  { echo "[INFO] $*"; }
pass() { echo "[PASS] $*"; PASS_COUNT=$((PASS_COUNT + 1)); }
warn() { echo "[WARN] $*"; WARN_COUNT=$((WARN_COUNT + 1)); }
fail() { echo "[FAIL] $*"; FAIL_COUNT=$((FAIL_COUNT + 1)); }

run_check() {
  local name="$1"
  shift
  if "$@"; then
    pass "$name"
  else
    fail "$name"
  fi
}

require_cmd() {
  local c="$1"
  if command -v "$c" >/dev/null 2>&1; then
    return 0
  fi
  fail "Не найдена команда: $c"
  return 1
}

remote_ssh() {
  local cmd="$1"
  local target="${REMOTE_HAPROXY_USER}@${REMOTE_HAPROXY_HOST}"
  local opts=(-p "$REMOTE_HAPROXY_PORT" -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
    SSHPASS="$REMOTE_HAPROXY_PASSWORD" sshpass -e ssh "${opts[@]}" "$target" "$cmd"
  else
    ssh "${opts[@]}" "$target" "$cmd"
  fi
}

check_gitea_container() {
  require_cmd docker || return 1
  docker ps --format '{{.Names}} {{.Status}}' | grep -E '^gitea[[:space:]]+Up' >/dev/null
}

check_local_gitea_http() {
  require_cmd curl || return 1
  local code
  code="$(curl -sS -o /dev/null -w '%{http_code}' "$GITEA_LOCAL_URL")"
  [[ "$code" =~ ^(200|30[0-9]|401|403)$ ]]
}

check_public_https() {
  require_cmd curl || return 1
  local code
  code="$(curl -sS -o /dev/null -w '%{http_code}' "https://${SERVER_DOMAIN}")"
  [[ "$code" =~ ^(200|30[0-9]|401|403)$ ]]
}

check_ssh_port() {
  if command -v nc >/dev/null 2>&1; then
    nc -z -w 5 "$SERVER_DOMAIN" "$SSH_TEST_PORT" >/dev/null 2>&1
    return $?
  fi
  if command -v timeout >/dev/null 2>&1; then
    timeout 5 bash -c ">/dev/tcp/${SERVER_DOMAIN}/${SSH_TEST_PORT}" >/dev/null 2>&1
    return $?
  fi
  warn "Нет nc/timeout для проверки порта ${SSH_TEST_PORT}, пропускаю."
  return 0
}

check_haproxy_remote() {
  require_cmd ssh || return 1
  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
    require_cmd sshpass || return 1
  fi
  remote_ssh "sudo haproxy -c -f /etc/haproxy/haproxy.cfg >/dev/null && sudo systemctl is-active --quiet haproxy"
}

check_remote_backup_presence() {
  require_cmd ssh || return 1
  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
    require_cmd sshpass || return 1
  fi
  remote_ssh "ls -1 /etc/haproxy/haproxy.cfg.bak.* >/dev/null 2>&1"
}

main() {
  log "Запускаю post-install проверки для ${SERVER_DOMAIN}"

  run_check "Gitea контейнер запущен" check_gitea_container
  run_check "Локальный HTTP Gitea отвечает (${GITEA_LOCAL_URL})" check_local_gitea_http
  run_check "Публичный HTTPS отвечает (https://${SERVER_DOMAIN})" check_public_https
  run_check "SSH порт доступен (${SERVER_DOMAIN}:${SSH_TEST_PORT})" check_ssh_port

  if [[ "$CHECK_REMOTE_HAPROXY" == "true" ]]; then
    run_check "Удаленный HAProxy валиден и active (${REMOTE_HAPROXY_HOST})" check_haproxy_remote
    run_check "На удаленном HAProxy есть backup-конфиги" check_remote_backup_presence
  else
    warn "Проверка удаленного HAProxy пропущена (CHECK_REMOTE_HAPROXY=false)"
  fi

  echo
  echo "Итог: PASS=${PASS_COUNT} WARN=${WARN_COUNT} FAIL=${FAIL_COUNT}"
  if [[ "$FAIL_COUNT" -gt 0 ]]; then
    exit 1
  fi
}

main "$@"