#!/usr/bin/env bash
set -euo pipefail

PRIVATE_ADMIN_HOSTS=(
  gotify.lan.ddnsgeek.com
  grafana.lan.ddnsgeek.com
  prometheus.lan.ddnsgeek.com
  node-red.lan.ddnsgeek.com
  traefik.lan.ddnsgeek.com
  portainer.lan.ddnsgeek.com
  influxdb.lan.ddnsgeek.com
  kuma.lan.ddnsgeek.com
  monitor-kuma.lan.ddnsgeek.com
)

echo "[+] External retest started: $(date -u +'%Y-%m-%dT%H:%M:%SZ')"

a11y_failures=0
for host in "${PRIVATE_ADMIN_HOSTS[@]}"; do
  code=$(curl -k -sS -o /dev/null -m 10 -w '%{http_code}' "https://${host}" || true)
  if [[ "$code" == "000" || "$code" == "403" || "$code" == "401" ]]; then
    echo "[PASS] ${host} blocked externally (code=${code})"
  else
    echo "[FAIL] ${host} appears reachable externally (code=${code})"
    a11y_failures=$((a11y_failures + 1))
  fi
done

echo
if [[ $a11y_failures -eq 0 ]]; then
  echo "[PASS] Non-public services are inaccessible from this source path."
  exit 0
else
  echo "[FAIL] ${a11y_failures} private-admin service(s) still externally reachable."
  exit 1
fi