#!/usr/bin/env bash
# Healthy only when the domain is seeded, the export is written and LDAPS answers
# with a certificate that verifies against the exported CA for dc1.pstest.local.
set -eu

test -f /export/seeded
test -s /export/ca.pem
test -s /export/users.json

# TLS on 636: the handshake must verify the chain and the host name.
openssl s_client -connect 127.0.0.1:636 -servername dc1.pstest.local \
  -CAfile /export/ca.pem -verify_hostname dc1.pstest.local -verify_return_error \
  </dev/null >/dev/null 2>&1

# The directory answers: the service account exists in the seeded tree.
ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "OU=System_Accounts,OU=Admin,DC=pstest,DC=local" \
  "(sAMAccountName=svc-packetstation)" dn 2>/dev/null | grep -q '^dn: '