#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=backup.env
source "$SCRIPT_DIR/backup.env"

# ==============================================================================
# CONNECTION CHECK
# ==============================================================================
BACKUP_LABEL="${HOSTNAME}-root"
EXCLUDE_FILE="/opt/backup/exclude"

fail() {
    echo "check-connection: FAIL: $*" >&2
    exit 1
}

echo "PBS target: ${PBS_SERVER}:${PBS_PORT}  datastore=${PBS_DATASTORE}  namespace=${BACKUP_NS:-default}"
echo

# 1. Preflight — the files backup.sh itself requires
[ -s "$ENCRYPTION_KEY_FILE" ] || fail "encryption key not found at $ENCRYPTION_KEY_FILE"
echo "[ok] encryption key present: $ENCRYPTION_KEY_FILE"
[ -f "$EXCLUDE_FILE" ] || fail "exclude list not found at $EXCLUDE_FILE"
echo "[ok] exclude list present: $EXCLUDE_FILE"
echo

# 2. TCP reachability of the PBS server
if ! timeout 5 bash -c "exec 3<>/dev/tcp/${PBS_SERVER}/${PBS_PORT}" 2>/dev/null; then
    fail "cannot open TCP connection to ${PBS_SERVER}:${PBS_PORT} (hostname resolution or firewall?)"
fi
echo "[ok] TCP connection to ${PBS_SERVER}:${PBS_PORT}"
echo

# 3. Authenticated round-trip: list existing snapshots for this host
if ! SNAP_OUT="$(timeout 30 proxmox-backup-client snapshot list "host/${BACKUP_LABEL}" --ns "$BACKUP_NS" 2>&1)"; then
    echo "$SNAP_OUT" >&2
    fail "authenticated request failed — check PBS_AUTH_ID / PBS_PASSWORD in backup.env"
fi
echo "[ok] authentication + API round-trip to the server"
if [ -n "$SNAP_OUT" ]; then
    echo "existing snapshots for ${BACKUP_LABEL}:"
    echo "$SNAP_OUT"
else
    echo "    (none yet for ${BACKUP_LABEL} — the first backup has not run)"
fi

echo
echo "All checks passed. The next backup should succeed."