#!/usr/bin/env bash
# db-replica (10.20.0.21): hot standby of db-primary via streaming replication (Terraform design 6.10;
# PostgreSQL docs 26.2.4/26.2.5). First run: pg_basebackup -R (creates standby.signal + primary_conninfo, slot replica1).
# Re-runs leave an existing standby alone. Password from Secret Manager via the VM SA.
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
PGV=16
PRIMARY_IP=10.20.0.20
DATA=/var/lib/postgresql/${PGV}/main
CONF=/etc/postgresql/${PGV}/main

apt-get update -qq
apt-get install -y -qq postgresql-${PGV} jq >/dev/null
install -d -m 755 -o postgres -g postgres "$CONF/conf.d"
cat > "$CONF/conf.d/10-selfheal.conf" <<CONF
# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
listen_addresses = '*'
ssl = on
password_encryption = 'scram-sha-256'
hot_standby = on
log_line_prefix = '%m [%p] %u@%d '
CONF
cat > "$CONF/pg_hba.conf" <<HBA
# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
local   all             postgres                                peer
local   all             all                                     peer
hostssl app             app             10.10.0.0/16            scram-sha-256
hostssl app             app             10.20.0.0/20            scram-sha-256
hostssl all             harness         10.20.0.0/20            scram-sha-256
HBA
chown postgres:postgres "$CONF/conf.d/10-selfheal.conf" "$CONF/pg_hba.conf"; chmod 640 "$CONF/pg_hba.conf"

if [ -f "$DATA/standby.signal" ]; then
  echo "already a standby; restarting to pick up config"
  systemctl restart postgresql
else
  PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
  TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
  PGPASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" "https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" | jq -r .payload.data | base64 -d)"
  unset TOKEN; export PGPASSWORD
  [ -n "$PGPASSWORD" ] || { echo "empty DB password" >&2; exit 1; }
  systemctl stop postgresql
  rm -rf "$DATA"
  install -d -m 700 -o postgres -g postgres "$DATA"
  sudo -u postgres PGPASSWORD="$PGPASSWORD" PGSSLMODE=require pg_basebackup -h "$PRIMARY_IP" -U replicator -D "$DATA" -R -X stream -C -S replica1 -P
  unset PGPASSWORD
  systemctl start postgresql
fi
sleep 3
echo "--- replica status"
sudo -u postgres psql -Atc "select pg_is_in_recovery()"
sudo -u postgres psql -Atc "select status, sender_host, slot_name from pg_stat_wal_receiver" 2>/dev/null || true