#!/usr/bin/env bash
# Одноразовый hotfix: увеличить proxy_read_timeout для долгих SSH/WinRM API.
# Запуск на SAC-сервере: sudo bash patch-nginx-sac-long-timeout.sh
set -euo pipefail

CFG="${SAC_NGINX_SITE:-/etc/nginx/sites-available/sac}"

if [[ "$(id -u)" -ne 0 ]]; then
  echo "Run as root: sudo bash $0" >&2
  exit 1
fi

if [[ ! -f "$CFG" ]]; then
  echo "Config not found: $CFG" >&2
  exit 1
fi

if grep -q 'agent-update-fallback' "$CFG"; then
  echo "Already patched: $CFG"
else
  cp "$CFG" "${CFG}.bak-$(date +%Y%m%d%H%M%S)"
  python3 - "$CFG" <<'PY'
import sys
from pathlib import Path

path = Path(sys.argv[1])
text = path.read_text(encoding="utf-8")
block = """
    # SSH/WinRM и git-probe: backend ждёт до 900s
    location ~ ^/api/v1/(hosts/[0-9]+/actions/(agent-update|agent-update-fallback|ssh-test|winrm-test)|settings/agent-updates/test-git) {
        proxy_pass http://sac_api;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 960s;
        proxy_read_timeout 960s;
    }

"""
needle = "    location / {"
if needle not in text:
    raise SystemExit(f"needle not found in {path}")
path.write_text(text.replace(needle, block + needle, 1), encoding="utf-8")
print(f"Patched {path}")
PY
fi

nginx -t
systemctl reload nginx
echo "nginx reloaded OK"