#!/usr/bin/env bash
# Read-only health check for the FreeIPA server.
# Run locally on domain-controller or remotely:
#   ssh wayne@domain-controller 'bash -s' < scripts/verify.sh
#
# Exit code 0 = all checks passed, non-zero = something is wrong.

set -uo pipefail

PASS=0
FAIL=0

check() {
  local label="$1"
  shift
  if "$@" >/dev/null 2>&1; then
    echo "  OK  $label"
    (( PASS++ )) || true
  else
    echo "FAIL  $label"
    (( FAIL++ )) || true
  fi
}

echo "=== FreeIPA health check: $(hostname -f) ==="
echo ""

echo "--- Services ---"
check "ipactl status"       sudo ipactl status
check "dirsrv running"      systemctl is-active dirsrv.target
check "krb5kdc running"     systemctl is-active krb5kdc
check "named running"       systemctl is-active named
check "httpd running"       systemctl is-active httpd
check "pki-tomcatd running" systemctl is-active pki-tomcatd.target

echo ""
echo "--- DNS ---"
check "A record: domain-controller.sweet.home"   dig +short domain-controller.sweet.home A @127.0.0.1
check "SRV: _kerberos._udp.sweet.home"           dig +short _kerberos._udp.sweet.home SRV @127.0.0.1
check "SRV: _ldap._tcp.sweet.home"               dig +short _ldap._tcp.sweet.home SRV @127.0.0.1
check "TXT: _kerberos.sweet.home"                dig +short _kerberos.sweet.home TXT @127.0.0.1

echo ""
echo "--- LDAP ---"
check "LDAP port 389 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/389"
check "LDAPS port 636 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/636"

echo ""
echo "--- Kerberos ---"
check "KDC port 88 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/88"

echo ""
echo "--- HTTP ---"
check "IPA HTTP redirect" curl -sk -o /dev/null -w "%{http_code}" http://localhost/ | grep -qE "^(301|302|200)"
check "IPA HTTPS UI"      curl -sk -o /dev/null -w "%{http_code}" https://localhost/ipa/ui/ | grep -q "200"

echo ""
if [[ $FAIL -eq 0 ]]; then
  echo "All $PASS checks passed."
else
  echo "$FAIL check(s) FAILED, $PASS passed."
  exit 1
fi