#!/usr/bin/env bash
# Ensure the deployed DBIS frontend/API surfaces on r630-01 stay healthy.
#
# Expected runtime:
# - VMID 10130: nginx serving the built DBIS frontend on port 80
# - VMID 10150: dbis-api.service serving the primary DBIS API on port 3000
# - VMID 10151: dbis-api.service serving the secondary DBIS API on port 3000
#
# Usage: ./scripts/maintenance/ensure-dbis-services-via-ssh.sh [--dry-run]
# Env: PROXMOX_HOST_R630_01 (default 192.168.11.11)
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
[[ -f "${PROJECT_ROOT}/scripts/lib/load-project-env.sh" ]] && source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh" 2>/dev/null || true

DRY_RUN=false
[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true

PROXMOX_HOST="${PROXMOX_HOST_R630_01:-192.168.11.11}"

log_info() { echo -e "\033[0;34m[INFO]\033[0m $1"; }
log_ok()   { echo -e "\033[0;32m[✓]\033[0m $1"; }
log_warn() { echo -e "\033[0;33m[⚠]\033[0m $1"; }

run_ssh() { ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@"$PROXMOX_HOST" "$@"; }

build_url() {
  local ip="$1"
  local port="$2"
  local path="$3"
  if [[ "$port" == "80" ]]; then
    printf 'http://%s%s' "$ip" "$path"
  else
    printf 'http://%s:%s%s' "$ip" "$port" "$path"
  fi
}

ensure_service_surface() {
  local vmid="$1"
  local ip="$2"
  local port="$3"
  local path="$4"
  local service="$5"
  local label="$6"
  local status
  local local_url
  local remote_url
  local local_check
  local remote_script

  status="$(run_ssh "pct status $vmid 2>/dev/null | awk '{print \$2}'" 2>/dev/null || echo "missing")"
  if [[ "$status" != "running" ]]; then
    log_warn "$label (VMID $vmid) is not running"
    return 0
  fi

  local_url="$(build_url "$ip" "$port" "$path")"
  remote_url="$(build_url "127.0.0.1" "$port" "$path")"

  local_check="$(run_ssh "timeout 5 curl -sS -o /dev/null -w '%{http_code}' ${local_url@Q} 2>/dev/null || true" | tr -d '\r\n')"
  if [[ "$local_check" == "200" ]]; then
    log_ok "$label already responds at $local_url"
    return 0
  fi

  if [[ "$DRY_RUN" == true ]]; then
    log_info "Would restart $service on VMID $vmid and recheck $local_url"
    return 0
  fi

  printf -v remote_script '%s' "$(cat <<EOF
set -e
systemctl reset-failed ${service} >/dev/null 2>&1 || true
systemctl restart ${service}
for _ in \$(seq 1 15); do
  if curl -fsS ${remote_url@Q} >/dev/null 2>&1; then
    exit 0
  fi
  sleep 2
done
curl -fsS ${remote_url@Q} >/dev/null
EOF
)"

  if ! run_ssh "pct exec $vmid -- bash --norc -lc $(printf '%q' "$remote_script")"; then
    log_warn "$label restart path failed on VMID $vmid"
  fi

  local_check="$(run_ssh "timeout 5 curl -sS -o /dev/null -w '%{http_code}' ${local_url@Q} 2>/dev/null || true" | tr -d '\r\n')"
  if [[ "$local_check" == "200" ]]; then
    log_ok "$label restored at $local_url"
  else
    log_warn "$label still not healthy at $local_url (curl=${local_check:-000})"
  fi
}

echo ""
echo "=== Ensure DBIS deployed services ==="
echo "  Host: $PROXMOX_HOST  dry-run=$DRY_RUN"
echo ""

ensure_service_surface 10130 "192.168.11.130" "80" "/" "nginx" "DBIS frontend"
ensure_service_surface 10150 "192.168.11.155" "3000" "/v1/health" "dbis-api.service" "DBIS API primary"
ensure_service_surface 10151 "192.168.11.156" "3000" "/v1/health" "dbis-api.service" "DBIS API secondary"

echo ""