#!/bin/bash
# check-caddy-backends.sh — validate all Caddy reverse_proxy targets are reachable
# Run this on hubris (192.168.8.77) or any host on the homelab LAN.
# Returns non-zero if any backend is unreachable.
# Uses curl with a short timeout for reliable TCP checks.
set -o pipefail

CADDY_HOST="192.168.8.175"

echo "=== Caddy backend connectivity check ==="
echo "Date: $(date)"
echo ""

TMPFILE=$(mktemp /tmp/caddy-checks.XXXXXX)
trap "rm -f $TMPFILE" EXIT

# Extract unique IP:port targets from Caddyfile
ssh root@"$CADDY_HOST" "grep reverse_proxy /etc/caddy/Caddyfile \
  | grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d+' \
  | sort -u" > "$TMPFILE"

TOTAL=0
FAILED=0

while read -r target; do
  [ -z "$target" ] && continue
  TOTAL=$((TOTAL + 1))
  # Use curl with 3s connect timeout for reliable TCP check
  if timeout 3 curl -s -o /dev/null --connect-timeout 2 "$target" 2>/dev/null; then
    echo "  ✅ $target"
  elif timeout 2 bash -c "echo >/dev/tcp/${target/:/\/}" 2>/dev/null; then
    echo "  ⚠️ $target — port open, no HTTP response"
  else
    echo "  ❌ $target — unreachable"
    FAILED=$((FAILED + 1))
  fi
done < "$TMPFILE"

echo ""
echo "Checked $TOTAL targets, $FAILED failures"
exit $FAILED