#!/bin/sh
# Health check for a FreeRADIUS node in front of MilFA (keepalived vrrp_script,
# external checks of nginx/Angie stream balancers, monitoring).
# Exit 0 when FreeRADIUS answers Status-Server AND the MilFA core it uses is ready.
#
#   RADIUS_STATUS_ADDR   Status-Server address        (default 127.0.0.1:18121)
#   RADIUS_STATUS_SECRET secret of the status client  (default change-me-status-secret)
#   MILFA_READYZ_URL     readiness of the MilFA core  (default http://127.0.0.1:9101/readyz,
#                        the core's health port; for a remote core use its management address)
RAD=${RADIUS_STATUS_ADDR:-127.0.0.1:18121}
SECRET=${RADIUS_STATUS_SECRET:-change-me-status-secret}
CORE=${MILFA_READYZ_URL:-http://127.0.0.1:9101/readyz}

if ! echo 'Message-Authenticator = 0x00' | radclient -q -r 1 -t 2 "$RAD" status "$SECRET" >/dev/null 2>&1; then
  echo "freeradius: no Status-Server answer from $RAD" >&2
  exit 1
fi
if ! curl -fsS --max-time 2 "$CORE" >/dev/null 2>&1; then
  echo "milfa core not ready: $CORE" >&2
  exit 1
fi
exit 0
