#!/bin/bash
# Site Guardian — monitors critical sites + core services, auto-heals on failure.
# Runs every minute via systemd timer. Logs to /opt/site-guardian/logs/guardian.log
LOG=/opt/site-guardian/logs/guardian.log
SITES=(levelupforlocal.com cmptv.ca news.cmptv.ca manage.cmptv.ca communitymarketplace.ca planetgiftcards.org ordereats.ca)
ts(){ date '+%Y-%m-%d %H:%M:%S'; }
log(){ echo "[$(ts)] $*" >> "$LOG"; }

healed=0

# 1. Core service liveness — restart if dead
for svc in httpd nginx; do
  if ! systemctl is-active --quiet $svc; then
    log "SERVICE DOWN: $svc — attempting restart"
    # If httpd won't start due to SSL pair issue, auto-repair first
    if [ "$svc" = "httpd" ] && ! /usr/sbin/httpd -t >/dev/null 2>&1; then
      log "httpd config invalid — running ssl auto-repair"
      /opt/site-guardian/ssl-repair.sh >> "$LOG" 2>&1
    fi
    if [ "$svc" = "nginx" ] && ! /usr/sbin/nginx -t >/dev/null 2>&1; then
      log "nginx config invalid — running ssl auto-repair"
      /opt/site-guardian/ssl-repair.sh >> "$LOG" 2>&1
    fi
    systemctl restart $svc >> "$LOG" 2>&1 && log "RESTARTED: $svc" || log "RESTART FAILED: $svc"
    healed=1
  fi
done

# 2. Apache backend ports must be listening (81/444)
if systemctl is-active --quiet httpd; then
  for port in 81 444; do
    if ! ss -tln 2>/dev/null | grep -q ":$port "; then
      log "Apache backend port $port not listening — restarting httpd"
      systemctl restart httpd >> "$LOG" 2>&1; healed=1
    fi
  done
fi

# 3. HTTP health of each site (origin, bypassing Cloudflare cache via direct Apache backend)
down=()
for s in "${SITES[@]}"; do
  code=$(curl -s -H "Host: $s" "http://127.0.0.1:81/" --max-time 15 -o /dev/null -w "%{http_code}" 2>/dev/null)
  case "$code" in
    2*|3*) : ;;  # healthy
    *) down+=("$s:$code") ;;
  esac
done
if [ ${#down[@]} -gt 0 ]; then
  log "SITES UNHEALTHY at origin: ${down[*]}"
  # Backend serving bad codes -> bounce php-fpm + apache
  if [ $healed -eq 0 ]; then
    log "Bouncing PHP-FPM + httpd to recover unhealthy sites"
    systemctl restart 'ea-php*-php-fpm' >> "$LOG" 2>&1
    systemctl restart httpd >> "$LOG" 2>&1
    healed=1
  fi
fi

# 4. SSL datastore integrity drift detection (cheap, every run)
if ! /opt/site-guardian/ssl-audit.sh >> "$LOG" 2>&1; then
  log "SSL AUDIT FAILED — running auto-repair"
  /opt/site-guardian/ssl-repair.sh >> "$LOG" 2>&1
  systemctl reload nginx >> "$LOG" 2>&1
  systemctl reload httpd >> "$LOG" 2>&1
  healed=1
fi

[ $healed -eq 1 ] && log "Guardian took corrective action this cycle."
exit 0