vps

// The VPS of an OVHcloud account, by the OVHcloud API with an application's keys: the state of each VPS.
// Reads GET <api>/vps, then for each VPS GET <api>/vps/<name>, each signed by ovh.sign.
need('protocol:http');
need('protocol:ovh');
$endpoint = need('protocol:ovh:endpoint');

per('vps', 'VPS');
output('state', 'text', array('label' => 'State', 'per' => 'vps'));

watch.expect('not-running', 'VPS not running', 'state', array(
    'help'     => 'Raises when the VPS is in any other state than running, or than the backup OVHcloud makes while it runs.',
    'critical' => array('running', 'backuping'),
    'for'      => '2 runs',
));
watch.missing('missing', 'VPS missing', 'state', array('enabled' => false));

// The address of the API set on the probe, checked: https:// only, its host and its version, without a final
// slash, https://eu.api.ovh.com/1.0. The signed headers go there and nowhere else.
function ovh_api($endpoint) {
    if (list.count(text.match($endpoint, '^https://[A-Za-z0-9.-]+/[0-9.]+$')) == 0) {
        fail('misconfigured', 'The address of the OVHcloud API is not written https://<host>/<version>',
            'For instance https://eu.api.ovh.com/1.0, https://ca.api.ovh.com/1.0 or https://api.us.ovhcloud.com/1.0.');
    }
    return $endpoint;
}

// One signed GET on the OVHcloud API: ovh.sign gives the headers that carry the application key, the consumer
// key and the signature; the application secret never leaves.
function ovh_get($api, $path, $what) {
    $url = $api . $path;
    $answer = http.get($url, headers=ovh.sign('GET', $url, ''));
    if ($answer['status'] == 401) {
        fail('misconfigured', 'OVHcloud refuses the keys, code 401',
            'The application key, its secret or the consumer key is wrong, expired or revoked, or the clock of the poller is off.');
    }
    if ($answer['status'] == 403) {
        fail('misconfigured', 'The consumer key may not read ' . $what . ', code 403',
            'Its access rules must allow GET on the routes the documentation of the collector names.');
    }
    if ($answer['status'] == 400 || $answer['status'] == 404) {
        fail('misconfigured', 'OVHcloud refuses to read ' . $what . ', code ' . $answer['status']);
    }
    if ($answer['status'] != 200) {
        fail('unreachable', 'OVHcloud answers the reading of ' . $what . ' with code ' . $answer['status']);
    }
    return json.read($answer['body']);
}

$api = ovh_api($endpoint);

// ["vps-0a1b2c3d.vps.ovh.net", …]: the names of the VPS, each the serviceName of its routes. A VPS:
// {"name": "vps-0a1b2c3d.vps.ovh.net", "displayName": "web-1", "state": "running", …}; state is backuping, installing, maintenance, rebooting, rescued, running, stopped, stopping or
// upgrading. A VPS is named by its service name, unique; its display name is the customer's and may repeat.
foreach (ovh_get($api, '/vps', 'the VPS') as $name) {
    $vps = ovh_get($api, '/vps/' . url.encode($name), 'the VPS ' . $name);
    value('state', $vps['state'], $name);
}