#!/usr/bin/env bash
# ONE-SHOT as root: publish monitoring HTML + enable Caddy handles
#
# Suite copy (taler-monitoring host-agent). Live install path on koopa:
#   ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
# Prefer absolute path ( ~ expands to /root when already root ):
#   sudo ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh
#   ${KOOPA_CADDY_DIR}/apply-monitoring-live.sh   # if already root
#
# After editing here: rsync to koopa ~/koopa-caddy/ before root apply.
set -euo pipefail
if [[ "$(id -u)" -ne 0 ]]; then
  exec sudo -E "$0" "$@"
fi

STAGING="${DEPLOY_STAGING:-${HTML_OUT:-$HOME/monitoring-sites-staging}}"
WWW="${DEPLOY_WWW_ROOT:?set DEPLOY_WWW_ROOT in env}"
SRC="${KOOPA_CADDY_DIR:?set KOOPA_CADDY_DIR in env}/Caddyfile"
DST=/etc/caddy/Caddyfile

if [[ ! -f "$SRC" ]]; then
  echo "ERROR: missing Caddyfile source: $SRC" >&2
  exit 1
fi
if [[ ! -d "$STAGING" ]]; then
  echo "ERROR: missing staging HTML: $STAGING" >&2
  exit 1
fi

echo "== 1) HTML staging → www =="
mkdir -p "$WWW"
rsync -a --delete "$STAGING/" "$WWW/"
# allow hernani to update future runs without root
chown -R hernani:caddy "$WWW"
chmod -R g+rwX "$WWW"
find "$WWW" -type d -exec chmod g+s {} \;
# ACL default if available
if command -v setfacl >/dev/null 2>&1; then
  setfacl -R -m u:hernani:rwx,g:caddy:rwx "$WWW" || true
  setfacl -R -d -m u:hernani:rwx,g:caddy:rwx "$WWW" || true
fi
ls -la "$WWW" "$WWW/taler.hacktivism.ch" || true

echo "== 2) Caddyfile (backup + install) =="
ts=$(date +%Y%m%d-%H%M%S)
cp -a "$DST" "/etc/caddy/Caddyfile.bak-monitoring-${ts}"
cp -a "$SRC" "$DST"
chown root:caddy "$DST" 2>/dev/null || chown root:root "$DST"
chmod 644 "$DST"
caddy validate --config "$DST"
systemctl reload caddy
systemctl is-active caddy

echo "== 3) smoke =="
# bash: every continued line except the last must end with \
urls=(
  https://taler.hacktivism.ch/monitoring/
  https://bank.hacktivism.ch/monitoring/
  https://exchange.hacktivism.ch/monitoring/
  https://taler.hacktivism.ch/monitoring-max-ladder/
  https://bank.hacktivism.ch/monitoring-max-ladder/
  https://exchange.hacktivism.ch/monitoring-max-ladder/
  https://taler.hacktivism.ch/taler-monitoring-surface
  https://taler.hacktivism.ch/taler-monitoring-surface/
  https://taler.hacktivism.ch/taler-monitoring-surface_err/
  https://taler.hacktivism.ch/taler-monitoring-aptdeploy/
  https://taler.hacktivism.ch/taler-monitoring-aptdeploy_err/
)
smoke_fail=0
for url in "${urls[@]}"; do
  code=$(curl -sS -o /tmp/monchk -w '%{http_code}' -L --max-redirs 3 -m 12 "$url" || echo ERR)
  ct=$(file -b /tmp/monchk 2>/dev/null | head -c 40)
  echo "  $code  $url  ($ct)"
  if grep -qE '"code":[[:space:]]*21' /tmp/monchk 2>/dev/null; then
    echo "    STILL merchant JSON code 21 — Caddy handles not active?"
    smoke_fail=1
  fi
done
# bare path must redirect (or land on HTML), not merchant JSON
bare_code=$(curl -sS -o /tmp/monbare -w '%{http_code}' --max-redirs 0 -m 12 \
  https://taler.hacktivism.ch/taler-monitoring-surface || echo ERR)
if grep -qE '"code":[[:space:]]*21' /tmp/monbare 2>/dev/null; then
  echo "ERROR: bare /taler-monitoring-surface still merchant code 21 (HTTP $bare_code)" >&2
  smoke_fail=1
elif [[ "$bare_code" != "302" && "$bare_code" != "301" && "$bare_code" != "200" ]]; then
  echo "WARN: bare /taler-monitoring-surface HTTP $bare_code (want 302/301/200 HTML)" >&2
fi
echo "  bare_no_follow=$bare_code  https://taler.hacktivism.ch/taler-monitoring-surface"

if [[ "$smoke_fail" -ne 0 ]]; then
  echo "ERROR: smoke failed" >&2
  exit 1
fi
echo "OK apply-monitoring-live done"