#!/bin/bash

# Verify Complete Path: DNS → UDM Pro → NPMplus → VMID 5000

set -uo pipefail

DOMAIN="explorer.d-bis.org"
PUBLIC_IP="76.53.10.36"
NPMPLUS_IP="192.168.11.166"
VM_IP="192.168.11.140"

# Colors
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

echo "=========================================="
echo "Complete Path Verification"
echo "=========================================="
echo ""

ALL_GOOD=true

# Test 1: DNS
echo -e "${BLUE}1. DNS Resolution${NC}"
DNS_IP=$(dig +short $DOMAIN A 2>/dev/null | head -1 || echo "")
if [ "$DNS_IP" = "$PUBLIC_IP" ]; then
    echo -e "${GREEN}   ✅ DNS: $DOMAIN → $DNS_IP${NC}"
else
    echo -e "${RED}   ❌ DNS: $DOMAIN → $DNS_IP (Expected: $PUBLIC_IP)${NC}"
    ALL_GOOD=false
fi

# Test 2: NPMplus to VM
echo -e "${BLUE}2. NPMplus → VMID 5000${NC}"
NPMPLUS_TO_VM=$(ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 root@192.168.11.10 \
  "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 root@r630-01 'pct exec 10233 -- curl -s -H \"Host: $DOMAIN\" -o /dev/null -w \"%{http_code}\" --connect-timeout 5 http://$VM_IP:80/ 2>/dev/null'" 2>&1 || echo "000")

if [ "$NPMPLUS_TO_VM" = "200" ]; then
    echo -e "${GREEN}   ✅ NPMplus can serve $DOMAIN (HTTP $NPMPLUS_TO_VM)${NC}"
else
    echo -e "${RED}   ❌ NPMplus cannot serve $DOMAIN (HTTP $NPMPLUS_TO_VM)${NC}"
    ALL_GOOD=false
fi

# Test 3: NPMplus HTTPS
echo -e "${BLUE}3. NPMplus HTTPS (internal)${NC}"
NPMPLUS_HTTPS=$(ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 root@192.168.11.10 \
  "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 root@r630-01 'pct exec 10233 -- curl -s -k -I https://localhost:443 -H \"Host: $DOMAIN\" 2>/dev/null | head -1'" 2>&1 || echo "")

if echo "$NPMPLUS_HTTPS" | grep -qE "200|301|302"; then
    echo -e "${GREEN}   ✅ NPMplus HTTPS working${NC}"
else
    echo -e "${YELLOW}   ⚠️  NPMplus HTTPS: $NPMPLUS_HTTPS${NC}"
fi

# Test 4: External access
echo -e "${BLUE}4. External Access${NC}"
EXTERNAL_HTTP=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 10 "http://$DOMAIN" 2>/dev/null || echo "000")
EXTERNAL_HTTPS=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 10 "https://$DOMAIN" 2>/dev/null || echo "000")

if [ "$EXTERNAL_HTTP" = "200" ] || [ "$EXTERNAL_HTTP" = "301" ] || [ "$EXTERNAL_HTTP" = "302" ]; then
    echo -e "${GREEN}   ✅ External HTTP: $EXTERNAL_HTTP${NC}"
elif [ "$EXTERNAL_HTTP" = "000" ]; then
    echo -e "${YELLOW}   ⚠️  External HTTP: Timeout${NC}"
else
    echo -e "${YELLOW}   ⚠️  External HTTP: $EXTERNAL_HTTP${NC}"
fi

if [ "$EXTERNAL_HTTPS" = "200" ] || [ "$EXTERNAL_HTTPS" = "301" ] || [ "$EXTERNAL_HTTPS" = "302" ]; then
    echo -e "${GREEN}   ✅ External HTTPS: $EXTERNAL_HTTPS${NC}"
elif [ "$EXTERNAL_HTTPS" = "000" ]; then
    echo -e "${YELLOW}   ⚠️  External HTTPS: Timeout (check UDM Pro port forwarding)${NC}"
else
    echo -e "${YELLOW}   ⚠️  External HTTPS: $EXTERNAL_HTTPS${NC}"
fi

echo ""
echo "=========================================="
if [ "$ALL_GOOD" = true ] && [ "$NPMPLUS_TO_VM" = "200" ]; then
    echo -e "${GREEN}✅ Internal path is working correctly!${NC}"
    echo ""
    echo "If external access is not working, check:"
    echo "  1. UDM Pro port forwarding: $PUBLIC_IP:80/443 → $NPMPLUS_IP:80/443"
    echo "  2. UDM Pro firewall rules"
    echo "  3. Network connectivity from internet to $PUBLIC_IP"
else
    echo -e "${RED}❌ Some issues found${NC}"
fi
echo ""