#!/usr/bin/env bash
# Actuator on its own port and path.
set -uo pipefail
cd "$(dirname "$0")/.."
OUT=docs/output/06-management-port.txt
{
  echo "### profile: mgmtport"
  echo "### management.server.port: 9001 / management.server.address: 127.0.0.1 / base-path: /manage"
  echo
  echo "--- the application port no longer serves Actuator at all ---"
  printf '  %-52s %s\n' "GET :8080/actuator/health"  "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/actuator/health)"
  printf '  %-52s %s\n' "GET :8080/manage/health"    "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/manage/health)"
  printf '  %-52s %s\n' "GET :8080/orders/count"     "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:8080/orders/count)"
  echo
  echo "--- the management port serves it on the new base path ---"
  printf '  %-52s %s\n' "GET :9001/manage/health"    "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/manage/health)"
  printf '  %-52s %s\n' "GET :9001/actuator/health"  "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/actuator/health)"
  printf '  %-52s %s\n' "GET :9001/orders/count"     "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://127.0.0.1:9001/orders/count)"
  echo
  echo "  Note the last line. The management context has its own DispatcherServlet and does NOT"
  echo "  see application controllers. That is the isolation you are paying for."
  echo
  echo "--- what the management context reports about itself ---"
  echo "\$ curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag"
  curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag | python3 -m json.tool
  echo
  echo "--- listening sockets ---"
  echo "\$ ss -ltn | grep -E ':(8080|9001)'"
  ss -ltn 2>/dev/null | grep -E ':(8080|9001)' || netstat -ltn 2>/dev/null | grep -E ':(8080|9001)'
  echo
  echo "  9001 is bound to 127.0.0.1 only. 8080 is bound to *. An ingress that forwards to 8080"
  echo "  cannot reach Actuator no matter how the security rules are written."
} > "$OUT" 2>&1
echo "wrote $OUT"