#!/usr/bin/env bash
set -uo pipefail
source '{{ healthcheck_install_root }}/health-common.sh'

require_command docker
require_command curl
require_command dig
check_compose

image="$(docker inspect pdns-auth --format '{{ '{{' }}.Config.Image{{ '}}' }}' 2>/dev/null)" || record critical 'pdns_container_missing'
grep -Eq ':5\.0\.[6-9]|:5\.[1-9]\.' <<<"$image" || record warning 'pdns_version_not_confirmed'
security="$(docker logs pdns-auth 2>&1 | grep -i 'Mandatory.*Security Update' || true)"
[[ -z "$security" ]] || record critical 'pdns_security_update_banner'

# The API key remains in the container environment; the request emits only the
# reported version and no authentication material.
api="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T auth python3 - <<'PY' 2>&1
import json, os, urllib.request
request=urllib.request.Request('http://127.0.0.1:8081/api/v1/servers/localhost', headers={'X-API-Key': os.environ['PDNS_API_KEY']})
print(json.load(urllib.request.urlopen(request, timeout=10))['version'])
PY
)" || record critical 'pdns_api_failed'
grep -Eq '^5\.' <<<"$api" || record critical 'pdns_api_version_invalid'

for zone in windy.me wsvc.info chans.xyz; do
  primary="$(dig +short @154.36.174.161 SOA "$zone" 2>/dev/null)"
  secondary="$(dig +short @202.91.35.141 SOA "$zone" 2>/dev/null)"
  [[ -n "$primary" ]] || record critical "soa_primary_missing_${zone}"
  [[ -n "$secondary" ]] || record critical "soa_secondary_missing_${zone}"
  [[ "$primary" == "$secondary" ]] || record warning "soa_secondary_lag_${zone}"
done

check_https 'https://pdns.wsvc.info/' '^30[12]$'
check_https 'https://pgweb.wsvc.info/' '^(200|401)$'
check_backup_freshness '*/backup/*.sql.gz'
emit_result
exit "$EXIT_CODE"