#!/usr/bin/env bash
# run-mail-audit.sh — drive audit-mail-env.sh across the fleet, read-only.
#
# All remote access goes through the sanctioned chokepoints:
#   prox targets  -> tests/remote.sh prox-file      (PVE hosts, root)
#   vm targets    -> tests/remote.sh vm-file        (VMs + physical Linux)
#   dns targets   -> remote-dns.sh <alias>-file     (netinfra pair, netboot)
# Output: one text block per target under .crush/audit/mail/<name>.txt
#
# Usage: bash netinfra/mail/run-mail-audit.sh [targets-file]
set -u

REPO="$(cd "$(dirname "$0")/../.." && pwd)"
TARGETS="${1:-${REPO}/netinfra/mail/audit-targets.txt}"
PAYLOAD="${REPO}/netinfra/mail/audit-mail-env.sh"
OUTDIR="${REPO}/.crush/audit/mail"
REMOTE_SH="${REPO}/tests/remote.sh"
DNS_SH="${REPO}/netinfra/dns-cluster-setup/remote-dns.sh"
TMO="${MAIL_AUDIT_TIMEOUT:-45}"

mkdir -p "${OUTDIR}"
ok=0
fail=0
failed=""

while IFS='|' read -r mode name user; do
  case "${mode}" in '' | '#'*) continue ;; esac
  outfile="${OUTDIR}/${name}.txt"
  rc=0
  case "${mode}" in
    prox)
      timeout "${TMO}" env PROX_HOST="${name}" bash "${REMOTE_SH}" prox-file "${PAYLOAD}" >"${outfile}" 2>&1
      rc=$?
      ;;
    vm)
      for tgt in "${name}" "${name}.knel.net"; do
        timeout "${TMO}" env VM_IP="${tgt}" VM_USER="${user:-root}" bash "${REMOTE_SH}" vm-file "${PAYLOAD}" >"${outfile}" 2>&1
        rc=$?
        if [ "${rc}" -eq 0 ]; then
          break
        fi
        case "${tgt}" in
          *.*) break ;;
        esac
      done
      ;;
    dns)
      timeout "${TMO}" bash "${DNS_SH}" "${name}-file" "${PAYLOAD}" >"${outfile}" 2>&1
      rc=$?
      ;;
    *)
      echo "unknown mode '${mode}' for ${name}" >&2
      continue
      ;;
  esac
  if [ "${rc}" -eq 0 ] && grep -q '^== done' "${outfile}"; then
    ok=$((ok + 1))
    echo "[ok] ${name}"
  else
    fail=$((fail + 1))
    failed="${failed} ${name}(rc=${rc})"
    echo "[FAIL] ${name} rc=${rc}"
  fi
done <"${TARGETS}"

echo "=== audit run: ${ok} ok, ${fail} failed${failed}"