#!/usr/bin/env bash
# Checks the vault and SilverBullet on the agent host; run there as a user with
# sudo (scripts/agent-host.sh check sends it). Exits 1 if any check fails, and
# only says "all checks passed" once every one has run.
set -u
stack=${STACK:-/opt/stacks/silverbullet}
fail=0
ok() { echo "ok:   $1"; }
bad() { echo "FAIL: $1"; fail=1; }
cd "$stack" || { echo "FAIL: no $stack"; exit 1; }
[ "$(sudo docker compose ps --status running -q | wc -l)" -ge 1 ] \
  && ok "SilverBullet is running" || bad "SilverBullet isn't running"
if sudo docker compose logs --no-color silverbullet 2>/dev/null | grep -q 'boot mode: single-space'; then
  ok "it serves the vault as one space (no setup wizard)"
else
  bad "it didn't boot one space: the setup wizard may be open"
fi
code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/)
case $code in 2??|3??) ok "it answers locally ($code)" ;; *) bad "it answers $code" ;; esac
probe=.nisse-probe-$$
sudo docker compose exec -T -u 1000 silverbullet \
  sh -c "touch /data/infrastructure/$probe && rm /data/infrastructure/$probe" \
  && ok "the operator's folders are writable" || bad "the operator's folders aren't writable"
if sudo docker compose exec -T silverbullet sh -c "touch /data/memory/$probe" 2>/dev/null; then
  sudo docker compose exec -T silverbullet rm -f "/data/memory/$probe"
  bad "memory/ is writable from SilverBullet, even as root in it"
else
  ok "memory/ is read-only to SilverBullet"
fi
sudo iptables -S DOCKER-USER | grep -q -- '--comment nisse-firewall' \
  && ok "the firewall rule is in place" || bad "no firewall rule"
[ $fail = 0 ] && echo "all checks passed"
exit $fail