# Pre-Hybrid Fase 2 — verifikasi konektivitas semua komponen server
# Usage: .\scripts\pre-hybrid-phase2-healthcheck.ps1

param(
    [string]$RouterAddr = "192.168.0.1",
    [int]$PingTimeoutMs = 2000
)

$ErrorActionPreference = "Continue"
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"

$hosts = @(
    @{ Name = "Mikrotik (server GW)";     Ip = "10.100.1.1";   Ping = $true;  Tcp = @(255) }
    @{ Name = "Mikrotik (office GW)";     Ip = "192.168.0.1";  Ping = $true;  Tcp = @(255) }
    @{ Name = "SwOS CRS326";              Ip = "10.100.1.2";   Ping = $true;  Tcp = @(80) }
    @{ Name = "SwOS CSS610";              Ip = "10.100.1.3";   Ping = $true;  Tcp = @(80) }
    @{ Name = "NAS QNAP";                 Ip = "10.100.1.10";  Ping = $true;  Tcp = @(443) }
    @{ Name = "Reverse_proxy";            Ip = "10.100.1.24";  Ping = $true;  Tcp = @(22, 443) }
    @{ Name = "Main_Database";             Ip = "10.100.1.25";  Ping = $true;  Tcp = @(22, 1433, 5432) }
    @{ Name = "AD-LDAP";                  Ip = "10.100.1.40";  Ping = $true;  Tcp = @(22, 389) }
    @{ Name = "Main_Webserver";           Ip = "10.100.1.41";  Ping = $true;  Tcp = @(22, 80, 443) }
    @{ Name = "Zabbix";                   Ip = "10.100.1.42";  Ping = $true;  Tcp = @(22, 80) }
)

$sshTests = @(
    @{ Name = "Reverse_proxy SSH";  Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-m","hmac-sha1","root@10.100.1.24","-p","22","hostname") }
    @{ Name = "Main_Database SSH";   Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-m","hmac-sha1","root@10.100.1.25","-p","22","hostname") }
    @{ Name = "AD-LDAP SSH";         Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-m","hmac-sha1","Administrator@10.100.1.40","-p","22","hostname") }
    @{ Name = "Main_Webserver SSH";  Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-m","hmac-sha1","Administrator@10.100.1.41","-p","22","hostname") }
    @{ Name = "Zabbix SSH";         Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-m","hmac-sha1","root@10.100.1.42","-p","22","hostname") }
    @{ Name = "Mikrotik SSH";        Cmd = @("-o","BatchMode=yes","-o","ConnectTimeout=10","-i",$KeyFile,"-m","hmac-sha1","-p","255","admin@$RouterAddr","/system identity print") }
)

$httpsTests = @(
    @{ Name = "console.gisportal.id"; Url = "https://console.gisportal.id/" }
    @{ Name = "app.gisportal.id";     Url = "https://app.gisportal.id/" }
)

function Test-PingHost {
    param([string]$Ip)
    $ping = New-Object System.Net.NetworkInformation.Ping
    try {
        $r = $ping.Send($Ip, $PingTimeoutMs)
        if ($r.Status -eq "Success") { return "OK ($($r.RoundtripTime)ms)" }
        return "FAIL ($($r.Status))"
    } catch {
        return "FAIL ($($_.Exception.Message))"
    }
}

function Test-TcpPort {
    param([string]$Ip, [int]$Port)
    try {
        $tcp = New-Object System.Net.Sockets.TcpClient
        $iar = $tcp.BeginConnect($Ip, $Port, $null, $null)
        $ok = $iar.AsyncWaitHandle.WaitOne($PingTimeoutMs, $false)
        if ($ok -and $tcp.Connected) {
            $tcp.Close()
            return "OK"
        }
        $tcp.Close()
        return "FAIL"
    } catch {
        return "FAIL"
    }
}

Write-Host "=== Pre-Hybrid Fase 2 Health Check ===" -ForegroundColor Cyan
Write-Host "Waktu: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
Write-Host ""

# --- Ping & TCP dari laptop ---
Write-Host "--- LAPTOP: Ping & TCP ---" -ForegroundColor Yellow
$results = @()
foreach ($h in $hosts) {
    $pingResult = if ($h.Ping) { Test-PingHost $h.Ip } else { "skip" }
    $tcpResults = @()
    foreach ($port in $h.Tcp) {
        $tcpResults += "tcp/$port=$(Test-TcpPort $h.Ip $port)"
    }
    $line = "$($h.Name) ($($h.Ip)): ping=$pingResult | $($tcpResults -join ' ')"
    Write-Host $line
    $results += [PSCustomObject]@{
        Host = $h.Name
        Ip = $h.Ip
        Ping = $pingResult
        Tcp = ($tcpResults -join ", ")
    }
}

Write-Host ""
Write-Host "--- LAPTOP: SSH ---" -ForegroundColor Yellow
foreach ($t in $sshTests) {
    $cmd = $t.Cmd
    $out = & ssh @cmd 2>&1
    $ok = ($LASTEXITCODE -eq 0)
    $detail = if ($ok) { ($out | Select-Object -First 1) -join "" } else { ($out | Select-Object -Last 1) -join "" }
    $status = if ($ok) { "OK" } else { "FAIL" }
    Write-Host "$($t.Name): $status $detail"
}

Write-Host ""
Write-Host "--- LAPTOP: HTTPS (hairpin/public) ---" -ForegroundColor Yellow
foreach ($t in $httpsTests) {
    try {
        $code = curl.exe -sS -o NUL -w "%{http_code}" --connect-timeout 8 $t.Url 2>&1
        if ($code -match '^\d{3}$') {
            $ok = [int]$code -lt 500
            $status = if ($ok) { "OK" } else { "FAIL" }
            Write-Host "$($t.Name): $status HTTP $code"
        } else {
            Write-Host "$($t.Name): FAIL $code"
        }
    } catch {
        Write-Host "$($t.Name): FAIL $($_.Exception.Message)"
    }
}

Write-Host ""
Write-Host "--- ROUTER ($RouterAddr): Ping ---" -ForegroundColor Yellow
foreach ($h in $hosts) {
    if (-not $h.Ping) { continue }
    $out = & ssh -o BatchMode=yes -o ConnectTimeout=10 -i $KeyFile -m hmac-sha1 -p 255 "admin@$RouterAddr" "/ping $($h.Ip) count=1" 2>&1
    $statusLine = ($out | Select-String -Pattern "timeout|received=0|TIME" | Select-Object -First 1)
    if ($statusLine -match "timeout|received=0") {
        Write-Host "$($h.Name) ($($h.Ip)): FAIL (router ping)"
    } elseif ($statusLine) {
        Write-Host "$($h.Name) ($($h.Ip)): OK (router ping)"
    } else {
        Write-Host "$($h.Name) ($($h.Ip)): ? $out"
    }
}
& ssh -o BatchMode=yes -o ConnectTimeout=10 -i $KeyFile -m hmac-sha1 -p 255 "admin@$RouterAddr" "/ping 8.8.8.8 count=1" 2>&1 | Out-Null
Write-Host "Internet 8.8.8.8: OK (router ping)"

Write-Host ""
Write-Host "--- ROUTER: Failover & Prep ---" -ForegroundColor Yellow
& ssh -o BatchMode=yes -o ConnectTimeout=10 -i $KeyFile -m hmac-sha1 -p 255 "admin@$RouterAddr" "/ip route print where dst-address=0.0.0.0/0; /ip firewall mangle print" 2>&1 | ForEach-Object { Write-Host $_ }

Write-Host ""
Write-Host "=== Selesai ===" -ForegroundColor Cyan