#!/usr/bin/env bash
set -uo pipefail
source '{{ healthcheck_install_root }}/health-common.sh'

require_command docker
require_command ss
check_compose

container='wireguard'
if ! docker inspect "$container" >/dev/null 2>&1; then
  record critical 'wireguard_container_missing'
else
  running="$(docker inspect "$container" --format '{{ '{{' }}.State.Running{{ '}}' }}' 2>/dev/null)"
  [[ "$running" == true ]] || record critical 'wireguard_container_not_running'

  interface="$(docker exec "$container" wg show interfaces 2>/dev/null || true)"
  grep -qw 'wg0' <<<"$interface" || record critical 'wireguard_wg0_missing'

  configured_peer_count="$(docker exec "$container" sh -c 'find /config -mindepth 1 -maxdepth 1 -type d -name "peer_*" | wc -l' 2>/dev/null || true)"
  runtime_peer_count="$(docker exec "$container" wg show wg0 dump 2>/dev/null | awk 'NR > 1 { count++ } END { print count + 0 }')"
  [[ "$configured_peer_count" =~ ^[0-9]+$ ]] || record unknown 'wireguard_configured_peer_count_unknown'
  [[ "$runtime_peer_count" =~ ^[0-9]+$ ]] || record unknown 'wireguard_runtime_peer_count_unknown'
  if [[ "$configured_peer_count" =~ ^[0-9]+$ && "$runtime_peer_count" =~ ^[0-9]+$ ]]; then
    [[ "$configured_peer_count" -eq "$runtime_peer_count" ]] || record warning "wireguard_peer_count_mismatch_${configured_peer_count}_${runtime_peer_count}"
  fi
fi

if ss -H -uln 2>/dev/null | awk '{print $4}' | grep -Eq '(^|:)51820$'; then
  record ok 'wireguard_udp_51820_listening'
else
  record critical 'wireguard_udp_51820_missing'
fi

emit_result
exit "$EXIT_CODE"