<?php
// Requires ext-curl and a libcurl build that supports HTTPS proxies for Shield.
try {
    $key = getenv('QG_PRODUCT') === 'shield' ? 'QUOTAGUARDSHIELD_URL' : 'QUOTAGUARDSTATIC_URL';
    $proxy = getenv($key);
    if (!$proxy) throw new RuntimeException('Proxy required');
    $ch = curl_init('https://ip.quotaguard.com');
    curl_setopt_array($ch, [CURLOPT_PROXY => $proxy, CURLOPT_NOPROXY => '',
        CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_CONNECTTIMEOUT => 10, CURLOPT_TIMEOUT => 30]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($raw === false || $status !== 200) throw new RuntimeException('Request failed');
    $body = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
    $pair = array_map('trim', explode(',', getenv('QG_EXPECTED_IPS') ?: ''));
    if (count(array_unique($pair)) !== 2 || !in_array($body['ip'], $pair, true)) throw new RuntimeException('Wrong IP');
    echo "PHP client egress matches dashboard pair\n";
} catch (Throwable $e) {
    fwrite(STDERR, "PHP proxy check failed\n");
    exit(1);
}