#!/usr/bin/env bash
# Reproducible local syntax check. Fake credentials only; no published ports or VPS access.
set -euo pipefail
root=$(cd "$(dirname "$0")/../../.." && pwd)
cd "$root"
fixtures="$root/agents/codex/notes/r5-fixtures"
mkdir -p "$fixtures"
chmod 755 "$fixtures"
docker run --rm --name randomayzer-caddy-hash-fixture --network none --user 65534:65534 --cap-drop ALL --cap-add NET_BIND_SERVICE --security-opt no-new-privileges:true caddy:2.8-alpine caddy hash-password --plaintext FAKE_R5_CONFIG_TEST_ONLY > "$fixtures/fake-bcrypt.txt"
python3 - <<'PY'
from pathlib import Path
root=Path('agents/codex/notes/r5-fixtures')
h=(root/'fake-bcrypt.txt').read_text().strip()
assert h.startswith('$2'), 'Fake hash generation failed'
s=Path('deploy/randomayzer.Caddyfile').read_text()
assert s.count('owner BASIC_AUTH_HASH') == 1
p=root/'Caddyfile';p.write_text(s.replace('owner BASIC_AUTH_HASH','owner '+h));p.chmod(0o644)
s=Path('deploy/randomayzer.haproxy.cfg').read_text()
tls='\n'.join(x for x in s.splitlines() if x.startswith(('acl ','use_backend '))).replace('CADDY_TLS_BACKEND_FROM_ACTIVE_CONFIG','fixture_caddy_tls')
http='\n'.join(x[2:] for x in s.splitlines() if x.startswith(('# acl randomayzer_http','# use_backend CADDY_HTTP'))).replace('CADDY_HTTP_BACKEND_FROM_ACTIVE_CONFIG','fixture_caddy_http')
assert 'use_backend fixture_caddy_tls' in tls
assert 'use_backend fixture_caddy_http' in http
config='''global
    master-worker
defaults
    mode tcp
    timeout connect 5s
    timeout client 10s
    timeout server 10s
frontend fixture_tls
    bind :8443
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
'''+''.join('    '+x+'\n' for x in tls.splitlines())+'''    default_backend fixture_other_tls
frontend fixture_http
    mode http
    bind :8080
'''+''.join('    '+x+'\n' for x in http.splitlines())+'''    default_backend fixture_other_http
backend fixture_caddy_tls
    mode tcp
    server caddy 127.0.0.1:9443
backend fixture_other_tls
    mode tcp
    server other 127.0.0.1:9444
backend fixture_caddy_http
    mode http
    server caddy 127.0.0.1:9080
backend fixture_other_http
    mode http
    server other 127.0.0.1:9081
'''
p=root/'haproxy.cfg';p.write_text(config);p.chmod(0o644)
PY
docker run --rm --name randomayzer-caddy28-validate --network none --user 65534:65534 --cap-drop ALL --cap-add NET_BIND_SERVICE --security-opt no-new-privileges:true -e XDG_DATA_HOME=/tmp/caddy-data -e XDG_CONFIG_HOME=/tmp/caddy-config -v "$fixtures/Caddyfile:/etc/caddy/Caddyfile:ro" caddy:2.8-alpine caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
docker run --rm --name randomayzer-haproxy30-validate --network none --cap-drop ALL --security-opt no-new-privileges:true -v "$fixtures/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro" haproxy:3.0-alpine haproxy -c -V -f /usr/local/etc/haproxy/haproxy.cfg
printf 'PASS local Caddy 2.8 / HAProxy 3.0 template syntax (fake fixture, not live VPS acceptance)\n'