#!/usr/bin/env bash
set -uo pipefail
source '{{ healthcheck_install_root }}/health-common.sh'

require_command docker
require_command ss

# Auxiliary services co-located on hk2.chans.xyz (separate compose projects
# under /opt, fronted by Traefik). Verified live 2026-08-12.

# traefik
if docker inspect traefik >/dev/null 2>&1; then
  [[ "$(docker inspect traefik --format '{{ '{{' }}.State.Running{{ '}}' }}' 2>/dev/null)" == true ]] \
    && record ok 'traefik_running' || record critical 'traefik_not_running'
else
  record critical 'traefik_container_missing'
fi

# adguardhome (hk2 variant: DoH 5443, DoT 853)
if docker inspect adguardhome >/dev/null 2>&1; then
  [[ "$(docker inspect adguardhome --format '{{ '{{' }}.State.Running{{ '}}' }}' 2>/dev/null)" == true ]] \
    && record ok 'adguard_running' || record critical 'adguard_not_running'
else
  record critical 'adguard_container_missing'
fi

# remark42
if docker inspect remark42 >/dev/null 2>&1; then
  [[ "$(docker inspect remark42 --format '{{ '{{' }}.State.Running{{ '}}' }}' 2>/dev/null)" == true ]] \
    && record ok 'remark42_running' || record critical 'remark42_not_running'
else
  record critical 'remark42_container_missing'
fi

# nginx-manager was removed 2026-08-12 (leftover config, never running).
# Warn if a container by that name ever reappears.
if docker inspect nginx-manager >/dev/null 2>&1; then
  record warning 'nginx_manager_unexpectedly_running'
else
  record ok 'nginx_manager_not_running'
fi

# Listening ports (Traefik 80/443/8080, AdGuard DoH 5443 / DoT 853).
ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)80$' \
  && record ok 'traefik_http_80' || record critical 'traefik_http_80_missing'
ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)443$' \
  && record ok 'traefik_https_443' || record critical 'traefik_https_443_missing'
ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)8080$' \
  && record ok 'traefik_dashboard_8080' || record warning 'traefik_dashboard_8080_missing'
ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)5443$' \
  && record ok 'adguard_doh_5443' || record critical 'adguard_doh_5443_missing'
ss -H -ltn 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)853$' \
  && record ok 'adguard_dot_853' || record critical 'adguard_dot_853_missing'

emit_result
exit "$EXIT_CODE"