#!/usr/bin/env bash
# HTTPS availability watchdog for Les Petites Leçons de Frédéric (punycode host).
# Intended path on proxy: /opt/proxy-config/scripts/watch-https-lpldf.sh
# Optional env file (root-only recommended): /opt/proxy-config/scripts/env/watch-https-lpldf.env
# Syslog identifier: lpldf-https-watch (for SIEM / Wazuh-style log collection).
set -euo pipefail

_IA_DEV_TOOLS="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
if [[ -f "${_IA_DEV_TOOLS}/lib/smart_ide_logs.sh" ]]; then
	# shellcheck source=../lib/smart_ide_logs.sh
	source "${_IA_DEV_TOOLS}/lib/smart_ide_logs.sh"
	smart_ide_logs_begin "$_IA_DEV_TOOLS" "$0" "$*"
	smart_ide_logs_register_exit_trap
fi

readonly WATCH_URL="${WATCH_URL:-https://xn--lespetitesleonsdefrdric-89b1db.fr/}"
readonly STATE_DIR="${STATE_DIR:-/var/lib/lpldf-https-watch}"
readonly STATE_FILE="${STATE_DIR}/last_state"
readonly LAST_ALERT_FILE="${STATE_DIR}/last_alert_epoch"
readonly LOG_TAG="lpldf-https-watch"

ENV_FILE="${ENV_FILE:-/opt/proxy-config/scripts/env/watch-https-lpldf.env}"
if [[ -f "$ENV_FILE" ]]; then
	set -a
	# shellcheck disable=SC1090
	source "$ENV_FILE"
	set +a
fi

readonly ALERT_REPEAT_SECONDS="${ALERT_REPEAT_SECONDS:-3600}"

mkdir -p "$STATE_DIR"

last="OK"
if [[ -f "$STATE_FILE" ]]; then
	last="$(tr -d '\n' <"$STATE_FILE" || true)"
fi
[[ -z "$last" ]] && last="OK"

http_code="000"
if ! http_code="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 25 "$WATCH_URL" 2>/dev/null)"; then
	http_code="000"
fi
[[ -z "$http_code" ]] && http_code="000"

is_ok="false"
if [[ "$http_code" =~ ^(200|301|302|307|308)$ ]]; then
	is_ok="true"
fi

send_notifications() {
	local message="$1"
	logger -t "$LOG_TAG" -p daemon.warning "$message"
	if [[ -n "${ALERT_WEBHOOK_URL:-}" ]]; then
		curl -sS -X POST "${ALERT_WEBHOOK_URL}" \
			-H "Content-Type: text/plain; charset=utf-8" \
			--data-binary "$message" \
			--max-time 15 || logger -t "$LOG_TAG" -p daemon.err "ALERT_WEBHOOK_URL post failed"
	fi
	if [[ -n "${ALERT_EMAIL_TO:-}" ]] && command -v mail >/dev/null 2>&1; then
		printf '%s\n' "$message" | mail -s "LPLDF HTTPS down" "$ALERT_EMAIL_TO" || logger -t "$LOG_TAG" -p daemon.err "mail alert failed"
	fi
}

notify_recovery() {
	local message="$1"
	logger -t "$LOG_TAG" -p daemon.info "$message"
	if [[ -n "${ALERT_WEBHOOK_URL_RECOVER:-}" ]]; then
		curl -sS -X POST "${ALERT_WEBHOOK_URL_RECOVER}" \
			-H "Content-Type: text/plain; charset=utf-8" \
			--data-binary "$message" \
			--max-time 15 || true
	fi
}

now_epoch="$(date +%s)"

if [[ "$is_ok" == "true" ]]; then
	if [[ "$last" == "DOWN" ]]; then
		notify_recovery "LPLDF HTTPS recovered: ${WATCH_URL} HTTP ${http_code}"
	fi
	printf '%s\n' "OK" >"$STATE_FILE"
	exit 0
fi

msg="LPLDF HTTPS check FAIL: ${WATCH_URL} HTTP=${http_code}"

if [[ "$last" != "DOWN" ]]; then
	printf '%s\n' "DOWN" >"$STATE_FILE"
	printf '%s\n' "$now_epoch" >"$LAST_ALERT_FILE"
	send_notifications "$msg"
	exit 1
fi

last_alert="0"
if [[ -f "$LAST_ALERT_FILE" ]]; then
	last_alert="$(tr -d '\n' <"$LAST_ALERT_FILE" || echo 0)"
fi
[[ -z "$last_alert" ]] && last_alert="0"

if [[ "$((now_epoch - last_alert))" -ge "$ALERT_REPEAT_SECONDS" ]]; then
	printf '%s\n' "$now_epoch" >"$LAST_ALERT_FILE"
	send_notifications "$msg (still down, repeat every ${ALERT_REPEAT_SECONDS}s)"
fi

exit 1