entrypoint.sh

#!/bin/bash
set -eo pipefail

log() { echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*"; }

# === CONFIGURATION ===
ZABBIX_CONF="/etc/zabbix/zabbix_agent2.conf"
PSK_FILE="${ZBX_TLSPSKFILE:-/etc/zabbix/netvaktin.psk}"
HOSTNAME="${ZBX_HOSTNAME:-}"
SERVER_HOST="${ZBX_SERVER_HOST:-}"
SERVER_PORT="${ZBX_SERVER_PORT:-10051}"
# Comma-separated list of active Zabbix servers, used verbatim as ServerActive when set
# (e.g. "monitor.logbirta.is:10051,monitor.netvaktin.is:10051"). Falls back to
# SERVER_HOST:SERVER_PORT below when unset/empty.
SERVER_ACTIVE_LIST="${ZBX_SERVER_ACTIVE:-}"
PSK_IDENTITY="${ZBX_TLSPSKIDENTITY:-}"

# === 1. ROLE SWITCHING ===
# NETVAKTIN_ROLE controls prod/dev routing:
#   Domestic  → prod group "Netvaktin Probes"           + "Template Netvaktin"
#   External  → prod group "Netvaktin External Probes"  + "Template Netvaktin Inbound"
#   Dev       → dev group  "Netvaktin Dev Probes"       + "Template Netvaktin Dev"
#   DevExt    → dev group  "Netvaktin Dev External Probes" + "Template Netvaktin Inbound Dev"
#
# Override at any time by setting ZBX_HOSTGROUP_NAME and ZBX_TEMPLATE_NAME directly.
ROLE="${NETVAKTIN_ROLE:-Domestic}"

if [ "$ROLE" == "External" ]; then
    log "🌍 Mode: EXTERNAL (Inbound Monitoring) — PRODUCTION"
    export ZBX_HOSTGROUP_NAME="${ZBX_HOSTGROUP_NAME:-Netvaktin External Probes}"
    export ZBX_TEMPLATE_NAME="${ZBX_TEMPLATE_NAME:-Template Netvaktin Inbound}"
elif [ "$ROLE" == "Dev" ]; then
    log "🧪 Mode: DEV DOMESTIC (Outbound Monitoring) — DEV"
    export ZBX_HOSTGROUP_NAME="${ZBX_HOSTGROUP_NAME:-Netvaktin Dev Probes}"
    export ZBX_TEMPLATE_NAME="${ZBX_TEMPLATE_NAME:-Template Netvaktin Dev}"
elif [ "$ROLE" == "DevExt" ]; then
    log "🧪 Mode: DEV EXTERNAL (Inbound Monitoring) — DEV"
    export ZBX_HOSTGROUP_NAME="${ZBX_HOSTGROUP_NAME:-Netvaktin Dev External Probes}"
    export ZBX_TEMPLATE_NAME="${ZBX_TEMPLATE_NAME:-Template Netvaktin Inbound Dev}"
else
    log "🏠 Mode: DOMESTIC (Outbound Monitoring) — PRODUCTION"
    export ZBX_HOSTGROUP_NAME="${ZBX_HOSTGROUP_NAME:-Netvaktin Probes}"
    export ZBX_TEMPLATE_NAME="${ZBX_TEMPLATE_NAME:-Template Netvaktin}"
fi

# === 2. API SELF-REGISTRATION ===
if [ -n "$ZBX_API_TOKEN" ]; then
    log "🤖 Performing API Self-Registration..."
    python3 /usr/bin/register_probe.py
else
    log "⚠️ No ZBX_API_TOKEN provided. Skipping registration."
fi

# === 3. PSK FILE ===
if [ -n "${ZBX_TLSPSKVALUE:-}" ]; then
    mkdir -p "$(dirname "$PSK_FILE")"
    echo "$ZBX_TLSPSKVALUE" > "$PSK_FILE"
    chmod 600 "$PSK_FILE"
    log "🔑 PSK written from environment to $PSK_FILE."
elif [ ! -f "$PSK_FILE" ]; then
    log "❌ No PSK: ZBX_TLSPSKVALUE not set and $PSK_FILE not found."
    exit 1
fi

if [ ! -s "$PSK_FILE" ]; then
    log "❌ TLS PSK file is missing or empty at $PSK_FILE. Refusing to start Zabbix Agent 2."
    exit 1
fi

log "🔐 TLS PSK file ready at $PSK_FILE."

# === 4. ZABBIX AGENT CONFIGURATION ===
# A standalone active-server list is a complete config on its own — derive SERVER_HOST
# from its first endpoint so direct container/Kubernetes users aren't forced to also set
# ZBX_SERVER_HOST just to satisfy the validation loop below.
if [ -n "$SERVER_ACTIVE_LIST" ] && [ -z "$SERVER_HOST" ]; then
    first_active="${SERVER_ACTIVE_LIST%%,*}"
    SERVER_HOST="${first_active%%:*}"
fi

for required_name in HOSTNAME SERVER_HOST PSK_IDENTITY; do
    required_value="$(eval "printf '%s' \"\${$required_name}\"")"
    if [ -z "$required_value" ]; then
        log "❌ Required environment value missing: $required_name"
        exit 1
    fi
done

if command -v getcap >/dev/null 2>&1; then
    for bin in /usr/local/bin/scamper "$(command -v mtr 2>/dev/null || true)" "$(command -v mtr-packet 2>/dev/null || true)"; do
        [ -n "$bin" ] || continue
        if [ -x "$bin" ]; then
            log "🔎 Trace binary: $bin $(getcap "$bin" 2>/dev/null | sed "s#^$bin##")"
        fi
    done
fi

if [ -n "$SERVER_ACTIVE_LIST" ]; then
    SERVER_ACTIVE_CONFIG="$SERVER_ACTIVE_LIST"
else
    SERVER_ACTIVE_CONFIG="${SERVER_HOST}:${SERVER_PORT}"
fi
log "📡 Active Zabbix servers: $SERVER_ACTIVE_CONFIG"

log "⚙️ Generating Zabbix Agent configuration..."
cat > "$ZABBIX_CONF" <<EOF
PidFile=/var/run/zabbix/zabbix_agent2.pid
Timeout=30
LogFile=/dev/stdout
LogFileSize=0
ServerActive=${SERVER_ACTIVE_CONFIG}
Hostname=${HOSTNAME}
TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=${PSK_IDENTITY}
TLSPSKFile=${PSK_FILE}
# V4 backward compatibility bridge (Maps old Zabbix items to the V5 script)
UserParameter=netvaktin.mtr[*],/usr/bin/route_check_v5.py "\$2" "\$1" "icmp-paris" "3" "1000" "32" "false"
# V5 native configuration
UserParameter=netvaktin.v5.mtr[*],/usr/bin/route_check_v5.py "\$1" "\$2" "\$3" "\$4" "\$5" "\$6" "\$7"
EOF

# === 5. START THE AGENT ===
log "🚀 Starting Zabbix Agent 2..."
exec /usr/sbin/zabbix_agent2 -c "$ZABBIX_CONF"