foxhunt/terraform/runpod/validate.sh

#!/bin/bash
# Foxhunt Runpod Configuration Validator
# Checks terraform.tfvars for common issues before deployment

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

ERRORS=0
WARNINGS=0

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
    ((ERRORS++))
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
    ((WARNINGS++))
}

log_success() {
    echo -e "${GREEN}[OK]${NC} $1"
}

log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

echo "==========================================="
echo "Foxhunt Runpod Configuration Validator"
echo "==========================================="
echo ""

# Check if terraform.tfvars exists
if [ ! -f "terraform.tfvars" ]; then
    log_error "terraform.tfvars not found!"
    echo ""
    echo "Create it from the template:"
    echo "  cp terraform.tfvars.example terraform.tfvars"
    echo "  vim terraform.tfvars"
    exit 1
fi

log_success "terraform.tfvars found"

# Function to check if value is placeholder
is_placeholder() {
    [[ "$1" == *"<REQUIRED"* ]] || [[ "$1" == *"YOUR_"* ]] || [ -z "$1" ]
}

# Extract values from terraform.tfvars (simple parsing, assumes key = "value" format)
get_var() {
    grep -E "^[[:space:]]*$1[[:space:]]*=" terraform.tfvars | sed -E 's/.*"(.*)".*/\1/' | head -1
}

# Check required variables
echo ""
echo "Checking required variables..."

# Runpod API key
RUNPOD_API_KEY=$(get_var "runpod_api_key")
if is_placeholder "$RUNPOD_API_KEY"; then
    log_error "runpod_api_key is not set (required)"
    echo "  Get from: https://www.runpod.io/console/user/settings"
else
    log_success "runpod_api_key is set"
fi

# Postgres password
POSTGRES_PASSWORD=$(get_var "postgres_password")
if is_placeholder "$POSTGRES_PASSWORD"; then
    log_error "postgres_password is not set (required)"
    echo "  Generate with: openssl rand -base64 32"
else
    # Check password strength
    if [ ${#POSTGRES_PASSWORD} -lt 16 ]; then
        log_warning "postgres_password is weak (less than 16 characters)"
        echo "  Recommended: 16+ characters with mixed case, numbers, symbols"
    else
        log_success "postgres_password is set"
    fi
fi

# Databento API key
DATABENTO_API_KEY=$(get_var "databento_api_key")
if is_placeholder "$DATABENTO_API_KEY"; then
    log_error "databento_api_key is not set (required)"
    echo "  Get from: https://databento.com/"
else
    log_success "databento_api_key is set"
fi

# JWT secret
JWT_SECRET=$(get_var "jwt_secret")
if is_placeholder "$JWT_SECRET"; then
    log_error "jwt_secret is not set (required)"
    echo "  Generate with: openssl rand -base64 64"
else
    if [ ${#JWT_SECRET} -lt 32 ]; then
        log_warning "jwt_secret is weak (less than 32 characters)"
        echo "  Recommended: 64+ characters, generate with: openssl rand -base64 64"
    else
        log_success "jwt_secret is set"
    fi
fi

# Check optional but important variables
echo ""
echo "Checking optional variables..."

# GPU type
GPU_TYPE=$(get_var "gpu_type")
if [ -n "$GPU_TYPE" ]; then
    if [[ "$GPU_TYPE" == *"V100"* ]]; then
        log_success "gpu_type = Tesla V100 (16 GB VRAM, ~\$0.44/hr)"
    elif [[ "$GPU_TYPE" == *"4090"* ]]; then
        log_success "gpu_type = RTX 4090 (24 GB VRAM, ~\$0.69/hr)"
    else
        log_warning "gpu_type = $GPU_TYPE (ensure it's available in your data center)"
    fi
fi

# Cloud type
CLOUD_TYPE=$(get_var "cloud_type")
if [ -n "$CLOUD_TYPE" ]; then
    if [ "$CLOUD_TYPE" == "SECURE" ]; then
        log_success "cloud_type = SECURE (on-demand, recommended for production)"
    elif [ "$CLOUD_TYPE" == "COMMUNITY" ]; then
        log_warning "cloud_type = COMMUNITY (spot pricing, may be interrupted)"
        echo "  Use SECURE for production live trading"
    fi
fi

# Volume size
VOLUME_SIZE=$(get_var "volume_size_gb")
if [ -n "$VOLUME_SIZE" ]; then
    if [ "$VOLUME_SIZE" -lt 50 ]; then
        log_warning "volume_size_gb = ${VOLUME_SIZE} GB (may be too small for production)"
        echo "  Recommended: 100 GB for production (market data, models, logs)"
    else
        log_success "volume_size_gb = ${VOLUME_SIZE} GB"
    fi
fi

# Deployment environment
DEPLOYMENT_ENV=$(get_var "deployment_env")
if [ -n "$DEPLOYMENT_ENV" ]; then
    if [ "$DEPLOYMENT_ENV" == "production" ] && [ "$CLOUD_TYPE" == "COMMUNITY" ]; then
        log_warning "deployment_env = production but cloud_type = COMMUNITY"
        echo "  For production, use cloud_type = SECURE (guaranteed availability)"
    else
        log_success "deployment_env = $DEPLOYMENT_ENV"
    fi
fi

# Check for common security issues
echo ""
echo "Checking security configuration..."

# Check if using default Vault token
VAULT_TOKEN=$(get_var "vault_token")
if [ "$VAULT_TOKEN" == "foxhunt-dev-root" ]; then
    log_warning "vault_token is using default development token"
    echo "  For production, generate a random token: openssl rand -base64 32"
fi

# Check if public IP is enabled
ENABLE_PUBLIC_IP=$(grep -E "^[[:space:]]*enable_public_ip[[:space:]]*=" terraform.tfvars | grep -o "true\|false" | head -1)
if [ "$ENABLE_PUBLIC_IP" == "true" ]; then
    log_success "enable_public_ip = true (SSH access enabled)"
else
    log_warning "enable_public_ip = false (SSH access disabled)"
    echo "  Set to true if you need SSH access for debugging"
fi

# Check if terraform/tofu is installed
echo ""
echo "Checking environment..."

if command -v tofu &> /dev/null; then
    log_success "OpenTofu is installed ($(tofu version | head -1))"
elif command -v terraform &> /dev/null; then
    log_success "Terraform is installed ($(terraform version | head -1))"
else
    log_error "Neither OpenTofu nor Terraform is installed"
    echo "  Install OpenTofu: https://opentofu.org/docs/intro/install/"
    echo "  OR Terraform: https://www.terraform.io/downloads"
fi

# Cost estimate
echo ""
echo "==========================================="
echo "Estimated Monthly Cost (24/7 operation)"
echo "==========================================="

if [[ "$GPU_TYPE" == *"V100"* ]]; then
    echo "Pod (Tesla V100):  \$316.80/month"
elif [[ "$GPU_TYPE" == *"4090"* ]]; then
    echo "Pod (RTX 4090):    \$496.80/month"
else
    echo "Pod:               Unknown (check Runpod pricing)"
fi

if [ -n "$VOLUME_SIZE" ]; then
    VOLUME_COST=$(echo "scale=2; $VOLUME_SIZE * 0.10" | bc)
    echo "Volume (${VOLUME_SIZE} GB):    \$$VOLUME_COST/month"
fi

echo "==========================================="

# Final summary
echo ""
if [ $ERRORS -gt 0 ]; then
    log_error "Found $ERRORS error(s). Fix them before deployment."
    exit 1
elif [ $WARNINGS -gt 0 ]; then
    log_warning "Found $WARNINGS warning(s). Review them before deployment."
    echo ""
    echo "To proceed anyway:"
    echo "  ./deploy.sh plan   # preview changes"
    echo "  ./deploy.sh apply  # deploy to Runpod"
    exit 0
else
    log_success "Configuration looks good!"
    echo ""
    echo "Next steps:"
    echo "  ./deploy.sh init   # initialize Terraform (first time only)"
    echo "  ./deploy.sh plan   # preview changes"
    echo "  ./deploy.sh apply  # deploy to Runpod"
fi