#!/bin/sh
set -u

repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
cd "$repo" || exit 2
env_file=${COMPOSE_ENV_FILE:-.env.production}
if [ ! -r "$env_file" ]; then
  printf 'CRITICAL rf4spotter failures="env-file-unreadable"\n'
  exit 2
fi

read_env() {
  key=$1
  value=$(sed -n "s/^${key}=//p" "$env_file" | tail -n 1)
  printf '%s' "$value"
}

site_domain=${SITE_DOMAIN:-$(read_env SITE_DOMAIN)}
backup_root=${BACKUP_ROOT:-$(read_env BACKUP_ROOT)}
disk_max=${MONITOR_DISK_MAX_PERCENT:-$(read_env MONITOR_DISK_MAX_PERCENT)}
tls_days=${MONITOR_TLS_MIN_DAYS:-$(read_env MONITOR_TLS_MIN_DAYS)}
backup_hours=${MONITOR_BACKUP_MAX_HOURS:-$(read_env MONITOR_BACKUP_MAX_HOURS)}
db_max_mb=${MONITOR_DB_MAX_MB:-$(read_env MONITOR_DB_MAX_MB)}
minio_max_mb=${MONITOR_MINIO_MAX_MB:-$(read_env MONITOR_MINIO_MAX_MB)}
disk_max=${disk_max:-85}
tls_days=${tls_days:-14}
backup_hours=${backup_hours:-26}
db_max_mb=${db_max_mb:-2048}
minio_max_mb=${minio_max_mb:-10240}
for value in "$disk_max" "$tls_days" "$backup_hours" "$db_max_mb" "$minio_max_mb"; do
  case "$value" in ''|*[!0-9]*) printf 'CRITICAL rf4spotter failures="monitor-threshold-invalid"\n'; exit 2 ;; esac
done
base_url=${MONITOR_BASE_URL:-https://$site_domain}
compose="docker compose --env-file $env_file -f compose.production.yaml"
failures=""

fail() {
  failures="${failures}${failures:+; }$1"
}

running=$($compose ps --status running --services 2>/dev/null) || running=""
for service in proxy db minio api web; do
  printf '%s\n' "$running" | grep -qx "$service" || fail "service:$service"
done

ready_payload=$(curl -fsS --max-time 10 "$base_url/ready" 2>/dev/null) || ready_payload=""
printf '%s' "$ready_payload" | grep -Eq '"status"[[:space:]]*:[[:space:]]*"ready"' || fail "readiness"

disk_used=$(df -Pk "$repo" | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
case "$disk_used" in
  ''|*[!0-9]*) fail "disk:unknown" ;;
  *) [ "$disk_used" -lt "$disk_max" ] || fail "disk:${disk_used}%" ;;
esac

db_bytes=$($compose exec -T db sh -c 'psql -At -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select pg_database_size(current_database())"' 2>/dev/null) || db_bytes=""
case "$db_bytes" in
  ''|*[!0-9]*) db_mb="unknown"; fail "postgresql-size:unknown" ;;
  *) db_mb=$(((db_bytes + 1048575) / 1048576)); [ "$db_mb" -lt "$db_max_mb" ] || fail "postgresql-size:${db_mb}MB" ;;
esac

minio_kb=$($compose exec -T minio du -sk /data 2>/dev/null | awk 'NR==1 {print $1}')
case "$minio_kb" in
  ''|*[!0-9]*) minio_mb="unknown"; fail "minio-size:unknown" ;;
  *) minio_mb=$(((minio_kb + 1023) / 1024)); [ "$minio_mb" -lt "$minio_max_mb" ] || fail "minio-size:${minio_mb}MB" ;;
esac

if [ -z "$backup_root" ] || [ ! -d "$backup_root" ]; then
  fail "backup:directory"
else
  recent_backup=$(find "$backup_root" -mindepth 2 -maxdepth 2 -name SHA256SUMS -mmin "-$((backup_hours * 60))" -print -quit 2>/dev/null)
  if [ -z "$recent_backup" ]; then
    fail "backup:stale"
  else
    (cd "$(dirname "$recent_backup")" && sha256sum -c --quiet SHA256SUMS) >/dev/null 2>&1 || fail "backup:checksum"
  fi
fi

if [ -z "$site_domain" ]; then
  fail "tls:domain"
else
  tls_seconds=$((tls_days * 86400))
  certificate=$(openssl s_client -servername "$site_domain" -connect "$site_domain:443" </dev/null 2>/dev/null | openssl x509 -outform PEM 2>/dev/null) || certificate=""
  if [ -z "$certificate" ]; then
    fail "tls:unavailable"
  else
    printf '%s\n' "$certificate" | openssl x509 -checkend "$tls_seconds" -noout >/dev/null 2>&1 || fail "tls:expires-soon"
  fi
fi

timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
if [ -n "$failures" ]; then
  printf 'CRITICAL rf4spotter timestamp=%s failures="%s"\n' "$timestamp" "$failures"
  exit 1
fi

printf 'OK rf4spotter timestamp=%s disk_used=%s%% postgresql=%sMB minio=%sMB backup_max_age=%sh tls_min=%sd\n' "$timestamp" "$disk_used" "$db_mb" "$minio_mb" "$backup_hours" "$tls_days"