#!/usr/bin/env bash
# =====================================================================================
# Container healthcheck. Credential-free on purpose: it must never risk locking out an
# account by testing authentication. Authenticated checks live in scripts/verify.sh.
#   - process alive
#   - LDAP rootDSE answers (anonymous base object is allowed by design)
#   - own DNS answers the AD SRV records
#   - Kerberos / SMB / Global Catalog ports accept a connection
#   - smb.conf still parses
# =====================================================================================
set -uo pipefail

problems=()

pgrep -x samba >/dev/null 2>&1 || problems+=("samba process not running")

# LDAP rootDSE
if ! ldapsearch -x -H ldap://127.0.0.1:389 -s base -b '' defaultNamingContext 2>/dev/null \
        | grep -q '^defaultNamingContext:'; then
    problems+=("LDAP rootDSE did not answer")
fi

# authoritative SRV lookup against ourselves
zone="$(sed -n 's/^[[:space:]]*search[[:space:]]\{1,\}\([^[:space:]]\{1,\}\).*/\1/p' /etc/resolv.conf 2>/dev/null | head -1)"
if [ -z "$zone" ]; then
    zone="$(hostname -d 2>/dev/null || true)"
fi
if [ -n "$zone" ]; then
    if ! dig +time=2 +tries=1 +short @127.0.0.1 "_ldap._tcp.dc._msdcs.${zone}" SRV 2>/dev/null | grep -q .; then
        problems+=("_ldap._tcp.dc._msdcs.${zone} SRV returned nothing")
    fi
else
    problems+=("cannot determine DNS zone")
fi

for port in 88 135 445 3268; do
    if ! timeout 3 bash -c "exec 3<>/dev/tcp/127.0.0.1/${port}" 2>/dev/null; then
        problems+=("tcp/${port} refused")
    fi
done

# kpasswd (464) is UDP-only for most clients; check the KDC UDP path instead
if ! timeout 3 bash -c 'exec 3<>/dev/udp/127.0.0.1/88' 2>/dev/null; then
    problems+=("udp/88 unusable")
fi

testparm -s /etc/samba/smb.conf >/dev/null 2>&1 || problems+=("testparm failed")

if ((${#problems[@]} == 0)); then
    echo "healthy"
    exit 0
fi
printf 'UNHEALTHY:'
printf ' %s;' "${problems[@]}"
# Surface the daemon's own last words: samba writes the real reason to its log file and this
# shows up in `docker inspect --format '{{json .State.Health}}'`.
if [ -r /var/log/samba/log.samba ]; then
    printf '\n  log.samba tail: %s\n' "$(tail -3 /var/log/samba/log.samba | tr '\n' '|')"
fi
echo
exit 1