#!/usr/bin/env bash
set -euo pipefail

STACK_DIR="${1:-/opt/stacks/adguard-doh}"
[[ -f "$STACK_DIR/.env" && -f "$STACK_DIR/compose.yaml" ]] || {
  echo "Stack not found: $STACK_DIR" >&2
  exit 1
}

set -a
# shellcheck disable=SC1090
source "$STACK_DIR/.env"
set +a

cd "$STACK_DIR"
docker compose ps
docker compose config -q

admin_code="$(curl -sS -o /dev/null -w '%{http_code}' "https://$ADMIN_DOMAIN/")"
doh_code="$(curl -sS -o /dev/null -w '%{http_code}' "https://$DOH_DOMAIN/dns-query")"
cover_code="$(curl -sS -o /dev/null -w '%{http_code}' "https://$DOH_DOMAIN/")"

printf 'Admin HTTPS: HTTP %s\n' "$admin_code"
printf 'DoH endpoint: HTTP %s (400 is expected without a DNS payload)\n' "$doh_code"
printf 'Cover site: HTTP %s\n' "$cover_code"

[[ "$admin_code" == "302" || "$admin_code" == "200" ]]
[[ "$doh_code" == "400" ]]
[[ "$cover_code" == "200" ]]

listeners="$(ss -H -ltn 'sport = :3000')"
if [[ -z "$listeners" ]] || printf '%s\n' "$listeners" | awk '{print $4}' | grep -Evq '^127\.0\.0\.1:3000$'; then
  echo 'Port 3000 is exposed on a non-loopback address.' >&2
  exit 1
fi

echo 'Verification passed.'