#!/usr/bin/env bash
set -euo pipefail

# Verify the deployed DBIS RTGS first-slice sidecars on Proxmox VE.

HOST="${PROXMOX_HOST_R630_02:-192.168.11.12}"
SSH_OPTS="-o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new"

check_ct() {
  local vmid="$1"
  local hostname="$2"
  local service="$3"

  echo "=== CT $vmid ($hostname) ==="
  ssh $SSH_OPTS "root@$HOST" "pct status $vmid"
  ssh $SSH_OPTS "root@$HOST" "pct exec $vmid -- bash -lc 'systemctl is-active redis-server'"
  ssh $SSH_OPTS "root@$HOST" "pct exec $vmid -- bash -lc 'systemctl is-active $service'"
  ssh $SSH_OPTS "root@$HOST" "pct exec $vmid -- bash -lc 'curl -sf http://127.0.0.1:8080/actuator/health'"
  echo
}

echo "=== DBIS RTGS first-slice runtime check ==="
echo "Host: $HOST"
echo

check_ct 5802 rtgs-scsm-1 dbis-rtgs-scsm
check_ct 5803 rtgs-funds-1 dbis-rtgs-funds
check_ct 5804 rtgs-xau-1 dbis-rtgs-xau

echo "=== Fineract reachability from sidecars ==="
for vmid in 5802 5803 5804; do
  printf 'CT %s -> ' "$vmid"
  ssh $SSH_OPTS "root@$HOST" "pct exec $vmid -- bash -lc 'curl -s -o /tmp/fineract.out -w \"%{http_code}\" http://192.168.11.85:8080/fineract-provider/api/v1/offices'"
  echo
done

echo
echo "Interpretation:"
echo "- 200 means unauthenticated route unexpectedly open or credentials baked into proxy"
echo "- 400/401 means HTTP reachability exists, but authenticated tenant flow is not yet frozen"