#!/usr/bin/env sh
set -u
cd "$(dirname "$0")"
[ -f .env ] && { set -a; . ./.env; set +a; }

section(){ printf '\n== %s ==\n' "$1"; }

section "Host / CPU"
echo "Architektur: $(uname -m 2>/dev/null || echo unknown)"
if docker compose ps clickhouse 2>/dev/null | grep -q "Restarting"; then
  echo "WARNUNG: ClickHouse startet wiederholt neu."
  docker compose logs --tail=30 clickhouse 2>&1 | grep -q "Illegal instruction" && echo "URSACHE: ClickHouse SIGILL / CPU-Instruktionssatz inkompatibel. ./host-info.sh ausführen." || true
fi

section "Compose config"
docker compose config >/dev/null 2>&1 && echo "OK" || echo "FEHLER: docker compose config"

section "Docker"
docker compose ps || true

section "HTTP readiness"
if command -v curl >/dev/null 2>&1; then
  printf "Ingress: "; curl -fsS "http://127.0.0.1:${INGRESS_PORT:-8090}/readyz" || true; echo
  printf "API:     "; curl -fsS "http://127.0.0.1:${UI_PORT:-8080}/readyz" || true; echo
  printf "Grafana: "; curl -fsS "http://127.0.0.1:${GRAFANA_PORT:-3000}/api/health" || true; echo
else
  echo "curl fehlt; HTTP-Prüfung übersprungen."
fi

section "Garage"
docker compose exec -T garage /garage status 2>/dev/null || true
printf "S3 archive: "
docker compose exec -T archive-uploader rclone lsd "garage:${GARAGE_BUCKET:-siem-raw}" 2>/dev/null && echo "OK" || echo "nicht erreichbar"

section "ClickHouse"
docker compose exec -T clickhouse clickhouse-client \
  --user "${CLICKHOUSE_USER:-siem}" --password "${CLICKHOUSE_PASSWORD:-}" \
  --query "SELECT version(), currentUser(), currentDatabase()" 2>/dev/null || true
docker compose exec -T clickhouse clickhouse-client \
  --user "${CLICKHOUSE_USER:-siem}" --password "${CLICKHOUSE_PASSWORD:-}" \
  --database "${CLICKHOUSE_DB:-siem}" \
  --query "SELECT formatReadableQuantity(sum(rows)) AS rows, formatReadableSize(sum(bytes_on_disk)) AS disk, count() AS active_parts FROM system.parts WHERE database='${CLICKHOUSE_DB:-siem}' AND table='events' AND active" 2>/dev/null || true

section "Redpanda"
docker compose exec -T redpanda rpk cluster health 2>/dev/null || true
docker compose exec -T redpanda rpk group describe "${KAFKA_GROUP:-siem-processor-v1}" 2>/dev/null || true

section "PostgreSQL control plane"
docker compose exec -T postgres psql -U "${POSTGRES_USER:-siem}" -d "${POSTGRES_DB:-siem}" -Atc \
  "SELECT 'agents='||count(*) FROM agents; SELECT 'rule_sets='||count(*) FROM rule_sets; SELECT 'enabled_rules='||count(*) FROM detection_rules WHERE enabled; SELECT 'suppressions='||count(*) FROM detection_suppressions WHERE enabled AND (expires_at IS NULL OR expires_at>now()); SELECT 'open_detections='||count(*) FROM detections WHERE status IN ('open','investigating');" 2>/dev/null || true

section "Raw spool"
docker compose exec -T archive-uploader sh -c 'du -sh /spool 2>/dev/null || true; printf "files="; find /spool -type f 2>/dev/null | wc -l' 2>/dev/null || true

section "Recent errors"
docker compose logs --since=15m garage clickhouse clickhouse-schema postgres postgres-schema redpanda redpanda-init ingress processor detector api archive-uploader grafana 2>&1 \
  | grep -Ei 'error|fatal|failed|panic|not_ready|exception' | tail -120 || true