#!/bin/sh
# Secrets are read from a protected config file, never process arguments.
set -eu
conf=/run/mqtt-secrets/health.conf
topic=robot-market/test/health/check
token="health-$(date +%s)-$$"
cleanup() {
    timeout 4 mosquitto_pub -o "$conf" -h localhost -p 8883 \
        --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -r -n \
        >/dev/null 2>&1 || true
}
trap cleanup EXIT
# Retain only for the subscribe check so startup scheduling cannot lose the probe.
timeout 5 mosquitto_pub -o "$conf" -h localhost -p 8883 \
    --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -r -m "$token" \
    >/dev/null 2>&1 || exit 1
received=$(timeout 7 mosquitto_sub -o "$conf" -h localhost -p 8883 \
    --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -C 1 -W 5 \
    2>/dev/null) || exit 1
[ "$received" = "$token" ]