cleaned up many scrits and deleted some that were of no use; renamed a lot

1 files changed, 0 insertions, 1689 deletions

diff --git a/straper/restore-configs.sh b/straper/restore-configs.sh
deleted file mode 100755
index 5d01eaa..0000000
--- a/straper/restore-configs.sh
+++ /dev/null
@@ -1,1689 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"
-# shellcheck disable=SC1091
-source "${SCRIPT_DIR}/lib/common.sh"
-
-SCRIPT_NAME="restore-configs.sh"
-CATEGORIES=()
-LIST_CATEGORIES=false
-
-usage() {
-  cat <<USAGE
-Usage: sudo ./restore-configs.sh [options]
-
-Purpose:
-  Restore selected configs from a capture DB in a controlled, category-based way.
-  Intended to be non-fatal per item whenever possible. Sensitive/identity-heavy
-  categories should be restored deliberately.
-
-Options:
-  --db-dir PATH
-  --role lab|hardware|replacement
-  --category NAME           May be used multiple times
-  --list-categories
-  --yes                     Non-interactive yes to prompts
-  --dry-run
-  --verbose
-  --help
-
-Categories:
-  system-basics
-  users
-  ssh
-  network
-  dns
-  firewall
-  nginx
-  mariadb
-  postfix
-  prosody
-  tor
-  i2pd
-  docker
-  monitoring
-USAGE
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --db-dir) DB_DIR="$2"; PUBLIC_DIR="${DB_DIR}/db/public"; SECRET_DIR="${DB_DIR}/db/secret"; shift ;;
-    --role) ROLE="$2"; shift ;;
-    --category) CATEGORIES+=("$2"); shift ;;
-    --list-categories) LIST_CATEGORIES=true ;;
-    --yes) ASSUME_YES=true ;;
-    --dry-run) DRY_RUN=true ;;
-    --verbose) VERBOSE=true ;;
-    --help) usage; exit 0 ;;
-    *) die "unknown option: $1" ;;
-  esac
-  shift
-done
-
-if [[ "${LIST_CATEGORIES}" == true ]]; then
-  printf '%s\n' \
-    system-basics \
-    users \
-    ssh \
-    network \
-    dns \
-    firewall \
-    nginx \
-    mariadb \
-    postfix \
-    prosody \
-    tor \
-    i2pd \
-    docker \
-    monitoring
-  exit 0
-fi
-
-ensure_root
-load_optional_config
-ensure_runtime_dirs
-require_cmd cp chmod chown find grep sed awk systemctl
-
-[[ -d "${PUBLIC_DIR}" ]] || die "public DB not found: ${PUBLIC_DIR}"
-[[ ${#CATEGORIES[@]} -gt 0 ]] || die "no categories specified; use --category or --list-categories"
-
-log "${SCRIPT_NAME}: role=${ROLE} categories=${CATEGORIES[*]} db=${DB_DIR}"
-report "${SCRIPT_NAME}" "run" "start" "init" "ok" "role=${ROLE} categories=${CATEGORIES[*]}" ""
-
-case "${ROLE}" in
-  lab|hardware|replacement) ;;
-  *) die "invalid role: ${ROLE}" ;;
-esac
-
-fix_sudoers_perms() {
-  if [[ ${DRY_RUN} == true ]]; then
-    printf '[dry] normalize sudoers ownership and permissions\n'
-    return 0
-  fi
-
-  if [[ -f /etc/sudoers ]]; then
-    chown root:root /etc/sudoers || true
-    chmod 0440 /etc/sudoers || true
-  fi
-
-  if [[ -d /etc/sudoers.d ]]; then
-    chown root:root /etc/sudoers.d || true
-    chmod 0755 /etc/sudoers.d || true
-    find /etc/sudoers.d -maxdepth 1 -type f -exec chown root:root {} \; || true
-    find /etc/sudoers.d -maxdepth 1 -type f -exec chmod 0440 {} \; || true
-  fi
-
-  if visudo -c >/dev/null 2>&1; then
-    report "${SCRIPT_NAME}" "users" "sudoers-perms" "fix" "changed" "sudoers ownership and permissions normalized" ""
-    return 0
-  fi
-
-  note_failure "${SCRIPT_NAME}" "users" "sudoers-perms" "fix" "visudo validation failed after permission normalization"
-  return 1
-}
-
-maybe_restore() {
-  local category="$1" item="$2" src="$3" dst="$4"
-  local prompt_text="Restore ${category}/${item} -> ${dst}?"
-
-  if ! prompt_yes_no "${prompt_text}" yes; then
-    report "${SCRIPT_NAME}" "${category}" "${item}" "restore" "skipped" "operator skipped" ""
-    return 0
-  fi
-
-  restore_path "${SCRIPT_NAME}" "${category}" "${item}" "${src}" "${dst}" || true
-}
-
-category_enabled() {
-  local want="$1" x
-  for x in "${CATEGORIES[@]}"; do
-    [[ "${x}" == "${want}" ]] && return 0
-  done
-  return 1
-}
-
-restore_system_basics() {
-  local base="${PUBLIC_DIR}/system"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "system-basics" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'system-basics'?" yes; then
-    report "${SCRIPT_NAME}" "system-basics" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  maybe_restore "system-basics" "etc-hostname"      "${base}/etc-hostname"      "/etc/hostname"
-  maybe_restore "system-basics" "etc-hosts"         "${base}/etc-hosts"         "/etc/hosts"
-  maybe_restore "system-basics" "etc-environment"   "${base}/etc-environment"   "/etc/environment"
-  maybe_restore "system-basics" "locale.gen"        "${base}/locale.gen"        "/etc/locale.gen"
-  maybe_restore "system-basics" "timezone"          "${base}/timezone"          "/etc/timezone"
-
-  if [[ -f "${base}/etc-hostname" ]]; then
-    local captured_hostname
-    captured_hostname="$(head -n1 "${base}/etc-hostname" 2>/dev/null || true)"
-    if [[ -n "${captured_hostname}" ]]; then
-      if prompt_yes_no "Apply captured hostname now?" yes; then
-        if [[ ${DRY_RUN} == true ]]; then
-          printf '[dry] hostnamectl set-hostname %s\n' "${captured_hostname}"
-        else
-          hostnamectl set-hostname "${captured_hostname}" || note_failure "${SCRIPT_NAME}" "system-basics" "hostnamectl" "set" "hostnamectl failed"
-        fi
-        report "${SCRIPT_NAME}" "system-basics" "hostnamectl" "set" "changed" "${captured_hostname}" ""
-      else
-        report "${SCRIPT_NAME}" "system-basics" "hostnamectl" "set" "skipped" "operator skipped hostnamectl" ""
-      fi
-    fi
-  fi
-}
-
-restore_users() {
-  local base="${PUBLIC_DIR}/users"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "users" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'users'?" yes; then
-    report "${SCRIPT_NAME}" "users" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  maybe_restore "users" "sudoers"    "${base}/sudoers"    "/etc/sudoers"
-  maybe_restore "users" "sudoers.d"  "${base}/sudoers.d"  "/etc/sudoers.d"
-  fix_sudoers_perms || true
-  maybe_restore "users" "shells"     "${base}/shells"     "/etc/shells"
-  maybe_restore "users" "login.defs" "${base}/login.defs" "/etc/login.defs"
-}
-
-restore_ssh() {
-  local pub_users="${PUBLIC_DIR}/users"
-  local sec_ssh="${SECRET_DIR}/ssh"
-
-  if ! prompt_yes_no "Restore category 'ssh'?" yes; then
-    report "${SCRIPT_NAME}" "ssh" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if prompt_yes_no "Restore ssh/sshd_config -> /etc/ssh/sshd_config?" yes; then
-    restore_path "${SCRIPT_NAME}" "ssh" "sshd_config" \
-      "${pub_users}/sshd_config" "/etc/ssh/sshd_config" \
-      0644 root root || true
-  else
-    report "${SCRIPT_NAME}" "ssh" "sshd_config" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if prompt_yes_no "Restore ssh/sshd_config.d -> /etc/ssh/sshd_config.d?" yes; then
-    restore_path "${SCRIPT_NAME}" "ssh" "sshd_config.d" \
-      "${pub_users}/sshd_config.d" "/etc/ssh/sshd_config.d" || true
-
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] chown -R root:root /etc/ssh/sshd_config.d\n'
-      printf '[dry] find /etc/ssh/sshd_config.d -type d -exec chmod 0755 {} +\n'
-      printf '[dry] find /etc/ssh/sshd_config.d -type f -exec chmod 0644 {} +\n'
-    else
-      if [[ -d /etc/ssh/sshd_config.d ]]; then
-        chown -R root:root /etc/ssh/sshd_config.d 2>/dev/null || true
-        find /etc/ssh/sshd_config.d -type d -exec chmod 0755 {} + 2>/dev/null || true
-        find /etc/ssh/sshd_config.d -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-    fi
-
-    report "${SCRIPT_NAME}" "ssh" "sshd_config.d-metadata" "restore" "changed" \
-      "normalized /etc/ssh/sshd_config.d ownership=root:root dirs=0755 files=0644" ""
-  else
-    report "${SCRIPT_NAME}" "ssh" "sshd_config.d" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if [[ "${ROLE}" == "replacement" || "${ROLE}" == "hardware" ]]; then
-    if [[ -d "${sec_ssh}/etc-ssh" ]]; then
-      if prompt_yes_no "Restore SSH host keys from secret DB?" no; then
-        restore_path "${SCRIPT_NAME}" "ssh" "host-keys" \
-          "${sec_ssh}/etc-ssh" "/etc/ssh" || true
-
-        if [[ ${DRY_RUN} == true ]]; then
-          printf '[dry] chown root:root /etc/ssh\n'
-          printf '[dry] chmod 0755 /etc/ssh\n'
-          printf '[dry] find /etc/ssh -maxdepth 1 -type f -name '\''ssh_host_*_key'\'' -exec chown root:root {} +\n'
-          printf '[dry] find /etc/ssh -maxdepth 1 -type f -name '\''ssh_host_*_key'\'' -exec chmod 0600 {} +\n'
-          printf '[dry] find /etc/ssh -maxdepth 1 -type f -name '\''ssh_host_*_key.pub'\'' -exec chown root:root {} +\n'
-          printf '[dry] find /etc/ssh -maxdepth 1 -type f -name '\''ssh_host_*_key.pub'\'' -exec chmod 0644 {} +\n'
-        else
-          chown root:root /etc/ssh 2>/dev/null || true
-          chmod 0755 /etc/ssh 2>/dev/null || true
-          find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key' -exec chown root:root {} + 2>/dev/null || true
-          find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key' -exec chmod 0600 {} + 2>/dev/null || true
-          find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} + 2>/dev/null || true
-          find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} + 2>/dev/null || true
-        fi
-
-        report "${SCRIPT_NAME}" "ssh" "host-keys-metadata" "restore" "changed" \
-          "normalized SSH host key ownership=root:root private=0600 public=0644" ""
-      else
-        report "${SCRIPT_NAME}" "ssh" "host-keys" "restore" "skipped" "operator skipped host keys" ""
-      fi
-    fi
-  else
-    report "${SCRIPT_NAME}" "ssh" "host-keys" "restore" "skipped" "lab role: host keys not restored" ""
-  fi
-
-  if [[ -d "${sec_ssh}/user-lukasz" ]]; then
-    if prompt_yes_no "Restore lukasz user SSH material from secret DB?" no; then
-      restore_path "${SCRIPT_NAME}" "ssh" "user-lukasz" \
-        "${sec_ssh}/user-lukasz" "/home/lukasz/.ssh" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R lukasz:lukasz /home/lukasz/.ssh\n'
-        printf '[dry] chmod 700 /home/lukasz/.ssh\n'
-        printf '[dry] find /home/lukasz/.ssh -maxdepth 1 -type f -exec chmod 600 {} +\n'
-      else
-        chown -R lukasz:lukasz /home/lukasz/.ssh 2>/dev/null || true
-        chmod 700 /home/lukasz/.ssh 2>/dev/null || true
-        find /home/lukasz/.ssh -maxdepth 1 -type f -exec chmod 600 {} + 2>/dev/null || true
-      fi
-
-      report "${SCRIPT_NAME}" "ssh" "user-lukasz-metadata" "restore" "changed" \
-        "normalized /home/lukasz/.ssh ownership=lukasz:lukasz dir=0700 files=0600" ""
-    else
-      report "${SCRIPT_NAME}" "ssh" "user-lukasz" "restore" "skipped" "operator skipped user ssh material" ""
-    fi
-  fi
-
-  if have_cmd sshd; then
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] sshd -t\n'
-      report "${SCRIPT_NAME}" "ssh" "validate" "check" "ok" "dry-run only" ""
-    else
-      if sshd -t; then
-        report "${SCRIPT_NAME}" "ssh" "validate" "check" "ok" "sshd config validates" ""
-        systemctl restart ssh >/dev/null 2>&1 || true
-      else
-        note_failure "${SCRIPT_NAME}" "ssh" "validate" "check" "sshd validation failed"
-      fi
-    fi
-  fi
-}
-
-restore_network() {
-  local base="${PUBLIC_DIR}/network"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "network" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'network'? This can disrupt connectivity." no; then
-    report "${SCRIPT_NAME}" "network" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ "${ROLE}" == "lab" ]]; then
-    manual_line="lab role: full network restore intentionally skipped"
-    report "${SCRIPT_NAME}" "network" "category" "manual" "manual" "${manual_line}" ""
-    return 0
-  fi
-
-  maybe_restore "network" "etc-network"      "${base}/etc-network"      "/etc/network"
-  maybe_restore "network" "etc-netplan"      "${base}/etc-netplan"      "/etc/netplan"
-  maybe_restore "network" "systemd-network"  "${base}/systemd-network"  "/etc/systemd/network"
-  maybe_restore "network" "nsswitch.conf"    "${base}/nsswitch.conf"    "/etc/nsswitch.conf"
-
-  # Postfix maintains a chroot copy of nsswitch.conf — refresh it after restore
-  if ! $DRY_RUN && have_cmd postfix; then
-    postfix set-permissions 2>/dev/null || true
-    report "${SCRIPT_NAME}" "network" "postfix-chroot-sync" "fix" "ok" "postfix chroot permissions refreshed" ""
-  fi
-  maybe_restore "network" "hosts.allow"      "${base}/hosts.allow"      "/etc/hosts.allow"
-  maybe_restore "network" "hosts.deny"       "${base}/hosts.deny"       "/etc/hosts.deny"
-}
-
-# =============================================================================
-# restore_dns() — smart, adaptive DNS category restore
-# =============================================================================
-#
-# DROP-IN REPLACEMENT for the naive restore_dns() in restore-configs.sh.
-# Replace lines 326-344 with this entire block.
-#
-# What this does that the old version did not:
-#
-#   1. SCAN   — detects live interfaces, IPs, WireGuard ifaces, Docker bridges,
-#               who currently owns port 53
-#   2. ANALYZE — classifies each captured dnsmasq.conf and dnsmasq.d/* file:
-#               safe | adapted | dormant-wireguard | dormant-docker | manual
-#   3. ADAPT  — rewrites listen-address/server lines to only use IPs that
-#               exist on this machine right now
-#   4. PREPARE — bootstraps unbound root.key if missing
-#               disables systemd-resolved stub if it would conflict
-#   5. START  — enables + starts unbound then dnsmasq in correct order
-#               verifies each is listening before proceeding
-#   6. VERIFY — confirms deb.debian.org resolves
-#               only then writes /etc/resolv.conf
-#   7. REPORT — prints a precise summary with ✓/⚠/✗ and a MANUAL TASKS list
-#
-# Roles:
-#   lab         — skipped (architecture mismatch too severe for lab)
-#   hardware    — full adaptive restore, services started
-#   replacement — full adaptive restore, services started
-#
-# =============================================================================
-
-# ── Internal helpers ──────────────────────────────────────────────────────────
-
-# Print a DNS-category-specific status line (not using global report() for
-# the inline summary — those go to TSV separately)
-_dns_ok()     { printf '  \033[32m✓\033[0m adapted    %s\n' "$*"; }
-_dns_dormant(){ printf '  \033[33m⚠\033[0m dormant    %s\n' "$*"; }
-_dns_manual() { printf '  \033[31m✗\033[0m MANUAL     %s\n' "$*"; }
-_dns_info()   { printf '  \033[36m·\033[0m            %s\n' "$*"; }
-
-# Collect all IPs currently assigned to any interface on this machine
-_live_ips() {
-  ip -o addr show 2>/dev/null \
-    | awk '{print $4}' \
-    | sed 's|/.*||' \
-    | sort -u
-}
-
-# Collect WireGuard interface names currently present
-_wg_ifaces() {
-  ip link show type wireguard 2>/dev/null \
-    | awk -F': ' '/^[0-9]+:/{print $2}' \
-    | awk '{print $1}' \
-    | sort -u
-}
-
-# Collect Docker bridge IPs (172.x.x.1 pattern on br-* or docker0)
-_docker_bridge_ips() {
-  ip -o addr show 2>/dev/null \
-    | awk '/br-|docker0/{print $4}' \
-    | sed 's|/.*||' \
-    | sort -u
-}
-
-# Who owns port 53 right now?
-_port53_owner() {
-  local line
-  line="$(ss -tlnp 2>/dev/null | grep ':53 ' | head -1)"
-  if   echo "$line" | grep -q dnsmasq;  then echo "dnsmasq"
-  elif echo "$line" | grep -q unbound;  then echo "unbound"
-  elif echo "$line" | grep -q systemd;  then echo "resolved"
-  elif [[ -z "$line" ]];                then echo "none"
-  else                                       echo "unknown"
-  fi
-}
-
-# Is an IP a WireGuard-range IP? (10.50.x.x by default on sanctum)
-# Also checks if it matches any IP on a wg interface
-_is_wg_ip() {
-  local ip="$1"
-  # Check against known wg interface IPs
-  local wg_ips
-  wg_ips="$(ip -o addr show type wireguard 2>/dev/null | awk '{print $4}' | sed 's|/.*||')"
-  echo "$wg_ips" | grep -qx "$ip" && return 0
-  # Heuristic: 10.50.x.x is sanctum's WireGuard subnet
-  [[ "$ip" =~ ^10\.50\. ]] && return 0
-  return 1
-}
-
-# Is an IP a Docker bridge IP?
-_is_docker_ip() {
-  local ip="$1"
-  _docker_bridge_ips | grep -qx "$ip" && return 0
-  [[ "$ip" =~ ^172\.(1[6-9]|2[0-9]|3[01])\. ]] && return 0
-  return 1
-}
-
-# Is an IP live on this machine right now?
-_ip_is_live() {
-  _live_ips | grep -qx "$1"
-}
-
-# Is an IP in a private LAN range (RFC1918) that is just not live on this machine?
-# These are likely the source host's LAN IPs — dormant on fresh hardware, not truly foreign.
-_is_lan_ip() {
-  local ip="$1"
-  [[ "$ip" =~ ^10\. ]]          && return 0
-  [[ "$ip" =~ ^192\.168\. ]]    && return 0
-  [[ "$ip" =~ ^172\.(1[6-9]|2[0-9]|3[01])\. ]] && return 0
-  return 1
-}
-
-# Classify a single IP from a dnsmasq config perspective
-# Returns: live | wg | docker | lan | foreign
-_classify_ip() {
-  local ip="$1"
-  [[ "$ip" == "127.0.0.1" || "$ip" == "::1" ]] && { echo "live"; return; }
-  _ip_is_live "$ip"   && { echo "live";    return; }
-  _is_wg_ip   "$ip"   && { echo "wg";      return; }
-  _is_docker_ip "$ip" && { echo "docker";  return; }
-  _is_lan_ip  "$ip"   && { echo "lan";     return; }
-  echo "foreign"
-}
-
-# Rewrite a dnsmasq config file, adapting listen-address and server= lines.
-# Writes adapted file to $dst. Returns classification of the file overall.
-# Prints per-line notes to stdout.
-_adapt_dnsmasq_file() {
-  local src="$1" dst="$2" fname="$3"
-  local line classification="safe"
-  local has_wg=false has_docker=false has_foreign=false has_live=false
-  local dropped_lan=()
-  local has_lan_dropped=false
-
-  local tmp
-  tmp="$(mktemp)"
-
-  while IFS= read -r line; do
-    # ── listen-address = a,b,c ──────────────────────────────────────────────
-    if [[ "$line" =~ ^[[:space:]]*listen-address= ]]; then
-      local addr_str="${line#*=}"
-      local new_addrs=() dropped_wg=() dropped_docker=() dropped_foreign=()
-
-      IFS=',' read -ra addrs <<< "$addr_str"
-      for addr in "${addrs[@]}"; do
-        addr="${addr// /}"
-        local cls
-        cls="$(_classify_ip "$addr")"
-        case "$cls" in
-          live)    new_addrs+=("$addr"); has_live=true ;;
-          wg)      dropped_wg+=("$addr"); has_wg=true ;;
-          docker)  dropped_docker+=("$addr"); has_docker=true ;;
-          lan)     dropped_lan+=("$addr"); has_lan_dropped=true ;;
-          foreign) dropped_foreign+=("$addr"); has_foreign=true ;;
-        esac
-      done
-
-      if [[ ${#new_addrs[@]} -gt 0 ]]; then
-        printf 'listen-address=%s\n' "$(IFS=','; echo "${new_addrs[*]}")" >> "$tmp"
-      else
-        # No live addresses left — bind to loopback only as safe fallback
-        printf 'listen-address=127.0.0.1\n' >> "$tmp"
-        _dns_info "$fname: all listen-address IPs non-local — fell back to 127.0.0.1"
-      fi
-
-      [[ ${#dropped_wg[@]} -gt 0 ]]      && classification="dormant-wg"
-      [[ ${#dropped_docker[@]} -gt 0 ]]  && [[ "$classification" == "safe" ]] && classification="dormant-docker"
-      [[ ${#dropped_foreign[@]} -gt 0 ]] && classification="foreign"
-      continue
-    fi
-
-    # ── interface= lines referencing named interfaces ───────────────────────
-    if [[ "$line" =~ ^[[:space:]]*interface= ]]; then
-      local iface_name="${line#*=}"
-      iface_name="${iface_name// /}"
-      if ip link show "$iface_name" >/dev/null 2>&1; then
-        printf '%s\n' "$line" >> "$tmp"
-      else
-        printf '# [adapted] interface=%s not present — uncomment when interface exists\n' \
-          "$iface_name" >> "$tmp"
-        if [[ "$iface_name" =~ ^wg ]]; then
-          has_wg=true
-        elif [[ "$iface_name" =~ ^br-|^docker ]]; then
-          has_docker=true
-        else
-          has_foreign=true
-        fi
-      fi
-      continue
-    fi
-
-    # ── server= lines pointing at specific IPs ──────────────────────────────
-    if [[ "$line" =~ ^[[:space:]]*server= ]]; then
-      local server_val="${line#*=}"
-      # Extract just the IP part (before any #port or @iface)
-      local server_ip
-      server_ip="$(echo "$server_val" | sed 's|[#@].*||' | tr -d '/')"
-      if [[ -n "$server_ip" && "$server_ip" != "127.0.0.1" && "$server_ip" != "::1" ]]; then
-        local cls
-        cls="$(_classify_ip "$server_ip")"
-        case "$cls" in
-          wg)     has_wg=true ;;
-          docker) has_docker=true ;;
-          foreign) has_foreign=true ;;
-        esac
-      fi
-      printf '%s\n' "$line" >> "$tmp"
-      continue
-    fi
-
-    # All other lines pass through unchanged
-    printf '%s\n' "$line" >> "$tmp"
-  done < "$src"
-
-  # Final classification
-  # Note: "lan" IPs (RFC1918 not live on this machine) are treated as
-  # dormant-hardware — they belong to the source host's LAN and will be
-  # valid on real replacement hardware. They do NOT trigger "foreign".
-  if $has_foreign; then
-    classification="foreign"
-  elif $has_wg; then
-    classification="dormant-wg"
-  elif $has_docker; then
-    classification="dormant-docker"
-  fi
-  # If only lan IPs were dropped (no wg/docker/foreign), mark dormant-hardware
-  if [[ "$classification" == "safe" && ${#dropped_lan[@]} -gt 0 ]]; then
-    classification="dormant-hardware"
-  fi
-
-  mv "$tmp" "$dst"
-  echo "$classification"
-}
-
-# ── Main restore_dns() ────────────────────────────────────────────────────────
-
-restore_dns() {
-  local base="${PUBLIC_DIR}/dns"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "dns" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'dns'? This will adapt and apply the captured DNS stack." no; then
-    report "${SCRIPT_NAME}" "dns" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  # lab: architecture too machine-specific, skip
-  if [[ "${ROLE}" == "lab" ]]; then
-    report "${SCRIPT_NAME}" "dns" "category" "manual" "manual" \
-      "lab role: DNS restore intentionally skipped — run with --role hardware to test" ""
-    return 0
-  fi
-
-  # ── MANUAL TASKS accumulator ────────────────────────────────────────────────
-  local manual_tasks=()
-
-  # ── PHASE 1: SCAN ──────────────────────────────────────────────────────────
-  log "dns: scanning local topology..."
-
-  local live_ips wg_ifaces docker_ips port53_owner
-  live_ips="$(_live_ips | tr '\n' ' ')"
-  wg_ifaces="$(_wg_ifaces | tr '\n' ' ')"
-  docker_ips="$(_docker_bridge_ips | tr '\n' ' ')"
-  port53_owner="$(_port53_owner)"
-
-  log "dns: live IPs: ${live_ips:-none}"
-  log "dns: WireGuard ifaces: ${wg_ifaces:-none}"
-  log "dns: Docker bridge IPs: ${docker_ips:-none}"
-  log "dns: port 53 currently owned by: ${port53_owner}"
-
-  report "${SCRIPT_NAME}" "dns" "topology-scan" "scan" "ok" \
-    "live_ips=${live_ips} wg=${wg_ifaces:-none} docker=${docker_ips:-none} port53=${port53_owner}" ""
-
-  # ── PHASE 2: DISABLE SYSTEMD-RESOLVED STUB if it owns port 53 ──────────────
-  # systemd-resolved's stub listener on 127.0.0.53 conflicts with dnsmasq
-  # wanting to own 127.0.0.1:53. The correct fix for sanctum's architecture
-  # is to disable the stub and let dnsmasq own the port.
-  if [[ "$port53_owner" == "resolved" ]]; then
-    log "dns: systemd-resolved stub owns port 53 — disabling stub listener..."
-    if $DRY_RUN; then
-      printf '[dry] mkdir -p /etc/systemd/resolved.conf.d\n'
-      printf '[dry] write DNSStubListener=no to /etc/systemd/resolved.conf.d/no-stub.conf\n'
-      printf '[dry] systemctl restart systemd-resolved\n'
-    else
-      mkdir -p /etc/systemd/resolved.conf.d
-      printf '[Resolve]\nDNSStubListener=no\n' \
-        > /etc/systemd/resolved.conf.d/no-stub.conf
-      systemctl restart systemd-resolved >/dev/null 2>&1 || true
-      sleep 1
-      port53_owner="$(_port53_owner)"
-      log "dns: port 53 owner after stub disable: ${port53_owner}"
-    fi
-    report "${SCRIPT_NAME}" "dns" "resolved-stub" "adapt" "changed" \
-      "disabled systemd-resolved DNSStubListener to free port 53 for dnsmasq" ""
-  fi
-
-  # ── PHASE 3: ADAPT AND RESTORE DNSMASQ.CONF ────────────────────────────────
-  if [[ -f "${base}/dnsmasq.conf" ]]; then
-    log "dns: adapting dnsmasq.conf..."
-    local adapted_conf
-    adapted_conf="$(mktemp)"
-
-    if $DRY_RUN; then
-      printf '[dry] adapt dnsmasq.conf → /etc/dnsmasq.conf\n'
-      report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "ok" "dry-run only" ""
-    else
-      local cls
-      cls="$(_adapt_dnsmasq_file "${base}/dnsmasq.conf" "$adapted_conf" "dnsmasq.conf")"
-      cp "$adapted_conf" /etc/dnsmasq.conf
-      rm -f "$adapted_conf"
-      chown root:root /etc/dnsmasq.conf
-      chmod 0644 /etc/dnsmasq.conf
-
-      case "$cls" in
-        safe)
-          _dns_ok "dnsmasq.conf (no adaptation needed)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "changed" "restored unchanged" "" ;;
-        dormant-wg)
-          _dns_ok "dnsmasq.conf (adapted — WireGuard IPs dormant until wg0 exists)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "changed" "adapted: WireGuard IPs stripped from listen-address" ""
-          manual_tasks+=("WireGuard IPs in dnsmasq.conf will activate automatically once wg0 is up") ;;
-        dormant-docker)
-          _dns_ok "dnsmasq.conf (adapted — Docker bridge IPs dormant until Docker is up)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "changed" "adapted: Docker IPs stripped from listen-address" ""
-          manual_tasks+=("Docker bridge IPs in dnsmasq.conf will activate automatically once Docker is up") ;;
-        dormant-hardware)
-          _dns_ok "dnsmasq.conf (adapted — source-host LAN IPs stripped, will need real NIC IP)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "changed" "adapted: source LAN IPs stripped" ""
-          manual_tasks+=("dnsmasq.conf: add this machine's LAN IP to listen-address once NIC is configured") ;;
-        foreign)
-          _dns_dormant "dnsmasq.conf (contains unrecognized IPs — adapted to 127.0.0.1 only)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "restore" "changed" "adapted: foreign IPs stripped" ""
-          manual_tasks+=("dnsmasq.conf had unrecognized IPs — verify listen-address in /etc/dnsmasq.conf") ;;
-      esac
-    fi
-  else
-    mark_manual "${SCRIPT_NAME}" "dns" "dnsmasq.conf" "not found in DB"
-  fi
-
-  # ── PHASE 4: ADAPT AND RESTORE DNSMASQ.D/* ─────────────────────────────────
-  if [[ -d "${base}/dnsmasq.d" ]]; then
-    log "dns: adapting dnsmasq.d/..."
-    local dest_d="/etc/dnsmasq.d"
-    mkdir -p "$dest_d"
-
-    for src_file in "${base}/dnsmasq.d"/*; do
-      [[ -f "$src_file" ]] || continue
-      local fname
-      fname="$(basename "$src_file")"
-      local dst_file="${dest_d}/${fname}"
-      local adapted_f
-      adapted_f="$(mktemp)"
-
-      if $DRY_RUN; then
-        printf '[dry] adapt dnsmasq.d/%s → %s\n' "$fname" "$dst_file"
-        rm -f "$adapted_f"
-        continue
-      fi
-
-      local cls
-      cls="$(_adapt_dnsmasq_file "$src_file" "$adapted_f" "dnsmasq.d/${fname}")"
-      cp "$adapted_f" "$dst_file"
-      rm -f "$adapted_f"
-      chown root:root "$dst_file"
-      chmod 0644 "$dst_file"
-
-      case "$cls" in
-        safe)
-          _dns_ok "dnsmasq.d/${fname}"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.d/${fname}" "restore" "changed" "restored unchanged" "" ;;
-        dormant-wg)
-          _dns_dormant "dnsmasq.d/${fname} (WireGuard-dependent — dormant until wg0 exists)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.d/${fname}" "restore" "changed" "adapted: WireGuard IPs dormant" ""
-          manual_tasks+=("dnsmasq.d/${fname}: WireGuard-dependent rules preserved, activate when wg0 is up") ;;
-        dormant-docker)
-          _dns_dormant "dnsmasq.d/${fname} (Docker-dependent — dormant until Docker bridges exist)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.d/${fname}" "restore" "changed" "adapted: Docker IPs dormant" ""
-          manual_tasks+=("dnsmasq.d/${fname}: Docker-dependent rules preserved, activate when Docker is up") ;;
-        dormant-hardware)
-          _dns_ok "dnsmasq.d/${fname} (adapted — source-host LAN IPs stripped)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.d/${fname}" "restore" "changed" "adapted: source LAN IPs stripped" ""
-          manual_tasks+=("dnsmasq.d/${fname}: add this machine LAN IP to listen-address once NIC is configured") ;;
-        foreign)
-          _dns_manual "dnsmasq.d/${fname} (contains truly unrecognized IPs — copied but needs review)"
-          report "${SCRIPT_NAME}" "dns" "dnsmasq.d/${fname}" "restore" "changed" "adapted: foreign IPs stripped — review needed" ""
-          manual_tasks+=("REVIEW: dnsmasq.d/${fname} had unrecognized IPs — verify manually") ;;
-      esac
-    done
-
-    report "${SCRIPT_NAME}" "dns" "dnsmasq.d" "restore" "changed" "all files adapted and copied" ""
-  fi
-
-  # ── PHASE 5: RESTORE UNBOUND ────────────────────────────────────────────────
-  if [[ -d "${base}/etc-unbound" ]]; then
-    log "dns: restoring unbound config..."
-    if $DRY_RUN; then
-      printf '[dry] restore etc-unbound → /etc/unbound\n'
-    else
-      restore_path "${SCRIPT_NAME}" "dns" "etc-unbound" \
-        "${base}/etc-unbound" "/etc/unbound" || true
-      chown -R root:root /etc/unbound 2>/dev/null || true
-      find /etc/unbound -type d -exec chmod 0755 {} + 2>/dev/null || true
-      find /etc/unbound -type f -exec chmod 0644 {} + 2>/dev/null || true
-    fi
-    report "${SCRIPT_NAME}" "dns" "etc-unbound" "restore" "changed" "unbound config restored and permissions normalized" ""
-  fi
-
-  # ── PHASE 6: BOOTSTRAP UNBOUND DATA FILES ───────────────────────────────────
-  # On Debian 13:
-  #   - trust anchor managed by /usr/libexec/unbound-helper root_trust_anchor_update
-  #     (ExecStartPre in unbound.service) — no manual unbound-anchor needed
-  #   - root.hints must exist at /var/lib/unbound/root.hints if referenced by config
-  #     NOT provided by the package — must be fetched from internic.net
-  log "dns: preparing unbound data files..."
-  if $DRY_RUN; then
-    printf '[dry] mkdir -p /var/lib/unbound\n'
-    printf '[dry] fetch root.hints if referenced by config and missing\n'
-    printf '[dry] chown -R unbound:unbound /var/lib/unbound\n'
-  else
-    mkdir -p /var/lib/unbound
-
-    # root.hints will be fetched after DNS is confirmed working
-    # (fetch requires working DNS — moved to post-verification phase)
-    local needs_root_hints=false
-    grep -rq 'root-hints' /etc/unbound/ 2>/dev/null && needs_root_hints=true
-    if [[ -f /var/lib/unbound/root.hints ]]; then
-      _dns_ok "root.hints already present"
-    elif $needs_root_hints; then
-      _dns_info "root.hints needed — will fetch after DNS is confirmed working"
-    fi
-
-    # Detect unbound port from restored config (default 5353 for sanctum)
-    local unbound_port=5353
-    if [[ -f /etc/unbound/unbound.conf.d/recursive.conf ]]; then
-      local cfg_port
-      cfg_port="$(grep -h '^ *port:' /etc/unbound/unbound.conf.d/recursive.conf 2>/dev/null | awk '{print $2}' | tail -1)"
-      [[ -n "$cfg_port" ]] && unbound_port="$cfg_port"
-    fi
-
-    # If recursive.conf specifies validator module, it needs a valid trust anchor.
-    # On fresh installs without unbound-anchor, disable validator and force correct port.
-    # This gets unbound running; DNSSEC can be re-enabled after the system is stable.
-    local validator_in_use=false
-    grep -rq 'module-config.*validator' /etc/unbound/ 2>/dev/null && validator_in_use=true
-
-    if $validator_in_use; then
-      log "dns: validator module detected — creating no-dnssec override for bootstrap"
-      cat > /etc/unbound/unbound.conf.d/no-dnssec.conf << EOF
-server:
-    module-config: "iterator"
-    port: ${unbound_port}
-EOF
-      # Disable recursive.conf temporarily — it overrides module-config and port
-      if [[ -f /etc/unbound/unbound.conf.d/recursive.conf ]]; then
-        mv /etc/unbound/unbound.conf.d/recursive.conf            /etc/unbound/unbound.conf.d/recursive.conf.bootstrap-disabled
-        _dns_dormant "recursive.conf disabled for bootstrap (re-enable after system is stable)"
-        manual_tasks+=("DNSSEC: re-enable DNSSEC after system stable: mv /etc/unbound/unbound.conf.d/recursive.conf.bootstrap-disabled /etc/unbound/unbound.conf.d/recursive.conf && rm /etc/unbound/unbound.conf.d/no-dnssec.conf && systemctl restart unbound")
-      fi
-      report "${SCRIPT_NAME}" "dns" "unbound-dnssec" "adapt" "changed"         "validator disabled for bootstrap; re-enable after trust anchor is populated" ""
-    fi
-
-    # Ensure unbound owns its data directory
-    chown -R unbound:unbound /var/lib/unbound 2>/dev/null || true
-    chmod 755 /var/lib/unbound 2>/dev/null || true
-
-    # Trust anchor: on Debian 13, root.key is seeded from /usr/share/dns/root.key
-    # which is provided by the dns-root-data package. Install it and run the helper.
-    if [[ ! -f /usr/share/dns/root.key ]]; then
-      log "dns: installing dns-root-data for unbound trust anchor..."
-      DEBIAN_FRONTEND=noninteractive apt-get install -y dns-root-data >/dev/null 2>&1 \
-        && _dns_ok "dns-root-data installed" \
-        || { _dns_manual "dns-root-data install failed — install manually: apt install dns-root-data"; \
-             manual_tasks+=("MANUAL: apt install dns-root-data then systemctl restart unbound"); }
-    fi
-    if [[ -f /usr/share/dns/root.key ]]; then
-      rm -f /var/lib/unbound/root.key
-      /usr/libexec/unbound-helper root_trust_anchor_update 2>/dev/null || true
-      if [[ -f /var/lib/unbound/root.key ]]; then
-        chown unbound:unbound /var/lib/unbound/root.key 2>/dev/null || true
-        _dns_ok "trust anchor seeded from dns-root-data via unbound-helper"
-        report "${SCRIPT_NAME}" "dns" "unbound-trustanchor" "prepare" "changed" "seeded from dns-root-data" ""
-      else
-        _dns_manual "unbound-helper ran but root.key not created"
-        manual_tasks+=("MANUAL: sudo rm /var/lib/unbound/root.key && sudo /usr/libexec/unbound-helper root_trust_anchor_update")
-      fi
-    else
-      _dns_manual "dns-root-data not available — unbound DNSSEC will not work"
-      manual_tasks+=("MANUAL: apt install dns-root-data then restart unbound")
-    fi
-  fi
-
-  # Check for blocklist files referenced in unbound config
-  if ! $DRY_RUN; then
-    local rpz_refs
-    rpz_refs="$(grep -rh 'rpz-file\|include:\|zonefile' /etc/unbound/ 2>/dev/null \
-      | grep -v '^#' \
-      | grep -oP '"[^"]*\.rpz[^"]*"|/[^ ]+\.rpz[^ ]*' \
-      | tr -d '"' \
-      | sort -u || true)"
-    if [[ -n "$rpz_refs" ]]; then
-      while IFS= read -r rpz_file; do
-        if [[ ! -f "$rpz_file" ]]; then
-          _dns_dormant "unbound references ${rpz_file} which does not exist yet"
-          manual_tasks+=("POPULATE: ${rpz_file} referenced by unbound config but not yet present")
-        fi
-      done <<< "$rpz_refs"
-    fi
-  fi
-
-  # ── PHASE 7: START UNBOUND ──────────────────────────────────────────────────
-  log "dns: starting unbound..."
-  if $DRY_RUN; then
-    printf '[dry] systemctl enable --now unbound\n'
-  else
-    systemctl enable unbound >/dev/null 2>&1 || true
-    systemctl restart unbound >/dev/null 2>&1 || true
-    sleep 2
-
-    # Verify unbound is listening on expected port
-    local unbound_port=5353
-    # Detect port from config if non-standard
-    if [[ -f /etc/unbound/unbound.conf ]]; then
-      local cfg_port
-      cfg_port="$(grep -h 'port:' /etc/unbound/unbound.conf.d/*.conf /etc/unbound/unbound.conf 2>/dev/null \
-        | grep -v '^#' | awk '{print $2}' | tail -1)"
-      [[ -n "$cfg_port" ]] && unbound_port="$cfg_port"
-    fi
-
-    if ss -tlnp 2>/dev/null | grep -q ":${unbound_port} "; then
-      _dns_ok "unbound listening on port ${unbound_port}"
-      report "${SCRIPT_NAME}" "dns" "unbound-start" "start" "ok" "listening on :${unbound_port}" ""
-    else
-      local unbound_err
-      unbound_err="$(journalctl -u unbound -n 5 --no-pager 2>/dev/null | tail -3 || true)"
-      _dns_manual "unbound NOT listening on port ${unbound_port}"
-      log "dns: unbound journal tail: ${unbound_err}"
-      report "${SCRIPT_NAME}" "dns" "unbound-start" "start" "failed" "not listening on :${unbound_port}" ""
-      manual_tasks+=("MANUAL: unbound failed to start — check: journalctl -u unbound -n 20")
-    fi
-  fi
-
-  # ── PHASE 8: START DNSMASQ ──────────────────────────────────────────────────
-  log "dns: starting dnsmasq..."
-  if $DRY_RUN; then
-    printf '[dry] systemctl enable --now dnsmasq\n'
-  else
-    # Give unbound a moment to fully come up before dnsmasq tries to reach it
-    # dnsmasq validates its upstream server= at startup — if unbound is not
-    # yet listening on 5353, dnsmasq exits with INVALIDARGUMENT
-    sleep 3
-    systemctl enable dnsmasq >/dev/null 2>&1 || true
-    systemctl restart dnsmasq >/dev/null 2>&1 || true
-    sleep 2
-
-    if ss -tlnp 2>/dev/null | grep -q ':53 '; then
-      local new_owner
-      new_owner="$(_port53_owner)"
-      _dns_ok "port 53 now owned by: ${new_owner}"
-      report "${SCRIPT_NAME}" "dns" "dnsmasq-start" "start" "ok" "listening on :53 owner=${new_owner}" ""
-    else
-      local dnsmasq_err
-      dnsmasq_err="$(journalctl -u dnsmasq -n 5 --no-pager 2>/dev/null | tail -3 || true)"
-      _dns_manual "dnsmasq NOT listening on port 53"
-      log "dns: dnsmasq journal tail: ${dnsmasq_err}"
-      report "${SCRIPT_NAME}" "dns" "dnsmasq-start" "start" "failed" "not listening on :53" ""
-      manual_tasks+=("MANUAL: dnsmasq failed to start — check: journalctl -u dnsmasq -n 20")
-      manual_tasks+=("       likely cause: port 53 still held by another process (ss -tlnp | grep :53)")
-    fi
-  fi
-
-  # ── PHASE 9: VERIFY RESOLUTION ─────────────────────────────────────────────
-  local resolution_ok=false
-  if ! $DRY_RUN; then
-    log "dns: verifying resolution..."
-    sleep 1
-    if getent ahostsv4 deb.debian.org >/dev/null 2>&1; then
-      _dns_ok "deb.debian.org resolves ✓"
-      resolution_ok=true
-      report "${SCRIPT_NAME}" "dns" "verify-resolution" "check" "ok" "deb.debian.org resolves" ""
-    else
-      _dns_manual "resolution FAILED for deb.debian.org"
-      report "${SCRIPT_NAME}" "dns" "verify-resolution" "check" "failed" "deb.debian.org did not resolve" ""
-      manual_tasks+=("MANUAL: DNS resolution failed — run: dig deb.debian.org @127.0.0.1 to debug")
-    fi
-  fi
-
-  # ── PHASE 9b: FETCH ROOT.HINTS — now that DNS works ────────────────────────
-  if ! $DRY_RUN && $needs_root_hints && [[ ! -f /var/lib/unbound/root.hints ]]; then
-    log "dns: fetching root.hints (DNS now confirmed working)..."
-    if curl -sSf https://www.internic.net/domain/named.root             -o /var/lib/unbound/root.hints 2>/dev/null; then
-      chown unbound:unbound /var/lib/unbound/root.hints 2>/dev/null || true
-      _dns_ok "root.hints fetched from internic.net"
-      report "${SCRIPT_NAME}" "dns" "root.hints" "prepare" "changed" "fetched post-DNS-verify" ""
-      # Restart unbound with root.hints now available
-      systemctl restart unbound >/dev/null 2>&1 || true
-      sleep 1
-    else
-      _dns_manual "could not fetch root.hints"
-      manual_tasks+=("MANUAL: curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.root && systemctl restart unbound")
-    fi
-  fi
-
-  # ── PHASE 10: WRITE RESOLV.CONF — only if resolution confirmed ─────────────
-  if $DRY_RUN; then
-    printf '[dry] write /etc/resolv.conf → nameserver 127.0.0.1 (only if resolution confirmed)\n'
-  elif $resolution_ok; then
-    log "dns: writing /etc/resolv.conf..."
-
-    # Remove immutable flag if set by install-base bootstrap
-    chattr -i /etc/resolv.conf 2>/dev/null || true
-
-    # Back up current resolv.conf before touching it
-    backup_target /etc/resolv.conf >/dev/null 2>&1 || true
-
-    # Break symlink if it points at systemd-resolved stub
-    if [[ -L /etc/resolv.conf ]]; then
-      local link_target
-      link_target="$(readlink /etc/resolv.conf)"
-      log "dns: /etc/resolv.conf is symlink to ${link_target} — replacing with static file"
-      rm -f /etc/resolv.conf
-    fi
-
-    printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf
-    chown root:root /etc/resolv.conf
-    chmod 0644 /etc/resolv.conf
-
-    _dns_ok "/etc/resolv.conf written → nameserver 127.0.0.1"
-    report "${SCRIPT_NAME}" "dns" "resolv.conf" "restore" "changed" \
-      "written: nameserver 127.0.0.1 (resolution confirmed before write)" ""
-  else
-    # Resolution failed — write a safe fallback, mark resolv.conf as manual
-    log "dns: resolution not confirmed — writing fallback resolv.conf (1.1.1.1)"
-    chattr -i /etc/resolv.conf 2>/dev/null || true
-    backup_target /etc/resolv.conf >/dev/null 2>&1 || true
-    [[ -L /etc/resolv.conf ]] && rm -f /etc/resolv.conf
-    printf '# fallback — local resolver did not come up cleanly\n# replace with: nameserver 127.0.0.1 once dnsmasq is running\nnameserver 1.1.1.1\nnameserver 9.9.9.9\n' \
-      > /etc/resolv.conf
-    chown root:root /etc/resolv.conf
-    chmod 0644 /etc/resolv.conf
-
-    _dns_dormant "/etc/resolv.conf → fallback 1.1.1.1 (local resolver not confirmed)"
-    report "${SCRIPT_NAME}" "dns" "resolv.conf" "restore" "changed" \
-      "fallback written: 1.1.1.1 — replace with 127.0.0.1 once dnsmasq is confirmed" ""
-    manual_tasks+=("MANUAL: once dnsmasq is running, run: echo 'nameserver 127.0.0.1' > /etc/resolv.conf")
-  fi
-
-  # ── PHASE 11: SUMMARY REPORT ────────────────────────────────────────────────
-  printf '\n'
-  printf '  ── DNS restore summary ────────────────────────────────────────────\n'
-
-  # WireGuard not present
-  if [[ -z "${wg_ifaces// /}" ]]; then
-    _dns_dormant "WireGuard not present — WireGuard-dependent DNS rules are preserved but dormant"
-    _dns_info    "They will activate automatically once WireGuard is restored"
-    _dns_info    "Run: restore-configs.sh --category wireguard (when implemented)"
-  fi
-
-  # Docker not present or no bridges
-  if [[ -z "${docker_ips// /}" ]] && ! have_cmd docker; then
-    _dns_dormant "Docker not present — Docker-dependent DNS rules are preserved but dormant"
-  fi
-
-  # Print manual task list
-  if [[ ${#manual_tasks[@]} -gt 0 ]]; then
-    printf '\n'
-    printf '  ── MANUAL TASKS REQUIRED ──────────────────────────────────────────\n'
-    local i=1
-    for task in "${manual_tasks[@]}"; do
-      printf '  [%d] %s\n' "$i" "$task"
-      ((i+=1))
-    done
-    printf '\n'
-    report "${SCRIPT_NAME}" "dns" "manual-tasks" "manual" "manual" \
-      "${#manual_tasks[@]} manual tasks recorded" ""
-  else
-    printf '\n'
-    printf '  ── No manual tasks required ✓\n'
-    printf '\n'
-  fi
-
-  report "${SCRIPT_NAME}" "dns" "category" "restore" "changed" \
-    "adaptive DNS restore completed; manual_tasks=${#manual_tasks[@]}" ""
-}
-
-# ── Firewall output helpers ───────────────────────────────────────────────────
-_fw_ok()     { printf '  \033[32m✓\033[0m adapted    %s\n' "$*"; }
-_fw_dormant(){ printf '  \033[33m⚠\033[0m dormant    %s\n' "$*"; }
-_fw_manual() { printf '  \033[31m✗\033[0m MANUAL     %s\n' "$*"; }
-_fw_info()   { printf '  \033[36m·\033[0m            %s\n' "$*"; }
-
-_adapt_nftables() {
-  local src="$1" dst="$2"
-  local dormant_ifaces=()
-  local line tmp
-  tmp="$(mktemp)"
-
-  while IFS= read -r line; do
-    # Extract quoted interface name from iif/oif/iifname/oifname directives
-    # Skip wildcard patterns like br-*
-    # Pattern: keyword followed by whitespace and a quoted non-wildcard name
-    local ref_iface=""
-    if echo "$line" | grep -qE '(iif|oif|iifname|oifname)[[:space:]]+"[^"*]+"'; then
-      # Extract the interface name that immediately follows an iif/oif keyword
-      ref_iface="$(echo "$line" | sed -E 's/.*\b(iif|oif|iifname|oifname)[[:space:]]+"([^"*]+)".*/\2/' | grep -v "^$line$" || true)"
-    fi
-
-    if [[ -z "$ref_iface" ]]; then
-      printf '%s\n' "$line" >> "$tmp"
-      continue
-    fi
-
-    if ip link show "$ref_iface" >/dev/null 2>&1; then
-      printf '%s\n' "$line" >> "$tmp"
-    else
-      local reason="dormant"
-      [[ "$ref_iface" =~ ^wg ]] && reason="dormant-wireguard"
-      [[ "$ref_iface" == enx* || "$ref_iface" == eth* ]] && reason="dormant-hardware-nic"
-      printf '# [adapted:%s] %s\n' "$reason" "$line" >> "$tmp"
-      local already=false
-      local d
-      for d in "${dormant_ifaces[@]:-}"; do [[ "$d" == "$ref_iface" ]] && already=true; done
-      $already || dormant_ifaces+=("$ref_iface")
-    fi
-  done < "$src"
-
-  mv "$tmp" "$dst"
-  printf '%s\n' "${dormant_ifaces[@]:-}"
-}
-
-restore_firewall() {
-  local base="${PUBLIC_DIR}/firewall"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "firewall" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'firewall'? This will adapt and apply the captured ruleset." no; then
-    report "${SCRIPT_NAME}" "firewall" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ "${ROLE}" == "lab" ]]; then
-    report "${SCRIPT_NAME}" "firewall" "category" "manual" "manual" "lab role: firewall restore intentionally skipped" ""
-    return 0
-  fi
-
-  local fw_manual_tasks=()
-
-  # ── ADAPT AND RESTORE NFTABLES.CONF ────────────────────────────────────────
-  if [[ -f "${base}/nftables.conf" ]]; then
-    log "firewall: adapting nftables.conf..."
-    if $DRY_RUN; then
-      printf '[dry] adapt nftables.conf → /etc/nftables.conf\n'
-    else
-      local adapted dormant_list
-      adapted="$(mktemp)"
-      dormant_list="$(_adapt_nftables "${base}/nftables.conf" "$adapted")"
-      cp "$adapted" /etc/nftables.conf
-      rm -f "$adapted"
-      chown root:root /etc/nftables.conf
-      chmod 0640 /etc/nftables.conf
-
-      if [[ -n "$dormant_list" ]]; then
-        local docker_dormant=false
-        while IFS= read -r iface; do
-          [[ -z "$iface" ]] && continue
-          if [[ "$iface" =~ ^wg ]]; then
-            _fw_dormant "rules for ${iface} commented out (WireGuard — activate when ${iface} exists)"
-            fw_manual_tasks+=("FIREWALL: ${iface} rules dormant — activate when WireGuard is up")
-          elif [[ "$iface" == enx* || "$iface" == eth* ]]; then
-            _fw_dormant "rules for ${iface} commented out (NIC not present — update if using different interface name)"
-            fw_manual_tasks+=("FIREWALL: ${iface} rules dormant — replace with actual NIC name in /etc/nftables.conf")
-          elif [[ "$iface" =~ ^br- || "$iface" == docker0 ]]; then
-            docker_dormant=true
-          else
-            _fw_dormant "rules for ${iface} commented out (interface not present)"
-            fw_manual_tasks+=("FIREWALL: ${iface} rules dormant — review /etc/nftables.conf")
-          fi
-        done <<< "$dormant_list"
-        if $docker_dormant; then
-          _fw_dormant "Docker bridge rules commented out (Docker not yet up — will activate automatically when Docker starts)"
-          fw_manual_tasks+=("FIREWALL: Docker bridge rules dormant — start Docker and rules will activate on next nftables reload")
-        fi
-        report "${SCRIPT_NAME}" "firewall" "nftables.conf" "restore" "changed" "adapted: dormant interfaces commented out" ""
-      else
-        _fw_ok "nftables.conf (no adaptation needed)"
-        report "${SCRIPT_NAME}" "firewall" "nftables.conf" "restore" "changed" "restored unchanged" ""
-      fi
-    fi
-  else
-    mark_manual "${SCRIPT_NAME}" "firewall" "nftables.conf" "not found in DB"
-  fi
-
-  # ── RESTORE NFTABLES.D ──────────────────────────────────────────────────────
-  if [[ -d "${base}/nftables.d" ]]; then
-    if $DRY_RUN; then
-      printf '[dry] restore nftables.d → /etc/nftables.d\n'
-    else
-      restore_path "${SCRIPT_NAME}" "firewall" "nftables.d" \
-        "${base}/nftables.d" "/etc/nftables.d" || true
-      _fw_ok "nftables.d restored"
-    fi
-  fi
-
-  # ── VALIDATE ────────────────────────────────────────────────────────────────
-  if ! $DRY_RUN && [[ -f /etc/nftables.conf ]] && have_cmd nft; then
-    local validate_out
-    validate_out="$(nft -c -f /etc/nftables.conf 2>&1)"
-    if [[ -z "$validate_out" ]]; then
-      _fw_ok "nftables.conf validates cleanly"
-      report "${SCRIPT_NAME}" "firewall" "validate" "check" "ok" "nft -c passed" ""
-    else
-      _fw_manual "nftables.conf validation errors:"
-      while IFS= read -r vline; do _fw_info "  $vline"; done <<< "$validate_out"
-      fw_manual_tasks+=("FIREWALL: fix remaining validation errors: sudo nft -c -f /etc/nftables.conf")
-      note_failure "${SCRIPT_NAME}" "firewall" "validate" "check" "nft -c failed"
-    fi
-  fi
-
-  # ── LOAD ────────────────────────────────────────────────────────────────────
-  if ! $DRY_RUN && [[ -f /etc/nftables.conf ]] && have_cmd nft; then
-    local load_out
-    load_out="$(nft -f /etc/nftables.conf 2>&1)"
-    if [[ -z "$load_out" ]]; then
-      _fw_ok "ruleset loaded successfully"
-      systemctl enable nftables >/dev/null 2>&1 || true
-      systemctl start nftables >/dev/null 2>&1 || true
-      report "${SCRIPT_NAME}" "firewall" "load" "apply" "ok" "ruleset loaded and service started" ""
-    else
-      _fw_manual "ruleset failed to load:"
-      while IFS= read -r lline; do _fw_info "  $lline"; done <<< "$load_out"
-      fw_manual_tasks+=("FIREWALL: load manually once fixed: sudo nft -f /etc/nftables.conf")
-      note_failure "${SCRIPT_NAME}" "firewall" "load" "apply" "nft load failed"
-    fi
-  fi
-
-  # ── SUMMARY ─────────────────────────────────────────────────────────────────
-  printf '\n  ── Firewall restore summary ───────────────────────────────────────\n'
-  if [[ ${#fw_manual_tasks[@]} -gt 0 ]]; then
-    printf '\n  ── MANUAL TASKS REQUIRED ──────────────────────────────────────────\n'
-    local i=1
-    for task in "${fw_manual_tasks[@]}"; do
-      printf '  [%d] %s\n' "$i" "$task"
-      ((i+=1))
-    done
-    printf '\n'
-  else
-    printf '  ── No manual tasks required ✓\n\n'
-  fi
-
-  report "${SCRIPT_NAME}" "firewall" "category" "restore" "changed" \
-    "adaptive firewall restore completed; manual_tasks=${#fw_manual_tasks[@]}" ""
-}
-restore_nginx() {
-  local base="${PUBLIC_DIR}/nginx/etc-nginx"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "nginx" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'nginx'?" no; then
-    report "${SCRIPT_NAME}" "nginx" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  maybe_restore "nginx" "etc-nginx" "${base}" "/etc/nginx"
-
-  # Enable nginx — it will start properly after TLS certs are restored
-  if ! $DRY_RUN; then
-    systemctl enable nginx >/dev/null 2>&1 || true
-    # Only start if certs exist, otherwise nginx will fail to load
-    if [[ -d /etc/letsencrypt/live ]]; then
-      nginx -t >/dev/null 2>&1 && systemctl restart nginx >/dev/null 2>&1 || true
-    fi
-  fi
-
-  if [[ "${ROLE}" == "lab" ]]; then
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] sanitize /etc/nginx for lab role\n'
-      printf '[dry] rm -rf /etc/nginx/nginx\n'
-      printf '[dry] find /etc/nginx -maxdepth 1 -type d -name '\''sites-available.bak.*'\'' -exec rm -rf {} +\n'
-      printf '[dry] rm -f /etc/nginx/sites-enabled/*\n'
-      printf '[dry] ln -sf ../sites-available/default /etc/nginx/sites-enabled/default\n'
-    else
-      rm -rf /etc/nginx/nginx 2>/dev/null || true
-      find /etc/nginx -maxdepth 1 -type d -name 'sites-available.bak.*' -exec rm -rf {} + 2>/dev/null || true
-
-      mkdir -p /etc/nginx/sites-enabled
-      find /etc/nginx/sites-enabled -mindepth 1 -maxdepth 1 -exec rm -f {} + 2>/dev/null || true
-
-      if [[ -e /etc/nginx/sites-available/default ]]; then
-        ln -sf ../sites-available/default /etc/nginx/sites-enabled/default
-      fi
-    fi
-
-    report "${SCRIPT_NAME}" "nginx" "lab-sanitize" "restore" "changed" \
-      "lab role: dropped captured production sites-enabled and restored only default site" ""
-  fi
-}
-
-restore_mariadb() {
-  local base="${PUBLIC_DIR}/mariadb/etc-mysql"
-  [[ -d "${base}" ]] || { mark_manual "${SCRIPT_NAME}" "mariadb" "db" "missing ${base}"; return 0; }
-
-  if ! prompt_yes_no "Restore category 'mariadb'?" no; then
-    report "${SCRIPT_NAME}" "mariadb" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if prompt_yes_no "Restore mariadb/etc-mysql -> /etc/mysql?" yes; then
-    restore_path "${SCRIPT_NAME}" "mariadb" "etc-mysql" "${base}" "/etc/mysql" || true
-
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] chown -R root:root /etc/mysql\n'
-      printf '[dry] find /etc/mysql -type d -exec chmod 0755 {} +\n'
-      printf '[dry] find /etc/mysql -type f -exec chmod 0644 {} +\n'
-    else
-      if [[ -d /etc/mysql ]]; then
-        chown -R root:root /etc/mysql 2>/dev/null || true
-        find /etc/mysql -type d -exec chmod 0755 {} + 2>/dev/null || true
-        find /etc/mysql -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-    fi
-
-    report "${SCRIPT_NAME}" "mariadb" "metadata" "restore" "changed" \
-      "normalized /etc/mysql ownership=root:root dirs=0755 files=0644" ""
-  else
-    report "${SCRIPT_NAME}" "mariadb" "etc-mysql" "restore" "skipped" "operator skipped" ""
-  fi
-}
-
-restore_postfix() {
-  local pub_base="${PUBLIC_DIR}/postfix"
-
-  if ! prompt_yes_no "Restore category 'postfix'?" no; then
-    report "${SCRIPT_NAME}" "postfix" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ -f "${pub_base}/main.cf" ]]; then
-    if prompt_yes_no "Restore postfix/main.cf -> /etc/postfix/main.cf?" yes; then
-      restore_path "${SCRIPT_NAME}" "postfix" "main.cf" \
-        "${pub_base}/main.cf" "/etc/postfix/main.cf" \
-        0644 root root || true
-    fi
-  fi
-
-  if [[ -f "${pub_base}/master.cf" ]]; then
-    if prompt_yes_no "Restore postfix/master.cf -> /etc/postfix/master.cf?" yes; then
-      restore_path "${SCRIPT_NAME}" "postfix" "master.cf" \
-        "${pub_base}/master.cf" "/etc/postfix/master.cf" \
-        0644 root root || true
-    fi
-  fi
-
-  if [[ -d "${pub_base}/etc-postfix" ]]; then
-    if prompt_yes_no "Restore postfix/etc-postfix -> /etc/postfix?" yes; then
-      restore_path "${SCRIPT_NAME}" "postfix" "etc-postfix" \
-        "${pub_base}/etc-postfix" "/etc/postfix" || true
-      chown -R root:root /etc/postfix 2>/dev/null || true
-      find /etc/postfix -type f -exec chmod 0644 {} + 2>/dev/null || true
-      find /etc/postfix -type d -exec chmod 0755 {} + 2>/dev/null || true
-      report "${SCRIPT_NAME}" "postfix" "metadata" "restore" "changed" \
-        "normalized /etc/postfix ownership=root:root dirs=0755 files=0644" ""
-    fi
-  fi
-
-  if have_cmd postfix; then
-    postfix set-permissions 2>/dev/null || true
-    if postfix check 2>/dev/null; then
-      report "${SCRIPT_NAME}" "postfix" "validate" "check" "ok" "postfix check passed" ""
-      systemctl enable postfix >/dev/null 2>&1 || true
-      systemctl restart postfix >/dev/null 2>&1 || true
-    else
-      note_failure "${SCRIPT_NAME}" "postfix" "validate" "check" "postfix check failed"
-    fi
-  fi
-}
-
-restore_prosody() {
-  local pub_base="${PUBLIC_DIR}/prosody/etc-prosody"
-  local sec_base="${SECRET_DIR}/prosody/etc-prosody"
-  local base=""
-  local label=""
-
-  if ! prompt_yes_no "Restore category 'prosody'?" no; then
-    report "${SCRIPT_NAME}" "prosody" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ -d "${sec_base}" ]]; then
-    base="${sec_base}"
-    label="etc-prosody(secret)"
-  elif [[ -d "${pub_base}" ]]; then
-    base="${pub_base}"
-    label="etc-prosody(public)"
-  else
-    mark_manual "${SCRIPT_NAME}" "prosody" "db" "missing public/secret prosody config"
-    return 0
-  fi
-
-  if prompt_yes_no "Restore prosody/${label} -> /etc/prosody?" yes; then
-    restore_path "${SCRIPT_NAME}" "prosody" "${label}" "${base}" "/etc/prosody" || true
-
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] chown -R root:root /etc/prosody\n'
-      printf '[dry] find /etc/prosody -type d -exec chmod 0755 {} +\n'
-      printf '[dry] find /etc/prosody -type f -exec chmod 0644 {} +\n'
-      printf '[dry] find /etc/prosody/certs -type f -exec chmod 0640 {} + 2>/dev/null || true\n'
-    else
-      chown -R root:root /etc/prosody 2>/dev/null || true
-      find /etc/prosody -type d -exec chmod 0755 {} + 2>/dev/null || true
-      find /etc/prosody -type f -exec chmod 0644 {} + 2>/dev/null || true
-      [[ -d /etc/prosody/certs ]] && find /etc/prosody/certs -type f -exec chmod 0640 {} + 2>/dev/null || true
-    fi
-
-    report "${SCRIPT_NAME}" "prosody" "metadata" "restore" "changed" \
-      "normalized /etc/prosody ownership=root:root dirs=0755 files=0644 certs=0640" ""
-  else
-    report "${SCRIPT_NAME}" "prosody" "${label}" "restore" "skipped" "operator skipped" ""
-  fi
-}
-
-restore_tor() {
-  local pub_base="${PUBLIC_DIR}/tor"
-  local sec_base="${SECRET_DIR}/tor"
-
-  if ! prompt_yes_no "Restore category 'tor'?" no; then
-    report "${SCRIPT_NAME}" "tor" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if prompt_yes_no "Restore tor/torrc -> /etc/tor/torrc?" yes; then
-    restore_path "${SCRIPT_NAME}" "tor" "torrc" \
-      "${pub_base}/torrc" "/etc/tor/torrc" \
-      0644 root root || true
-  else
-    report "${SCRIPT_NAME}" "tor" "torrc" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if prompt_yes_no "Restore tor/torrc.d -> /etc/tor/torrc.d?" yes; then
-    restore_path "${SCRIPT_NAME}" "tor" "torrc.d" \
-      "${pub_base}/torrc.d" "/etc/tor/torrc.d" || true
-
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] chown -R root:root /etc/tor/torrc.d\n'
-      printf '[dry] find /etc/tor/torrc.d -type d -exec chmod 0755 {} +\n'
-      printf '[dry] find /etc/tor/torrc.d -type f -exec chmod 0644 {} +\n'
-    else
-      if [[ -d /etc/tor/torrc.d ]]; then
-        chown -R root:root /etc/tor/torrc.d 2>/dev/null || true
-        find /etc/tor/torrc.d -type d -exec chmod 0755 {} + 2>/dev/null || true
-        find /etc/tor/torrc.d -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-    fi
-
-    report "${SCRIPT_NAME}" "tor" "torrc.d-metadata" "restore" "changed" \
-      "normalized /etc/tor/torrc.d ownership=root:root dirs=0755 files=0644" ""
-  else
-    report "${SCRIPT_NAME}" "tor" "torrc.d" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if [[ "${ROLE}" == "replacement" && -d "${sec_base}/var-lib-tor" ]]; then
-    if prompt_yes_no "Restore tor/var-lib-tor -> /var/lib/tor?" no; then
-      restore_path "${SCRIPT_NAME}" "tor" "var-lib-tor" \
-        "${sec_base}/var-lib-tor" "/var/lib/tor" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R debian-tor:debian-tor /var/lib/tor\n'
-        printf '[dry] find /var/lib/tor -type d -exec chmod 0700 {} +\n'
-        printf '[dry] find /var/lib/tor -type f -exec chmod 0600 {} +\n'
-      else
-        if [[ -d /var/lib/tor ]]; then
-          chown -R debian-tor:debian-tor /var/lib/tor 2>/dev/null || true
-          find /var/lib/tor -type d -exec chmod 0700 {} + 2>/dev/null || true
-          find /var/lib/tor -type f -exec chmod 0600 {} + 2>/dev/null || true
-        fi
-      fi
-
-      report "${SCRIPT_NAME}" "tor" "var-lib-tor-metadata" "restore" "changed" \
-        "normalized /var/lib/tor ownership=debian-tor:debian-tor dirs=0700 files=0600" ""
-    else
-      report "${SCRIPT_NAME}" "tor" "var-lib-tor" "restore" "skipped" "operator skipped" ""
-    fi
-  else
-    report "${SCRIPT_NAME}" "tor" "identity" "restore" "skipped" "tor private data not restored in this role" ""
-  fi
-}
-
-restore_i2pd() {
-  local pub_base="${PUBLIC_DIR}/i2pd"
-  local sec_base="${SECRET_DIR}/i2pd"
-
-  if ! prompt_yes_no "Restore category 'i2pd'?" no; then
-    report "${SCRIPT_NAME}" "i2pd" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if prompt_yes_no "Restore i2pd/etc-i2pd -> /etc/i2pd?" yes; then
-    restore_path "${SCRIPT_NAME}" "i2pd" "etc-i2pd" \
-      "${pub_base}/etc-i2pd" "/etc/i2pd" || true
-
-    if [[ ${DRY_RUN} == true ]]; then
-      printf '[dry] chown -R root:root /etc/i2pd\n'
-      printf '[dry] find /etc/i2pd -type d -exec chmod 0755 {} +\n'
-      printf '[dry] find /etc/i2pd -type f -exec chmod 0644 {} +\n'
-    else
-      if [[ -d /etc/i2pd ]]; then
-        chown -R root:root /etc/i2pd 2>/dev/null || true
-        find /etc/i2pd -type d -exec chmod 0755 {} + 2>/dev/null || true
-        find /etc/i2pd -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-    fi
-
-    report "${SCRIPT_NAME}" "i2pd" "etc-i2pd-metadata" "restore" "changed" \
-      "normalized /etc/i2pd ownership=root:root dirs=0755 files=0644" ""
-  else
-    report "${SCRIPT_NAME}" "i2pd" "etc-i2pd" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if [[ "${ROLE}" == "replacement" && -d "${sec_base}/var-lib-i2pd" ]]; then
-    if prompt_yes_no "Restore i2pd/var-lib-i2pd -> /var/lib/i2pd?" no; then
-      restore_path "${SCRIPT_NAME}" "i2pd" "var-lib-i2pd" \
-        "${sec_base}/var-lib-i2pd" "/var/lib/i2pd" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R i2pd:i2pd /var/lib/i2pd\n'
-        printf '[dry] find /var/lib/i2pd -type d -exec chmod 0700 {} +\n'
-        printf '[dry] find /var/lib/i2pd -type f -exec chmod 0600 {} +\n'
-      else
-        if [[ -d /var/lib/i2pd ]]; then
-          chown -R i2pd:i2pd /var/lib/i2pd 2>/dev/null || true
-          find /var/lib/i2pd -type d -exec chmod 0700 {} + 2>/dev/null || true
-          find /var/lib/i2pd -type f -exec chmod 0600 {} + 2>/dev/null || true
-        fi
-      fi
-
-      report "${SCRIPT_NAME}" "i2pd" "var-lib-i2pd-metadata" "restore" "changed" \
-        "normalized /var/lib/i2pd ownership=i2pd:i2pd dirs=0700 files=0600" ""
-    else
-      report "${SCRIPT_NAME}" "i2pd" "var-lib-i2pd" "restore" "skipped" "operator skipped" ""
-    fi
-  else
-    report "${SCRIPT_NAME}" "i2pd" "identity" "restore" "skipped" "i2pd private data not restored in this role" ""
-  fi
-}
-
-restore_docker() {
-  local pub_base="${PUBLIC_DIR}/docker"
-  local sec_base="${SECRET_DIR}/docker"
-
-  if ! prompt_yes_no "Restore category 'docker'?" no; then
-    report "${SCRIPT_NAME}" "docker" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if prompt_yes_no "Restore docker/daemon.json -> /etc/docker/daemon.json?" yes; then
-    restore_path "${SCRIPT_NAME}" "docker" "daemon.json" \
-      "${pub_base}/daemon.json" "/etc/docker/daemon.json" \
-      0644 root root || true
-  else
-    report "${SCRIPT_NAME}" "docker" "daemon.json" "restore" "skipped" "operator skipped" ""
-  fi
-
-  if [[ -d "${sec_base}/compose-full" ]]; then
-    report "${SCRIPT_NAME}" "docker" "compose-full" "manual" "manual" \
-      "compose files available in secret DB; restore manually per stack" ""
-  fi
-
-  # Ensure primary user is in docker group
-  if ! $DRY_RUN && id "${PRIMARY_USER:-lukasz}" >/dev/null 2>&1; then
-    if ! id -nG "${PRIMARY_USER:-lukasz}" | grep -qw docker; then
-      usermod -aG docker "${PRIMARY_USER:-lukasz}" 2>/dev/null || true
-      report "${SCRIPT_NAME}" "docker" "docker-group" "fix" "changed" \
-        "${PRIMARY_USER:-lukasz} added to docker group — re-login required" ""
-    fi
-  fi
-}
-
-restore_monitoring() {
-  if ! prompt_yes_no "Restore category 'monitoring'?" no; then
-    report "${SCRIPT_NAME}" "monitoring" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ -d "${PUBLIC_DIR}/prometheus/etc-prometheus" ]]; then
-    if prompt_yes_no "Restore monitoring/prometheus -> /etc/prometheus?" yes; then
-      restore_path "${SCRIPT_NAME}" "monitoring" "prometheus" \
-        "${PUBLIC_DIR}/prometheus/etc-prometheus" "/etc/prometheus" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R root:root /etc/prometheus\n'
-        printf '[dry] find /etc/prometheus -type d -exec chmod 0755 {} +\n'
-        printf '[dry] find /etc/prometheus -type f -exec chmod 0644 {} +\n'
-      else
-        [[ -d /etc/prometheus ]] && chown -R root:root /etc/prometheus 2>/dev/null || true
-        [[ -d /etc/prometheus ]] && find /etc/prometheus -type d -exec chmod 0755 {} + 2>/dev/null || true
-        [[ -d /etc/prometheus ]] && find /etc/prometheus -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-
-      report "${SCRIPT_NAME}" "monitoring" "prometheus-metadata" "restore" "changed" \
-        "normalized /etc/prometheus ownership=root:root dirs=0755 files=0644" ""
-    else
-      report "${SCRIPT_NAME}" "monitoring" "prometheus" "restore" "skipped" "operator skipped" ""
-    fi
-  fi
-
-  if [[ -f "${PUBLIC_DIR}/prometheus/node-exporter-defaults" ]]; then
-    if prompt_yes_no "Restore monitoring/prometheus-node-exporter -> /etc/default/prometheus-node-exporter?" yes; then
-      restore_path "${SCRIPT_NAME}" "monitoring" "prometheus-node-exporter" \
-        "${PUBLIC_DIR}/prometheus/node-exporter-defaults" \
-        "/etc/default/prometheus-node-exporter" \
-        0644 root root || true
-    else
-      report "${SCRIPT_NAME}" "monitoring" "prometheus-node-exporter" "restore" "skipped" "operator skipped" ""
-    fi
-  fi
-
-  if [[ -d "${PUBLIC_DIR}/loki/etc-loki" ]]; then
-    if prompt_yes_no "Restore monitoring/loki -> /etc/loki?" yes; then
-      restore_path "${SCRIPT_NAME}" "monitoring" "loki" \
-        "${PUBLIC_DIR}/loki/etc-loki" "/etc/loki" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R root:root /etc/loki\n'
-        printf '[dry] find /etc/loki -type d -exec chmod 0755 {} +\n'
-        printf '[dry] find /etc/loki -type f -exec chmod 0644 {} +\n'
-      else
-        [[ -d /etc/loki ]] && chown -R root:root /etc/loki 2>/dev/null || true
-        [[ -d /etc/loki ]] && find /etc/loki -type d -exec chmod 0755 {} + 2>/dev/null || true
-        [[ -d /etc/loki ]] && find /etc/loki -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-
-      report "${SCRIPT_NAME}" "monitoring" "loki-metadata" "restore" "changed" \
-        "normalized /etc/loki ownership=root:root dirs=0755 files=0644" ""
-    else
-      report "${SCRIPT_NAME}" "monitoring" "loki" "restore" "skipped" "operator skipped" ""
-    fi
-  fi
-
-  if [[ -d "${PUBLIC_DIR}/grafana/etc-grafana" ]]; then
-    if prompt_yes_no "Restore monitoring/grafana -> /etc/grafana?" yes; then
-      restore_path "${SCRIPT_NAME}" "monitoring" "grafana" \
-        "${PUBLIC_DIR}/grafana/etc-grafana" "/etc/grafana" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R root:root /etc/grafana\n'
-        printf '[dry] find /etc/grafana -type d -exec chmod 0755 {} +\n'
-        printf '[dry] find /etc/grafana -type f -exec chmod 0644 {} +\n'
-      else
-        [[ -d /etc/grafana ]] && chown -R root:root /etc/grafana 2>/dev/null || true
-        [[ -d /etc/grafana ]] && find /etc/grafana -type d -exec chmod 0755 {} + 2>/dev/null || true
-        [[ -d /etc/grafana ]] && find /etc/grafana -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-
-      report "${SCRIPT_NAME}" "monitoring" "grafana-metadata" "restore" "changed" \
-        "normalized /etc/grafana ownership=root:root dirs=0755 files=0644" ""
-    else
-      report "${SCRIPT_NAME}" "monitoring" "grafana" "restore" "skipped" "operator skipped" ""
-    fi
-  fi
-
-  if [[ -d "${SECRET_DIR}/alloy/etc-alloy" ]]; then
-    if prompt_yes_no "Restore monitoring/alloy -> /etc/alloy?" yes; then
-      restore_path "${SCRIPT_NAME}" "monitoring" "alloy" \
-        "${SECRET_DIR}/alloy/etc-alloy" "/etc/alloy" || true
-
-      if [[ ${DRY_RUN} == true ]]; then
-        printf '[dry] chown -R root:root /etc/alloy\n'
-        printf '[dry] find /etc/alloy -type d -exec chmod 0755 {} +\n'
-        printf '[dry] find /etc/alloy -type f -exec chmod 0644 {} +\n'
-      else
-        [[ -d /etc/alloy ]] && chown -R root:root /etc/alloy 2>/dev/null || true
-        [[ -d /etc/alloy ]] && find /etc/alloy -type d -exec chmod 0755 {} + 2>/dev/null || true
-        [[ -d /etc/alloy ]] && find /etc/alloy -type f -exec chmod 0644 {} + 2>/dev/null || true
-      fi
-
-      report "${SCRIPT_NAME}" "monitoring" "alloy-metadata" "restore" "changed" \
-        "normalized /etc/alloy ownership=root:root dirs=0755 files=0644" ""
-    else
-      report "${SCRIPT_NAME}" "monitoring" "alloy" "restore" "skipped" "operator skipped" ""
-    fi
-  fi
-}
-
-
-restore_tls() {
-  local sec_tls="${SECRET_DIR}/tls"
-
-  if ! prompt_yes_no "Restore category 'tls' (TLS certificates from secret DB)?" no; then
-    report "${SCRIPT_NAME}" "tls" "category" "restore" "skipped" "operator skipped category" ""
-    return 0
-  fi
-
-  if [[ ! -d "${sec_tls}/letsencrypt" ]]; then
-    mark_manual "${SCRIPT_NAME}" "tls" "db" "no letsencrypt certs found in secret DB at ${sec_tls}/letsencrypt"
-    return 0
-  fi
-
-  if prompt_yes_no "Restore TLS certs from secret DB -> /etc/letsencrypt?" yes; then
-    if $DRY_RUN; then
-      printf '[dry] restore %s → /etc/letsencrypt\n' "${sec_tls}/letsencrypt"
-    else
-      restore_path "${SCRIPT_NAME}" "tls" "letsencrypt"         "${sec_tls}/letsencrypt" "/etc/letsencrypt" || true
-      chown -R root:root /etc/letsencrypt 2>/dev/null || true
-      # Private keys: root:root 0600
-      find /etc/letsencrypt -name 'privkey*.pem' -exec chmod 0600 {} + 2>/dev/null || true
-      find /etc/letsencrypt -name 'privkey*.pem' -exec chown root:root {} + 2>/dev/null || true
-      # Certs: readable
-      find /etc/letsencrypt -name '*.pem' ! -name 'privkey*' -exec chmod 0644 {} + 2>/dev/null || true
-      find /etc/letsencrypt -type d -exec chmod 0755 {} + 2>/dev/null || true
-      report "${SCRIPT_NAME}" "tls" "letsencrypt" "restore" "changed"         "TLS certs restored; privkeys=0600 certs=0644" ""
-    fi
-
-    # Check cert expiry
-    if ! $DRY_RUN && have_cmd certbot; then
-      local expiry_out
-      expiry_out="$(certbot certificates 2>/dev/null | grep -E 'Domains|Expiry|Certificate Name' || true)"
-      if [[ -n "$expiry_out" ]]; then
-        printf '
-  ── TLS cert expiry ──────────────────────────────────────────────
-'
-        while IFS= read -r line; do printf '  %s
-' "$line"; done <<< "$expiry_out"
-        printf '
-'
-      fi
-      report "${SCRIPT_NAME}" "tls" "expiry-check" "check" "ok" "certbot certificates checked" ""
-    fi
-
-    # Start/reload nginx now that certs exist
-    if ! $DRY_RUN && have_cmd nginx && nginx -t >/dev/null 2>&1; then
-      systemctl enable nginx >/dev/null 2>&1 || true
-      systemctl reload nginx 2>/dev/null || systemctl start nginx 2>/dev/null || true
-      report "${SCRIPT_NAME}" "tls" "nginx-reload" "apply" "ok" "nginx started/reloaded with certs" ""
-    fi
-  fi
-
-  report "${SCRIPT_NAME}" "tls" "category" "restore" "changed" "TLS restore completed" ""
-}
-
-for category in "${CATEGORIES[@]}"; do
-  log "processing category: ${category}"
-  case "${category}" in
-    system-basics) restore_system_basics ;;
-    users)         restore_users ;;
-    ssh)           restore_ssh ;;
-    network)       restore_network ;;
-    dns)           restore_dns ;;
-    firewall)      restore_firewall ;;
-    nginx)         restore_nginx ;;
-    mariadb)       restore_mariadb ;;
-    postfix)       restore_postfix ;;
-    prosody)       restore_prosody ;;
-    tor)           restore_tor ;;
-    i2pd)          restore_i2pd ;;
-    docker)        restore_docker ;;
-    monitoring)    restore_monitoring ;;
-    tls)           restore_tls ;;
-    *) note_failure "${SCRIPT_NAME}" "category" "${category}" "restore" "unknown category" ;;
-  esac
-done
-
-set_state restore_configs done
-report "${SCRIPT_NAME}" "run" "finish" "exit" "ok" "completed" ""
-log "${SCRIPT_NAME}: done; report=${REPORT_FILE}"