#!/bin/bash
# Recurring declared-vs-live check. Installed by the goss role.
# Writes TAP + a one-line status; notifies only on pass/fail transitions.
set -euo pipefail

GOSS_BIN="${GOSS_BIN:-/usr/local/bin/goss}"
GOSS_FILE="${GOSS_FILE:-/etc/goss/baseline.yaml}"
STATE_DIR="${STATE_DIR:-/var/lib/railiance/goss}"
NOTIFY_URL="${RAILIANCE_GOSS_NOTIFY_URL:-}"
HOST="$(hostname -s)"

mkdir -p "${STATE_DIR}"
chmod 0755 "${STATE_DIR}"

if [[ ! -x "${GOSS_BIN}" || ! -f "${GOSS_FILE}" ]]; then
  echo "skip: goss binary or baseline missing" | tee "${STATE_DIR}/last.status"
  exit 0
fi

set +e
"${GOSS_BIN}" -g "${GOSS_FILE}" validate --format tap > "${STATE_DIR}/last.tap"
rc=$?
set -e

if [[ "${rc}" -eq 0 ]]; then
  result=pass
else
  result=fail
fi

printf 'result=%s host=%s ts=%s rc=%s\n' \
  "${result}" "${HOST}" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${rc}" \
  > "${STATE_DIR}/last.status"

prev=""
if [[ -f "${STATE_DIR}/last.result" ]]; then
  prev="$(cat "${STATE_DIR}/last.result")"
fi
echo "${result}" > "${STATE_DIR}/last.result"

logger -t railiance-goss "baseline ${result} on ${HOST} (rc=${rc})"

if [[ "${result}" == "fail" ]]; then
  touch "${STATE_DIR}/FAILED"
else
  rm -f "${STATE_DIR}/FAILED"
fi

if [[ -n "${NOTIFY_URL}" && "${result}" != "${prev}" ]]; then
  payload=$(printf \
    '{"summary":"Goss baseline %s on %s","event_type":"note","author":"railiance-goss-timer"}' \
    "${result}" "${HOST}")
  curl -sS -m 10 -X POST "${NOTIFY_URL}" \
    -H 'Content-Type: application/json' \
    -d "${payload}" >/dev/null || \
    logger -t railiance-goss "notify failed for ${HOST} ${result}"
fi

exit "${rc}"