#!/usr/bin/env bash
set -euo pipefail

TARGET_HOST="${TARGET_HOST:-mevnode}"
PUBLIC_IP="${PUBLIC_IP:-149.50.96.162}"
PUBLIC_HOST="${PUBLIC_HOST:-trade.mpabi.pl}"

ssh_target() {
  ssh -o StrictHostKeyChecking=no "$TARGET_HOST" "$@"
}

echo "[1/5] Host listeners"
ssh_target "sudo ss -ltn '( sport = :80 or sport = :443 )'"

echo
echo "[2/5] Controller state"
ssh_target '
  set -euo pipefail
  sudo k3s kubectl -n kube-system get ds traefik -o wide
  sudo k3s kubectl -n cert-manager get deploy -o wide
'

echo
echo "[3/5] Issuer and ingress"
ssh_target '
  set -euo pipefail
  sudo k3s kubectl get clusterissuer letsencrypt-prod -o wide
  sudo k3s kubectl -n trade-r001-canary get ingress trade-frontend-public -o wide
  sudo k3s kubectl -n trade-r001-canary get certificate,order,challenge 2>/dev/null || true
'

echo
echo "[4/5] HTTP health via public IP"
curl -fsS --resolve "${PUBLIC_HOST}:80:${PUBLIC_IP}" "http://${PUBLIC_HOST}/healthz"
echo

echo
echo "[5/5] DNS and TLS state"
resolved_ip="$(getent ahostsv4 "${PUBLIC_HOST}" | awk 'NR==1 {print $1}')"
echo "resolved_ip=${resolved_ip:-<none>}"
if [ "${resolved_ip:-}" = "${PUBLIC_IP}" ]; then
  curl -fsS --resolve "${PUBLIC_HOST}:443:${PUBLIC_IP}" "https://${PUBLIC_HOST}/healthz"
  echo
else
  echo "TLS check skipped until ${PUBLIC_HOST} resolves to ${PUBLIC_IP}"
fi

echo
echo "Public edge check completed for ${PUBLIC_HOST}"