#!/bin/sh
# vault-sync-daemon-notify.sh — fired unconditionally by ExecStopPost= on
# EVERY exit of vault-sync-daemon.service (clean stop, restart, crash, kill,
# OOM). Distinguishes clean vs. unexpected via systemd's own $SERVICE_RESULT
# so routine `systemctl stop/restart` doesn't page like a real failure would.
#
# systemd passes SERVICE_RESULT / EXIT_CODE / EXIT_STATUS as env vars to
# ExecStopPost= (documented in systemd.exec(5) "Environment Variables Set for
# Executed Processes" -> systemd.service(5) "Process exit codes").
TOKEN_PATH="/home/hermes/.hermes/secrets/ntfy-vault-token"
NTFY_URL="https://ntfy.pandu.ski/vault"

TOKEN=$(cat "$TOKEN_PATH" 2>/dev/null) || exit 0
[ -n "$TOKEN" ] || exit 0

RESULT="${SERVICE_RESULT:-unknown}"
HOST=$(hostname)
NOW=$(date -u +'%Y-%m-%dT%H:%M:%SZ')

if [ "$RESULT" = "success" ]; then
  TITLE="Vault sync daemon stopped"
  BODY="Clean stop on $HOST at $NOW (manual stop/restart)."
  TAGS="octagonal_sign"
  PRIORITY="low"
else
  TITLE="Vault sync daemon DIED"
  BODY="Unexpected exit on $HOST at $NOW. result=$RESULT exit_code=${EXIT_CODE:-?} exit_status=${EXIT_STATUS:-?}. Restart=always will retry in 5s. Check: journalctl -u vault-sync-daemon -n 50"
  TAGS="skull,rotating_light"
  PRIORITY="urgent"
fi

curl -fsS --max-time 5 -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Title: $TITLE" -H "Tags: $TAGS" -H "Priority: $PRIORITY" \
  -d "$BODY" "$NTFY_URL" >/dev/null 2>&1 || true