#!/usr/bin/env bash
# Health snapshot for both halves of a Wazuh 5.0 deployment: the manager
# cluster and the indexer cluster. Read-only. Run it on a manager node.
#
# Companion to: https://maheshtata.com/wazuh/wazuh-cluster/
# Every command below comes from the 5.0-beta documentation; nothing is
# inferred. Output is printed as the tools produce it and is not parsed.
#
# Usage:
#   INDEXER_URL=https://10.0.0.1:9200 \
#   INDEXER_USER=admin \
#   INDEXER_PASS='...' \
#     ./cluster-health.sh

set -euo pipefail

MANAGER_BIN="${MANAGER_BIN:-/var/wazuh-manager/bin}"
INDEXER_URL="${INDEXER_URL:-https://127.0.0.1:9200}"
INDEXER_USER="${INDEXER_USER:-admin}"
INDEXER_PASS="${INDEXER_PASS:-}"

hr() { printf '\n----- %s -----\n' "$1"; }

hr "manager services on $(hostname)"
"${MANAGER_BIN}/wazuh-manager-control" status

hr "manager version"
"${MANAGER_BIN}/wazuh-manager-control" info -v

hr "cluster nodes"
"${MANAGER_BIN}/cluster_control" -l

hr "cluster health"
"${MANAGER_BIN}/cluster_control" -i health

hr "registered agents by node"
"${MANAGER_BIN}/cluster_control" -a

if [ -z "${INDEXER_PASS}" ]; then
  echo
  echo "INDEXER_PASS is not set; skipping the indexer checks."
  exit 0
fi

hr "indexer cluster health"
curl -sk -u "${INDEXER_USER}:${INDEXER_PASS}" "${INDEXER_URL}/_cluster/health?pretty"

hr "indexer nodes"
curl -sk -u "${INDEXER_USER}:${INDEXER_PASS}" "${INDEXER_URL}/_cat/nodes?v"

hr "indexer memory locking (expect mlockall true on every node)"
curl -sk -u "${INDEXER_USER}:${INDEXER_PASS}" \
  "${INDEXER_URL}/_nodes?filter_path=**.mlockall&pretty"

hr "indexer connector reachability from this manager"
# Uses the certificate pair the indexer connector itself presents.
curl -s --cacert /var/wazuh-manager/etc/certs/root-ca.pem \
        --cert   /var/wazuh-manager/etc/certs/indexer-connector.pem \
        --key    /var/wazuh-manager/etc/certs/indexer-connector-key.pem \
        "${INDEXER_URL}/_cluster/health"
echo