From 763586e878fbf78b07ea3ef0fa31199bab0e4235 Mon Sep 17 00:00:00 2001
From: Julian Foad <julian@foad.me.uk>
Date: Wed, 29 Jun 2022 10:48:40 +0100
Subject: [PATCH] matrix-ntfy: add self-check

---
 roles/matrix-ntfy/README.md            |  1 -
 roles/matrix-ntfy/defaults/main.yml    |  3 +++
 roles/matrix-ntfy/tasks/main.yml       |  7 +++++++
 roles/matrix-ntfy/tasks/self_check.yml | 25 +++++++++++++++++++++++++
 4 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 roles/matrix-ntfy/tasks/self_check.yml

diff --git a/roles/matrix-ntfy/README.md b/roles/matrix-ntfy/README.md
index 2a5301f7..41f83f66 100644
--- a/roles/matrix-ntfy/README.md
+++ b/roles/matrix-ntfy/README.md
@@ -1,5 +1,4 @@
 # TODO
 
-- Self-check.
 - Mount the ntfy database to disk so subscriptions persist across restarts.
 - Authentication?
diff --git a/roles/matrix-ntfy/defaults/main.yml b/roles/matrix-ntfy/defaults/main.yml
index 2df79674..916591e7 100644
--- a/roles/matrix-ntfy/defaults/main.yml
+++ b/roles/matrix-ntfy/defaults/main.yml
@@ -14,3 +14,6 @@ matrix_ntfy_container_http_host_bind_port: ''
 
 # A list of extra arguments to pass to the container (`docker run` command)
 matrix_ntfy_container_extra_arguments: []
+
+# Controls whether the self-check feature should validate SSL certificates.
+matrix_ntfy_self_check_validate_certificates: true
diff --git a/roles/matrix-ntfy/tasks/main.yml b/roles/matrix-ntfy/tasks/main.yml
index 3f3975f5..b2abac66 100644
--- a/roles/matrix-ntfy/tasks/main.yml
+++ b/roles/matrix-ntfy/tasks/main.yml
@@ -8,3 +8,10 @@
   tags:
     - setup-all
     - setup-ntfy
+
+- import_tasks: "{{ role_path }}/tasks/self_check.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: "run_self_check|bool and matrix_ntfy_enabled|bool"
+  tags:
+    - self-check
diff --git a/roles/matrix-ntfy/tasks/self_check.yml b/roles/matrix-ntfy/tasks/self_check.yml
new file mode 100644
index 00000000..324a2d95
--- /dev/null
+++ b/roles/matrix-ntfy/tasks/self_check.yml
@@ -0,0 +1,25 @@
+---
+
+# Query an arbitrary ntfy topic using ntfy's UnifiedPush topic name syntax.
+# Expect an empty response (because we query 'since=1s').
+
+- set_fact:
+    matrix_ntfy_url_endpoint_public: "https://{{ matrix_server_fqn_ntfy }}/upSELFCHECK123/json?poll=1&since=1s"
+
+- name: Check ntfy
+  uri:
+    url: "{{ matrix_ntfy_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_ntfy_self_check_validate_certificates }}"
+  register: matrix_ntfy_self_check_result
+  check_mode: false
+  ignore_errors: true
+
+- name: Fail if ntfy not working
+  fail:
+    msg: "Failed checking ntfy is up at `{{ matrix_server_fqn_ntfy }}` (checked endpoint: `{{ matrix_ntfy_url_endpoint_public }}`). Is ntfy running? Is port 443 open in your firewall? Full error: {{ matrix_ntfy_self_check_result }}"
+  when: "matrix_ntfy_self_check_result.failed"
+
+- name: Report working ntfy
+  debug:
+    msg: "ntfy at `{{ matrix_server_fqn_ntfy }}` is working (checked endpoint: `{{ matrix_ntfy_url_endpoint_public }}`)"