#!/bin/sh
# checks/ntpd.sh
# ntpd process, plus whether the clock's actual offset is within
# tolerance. A stopped or badly-drifted ntpd is a silent failure that
# only shows up later - in TLS handshake failures, cron firing at the
# wrong time, or cross-jail log timestamps that don't line up.
set -eu

DIR=$(dirname "$0")
. "$DIR/../lib/common.sh"

NTPD_STATUS=$(svc_status ntpd)
json_line "host services" "ntpd" "" "$NTPD_STATUS"

if [ "$NTPD_STATUS" != "ok" ]; then
    exit 0
fi

RAW=$(ntpq -c "rv 0 offset" 2>/dev/null | sed -n 's/.*offset=\([-+0-9.]*\).*/\1/p')

if [ -z "$RAW" ]; then
    json_line "host services" "clock offset" "no response" "warn"
    exit 0
fi

STATUS=$(awk -v v="$RAW" 'BEGIN {
    a = (v < 0) ? -v : v
    if (a < 50) print "ok"
    else if (a < 200) print "warn"
    else print "down"
}')

json_line "host services" "clock offset" "${RAW} ms" "$STATUS"