#!/usr/bin/env bash
# =============================================================================
# capture-full.sh — sanctum full-state capture with encrypted secret database
# =============================================================================
# Captures the complete state of sanctum into two tiers:
#
#   db/public/    — safe, unencrypted inventory (same as capture-state.sh)
#   db/secret/    — ALL secrets, root-only (chmod 700), never committed to git
#
# Together these two tiers contain everything needed to fully reproduce
# this machine on a fresh Debian 13 minimal install via bootstrap.sh.
#
# USAGE
#   sudo ./capture-full.sh [--dry-run] [--help]
#
# OPTIONS
#   --dry-run    Show what would be captured without writing anything
#   --help       Show this message
#
# REQUIREMENTS
#   - Must be run as root (sudo)
#   - GPG must be installed: apt install gnupg
#   - GPG_RECIPIENT must be set (key fingerprint or email), OR
#     set it in /etc/labunix/capture.conf or ~/.config/labunix/capture.conf
#   - jq must be installed: apt install jq
#   - Output goes to CAPTURE_DIR (default: <toolkit-dir>/db/)
#
# OUTPUT STRUCTURE
#   <toolkit-dir>/db/
#   ├── capture-full.sh         this script (self-referential copy)
#   ├── bootstrap.sh            reproduction script (generated separately)
#   ├── db/
#   │   ├── public/             unencrypted inventory — git-safe
#   │   │   ├── system/
#   │   │   ├── packages/
#   │   │   ├── services/
#   │   │   ├── docker/
#   │   │   ├── network/
#   │   │   ├── firewall/
#   │   │   └── ...
#   │   ├── secret/             GPG-encrypted — NEVER commit to git
#   │   │   ├── secrets.tar.gpg all secret material in one encrypted archive
#   │   │   └── secrets.index   unencrypted index of what is inside (no values)
#   │   └── README.md
#   └── README.md
#
# SECURITY MODEL
#   - db/public/  : safe to push to private git repo
#   - db/secret/  : local only, root-only permissions (chmod 700)
#                     protected by ZFS-on-LUKS disk encryption
#   - The .gitignore in the toolkit dir excludes db/secret/ entirely
#   - bootstrap.sh reads db/public/ for structure and db/secret/ for values
# =============================================================================

set -euo pipefail

# --------------------------------------------------------------------------- #
#  CONFIGURATION
# --------------------------------------------------------------------------- #
SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"
CAPTURE_DIR="${CAPTURE_DIR:-${SCRIPT_DIR}}"
PUBLIC_DIR="${CAPTURE_DIR}/db/public"
SECRET_DIR="${CAPTURE_DIR}/db/secret"
TIMESTAMP="$(date +"%Y-%m-%dT%H:%M:%S")"
HOSTNAME_SHORT="$(hostname -s)"
DRY_RUN=false
WARNINGS=()

# Load config file if present
for conf in /etc/labunix/capture.conf "${HOME}/.config/labunix/capture.conf"; do
  [[ -f "$conf" ]] && source "$conf" || true
done

# --------------------------------------------------------------------------- #
#  ARGUMENT PARSING
# --------------------------------------------------------------------------- #
for arg in "$@"; do
  case "$arg" in
    --dry-run) DRY_RUN=true ;;
    --help)
      grep '^#' "$0" | head -40 | sed 's/^# \?//'
      exit 0
      ;;
    *) echo "Unknown option: $arg" >&2; exit 1 ;;
  esac
done

# --------------------------------------------------------------------------- #
#  HELPERS
# --------------------------------------------------------------------------- #
log()     { echo "  [$(date +%H:%M:%S)] $*"; }
warn()    { echo "  [$(date +%H:%M:%S)] WARN: $*" >&2; WARNINGS+=("$*"); }
section() { echo ""; echo "── $* ──"; }
die()     { echo "ERROR: $*" >&2; exit 1; }

# pub <outfile> <cmd...>
# Capture command output into public (unencrypted) tier.
pub() {
  local out="${PUBLIC_DIR}/$1"; shift
  if $DRY_RUN; then echo "  [pub] $* → ${out#$PUBLIC_DIR/}"; return; fi
  mkdir -p "$(dirname "$out")"
  if ! "$@" > "$out" 2>&1; then
    warn "command failed: $*"
    echo "# ERROR: '$*' failed at ${TIMESTAMP}" > "$out"
  fi
}

# pub_copy <src> <dst_relative>
# Copy file/dir into public tier.
pub_copy() {
  local src="$1" dst="${PUBLIC_DIR}/$2"
  if $DRY_RUN; then echo "  [pub] copy ${src} → $2"; return; fi
  [[ -e "$src" ]] || return 0
  mkdir -p "$(dirname "$dst")"
  cp -a "$src" "$dst" 2>/dev/null || warn "could not copy ${src}"
}

# sec <dst_relative> <src_path>
# Copy secret material directly into the secret directory.
sec() {
  local dst="${SECRET_DIR}/$1" src="$2"
  if $DRY_RUN; then echo "  [sec] ${src} → secret/$1"; return; fi
  [[ -e "$src" ]] || return 0
  mkdir -p "$(dirname "$dst")"
  cp -a "$src" "$dst" 2>/dev/null || warn "could not stage secret: ${src}"
}

# sec_val <dst_relative> <value>
# Write a literal secret value as a file.
sec_val() {
  local dst="${SECRET_DIR}/$1"
  if $DRY_RUN; then echo "  [sec] value → secret/$1"; return; fi
  mkdir -p "$(dirname "$dst")"
  printf '%s\n' "$2" > "$dst"
}

# sec_cmd <dst_relative> <cmd...>
# Capture command output as a secret.
sec_cmd() {
  local dst="${SECRET_DIR}/$1"; shift
  if $DRY_RUN; then echo "  [sec] command → secret/$1"; return; fi
  mkdir -p "$(dirname "$dst")"
  if ! "$@" > "$dst" 2>&1; then
    warn "secret command failed: $*"
    echo "# ERROR: '$*' failed" > "$dst"
  fi
}

# index_secret <path> <description>
# Add an entry to the secrets index (unencrypted — shows what exists, not values).
SECRET_INDEX_ENTRIES=()
index_secret() {
  SECRET_INDEX_ENTRIES+=("$(printf '%-50s  %s' "$1" "$2")")
}

# --------------------------------------------------------------------------- #
#  PRE-FLIGHT CHECKS
# --------------------------------------------------------------------------- #
[[ $EUID -eq 0 ]] || die "run with sudo"

if ! $DRY_RUN; then
  command -v jq  &>/dev/null || die "jq not found — apt install jq"
  command -v tar &>/dev/null || die "tar not found"

  mkdir -p "${PUBLIC_DIR}" "${SECRET_DIR}"
  chmod 700 "${SECRET_DIR}"
fi

echo ""
echo "╔══════════════════════════════════════════════════════╗"
echo "║  labunix · capture-full — full state + secret DB    ║"
echo "╚══════════════════════════════════════════════════════╝"
echo ""
log "host      : ${HOSTNAME_SHORT}"
log "timestamp : ${TIMESTAMP}"
log "public    : ${PUBLIC_DIR}"
log "secret    : ${SECRET_DIR}/ (root-only, chmod 700)"
$DRY_RUN && log "(DRY RUN — nothing will be written)"

# =========================================================================== #
#  PUBLIC TIER — safe inventory, no secret values
# =========================================================================== #

# --------------------------------------------------------------------------- #
#  P1. SYSTEM IDENTITY
# --------------------------------------------------------------------------- #
section "P1 system"

pub "system/hostname.txt"    hostname -f
pub "system/os-release.txt"  cat /etc/os-release
pub "system/kernel.txt"      uname -a
pub "system/lscpu.txt"       lscpu
pub "system/memory.txt"      free -h
pub "system/lsblk.txt"       lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,UUID,LABEL
pub "system/df.txt"          df -hT --exclude-type=tmpfs --exclude-type=devtmpfs
pub "system/locale.txt"      locale
pub "system/timedatectl.txt" timedatectl
pub "system/uptime.txt"      uptime
pub "system/dmesg-err.txt"   dmesg --level=err,crit,alert,emerg

pub_copy /etc/hostname    "system/etc-hostname"
pub_copy /etc/hosts       "system/etc-hosts"
pub_copy /etc/fstab       "system/etc-fstab"
pub_copy /etc/crypttab    "system/etc-crypttab"
pub_copy /etc/environment "system/etc-environment"
pub_copy /etc/locale.gen  "system/locale.gen"
pub_copy /etc/timezone    "system/timezone"

log "done"

# --------------------------------------------------------------------------- #
#  P2. ZFS
# --------------------------------------------------------------------------- #
section "P2 zfs"

if command -v zpool &>/dev/null; then
  pub "zfs/zpool-status.txt"   zpool status -v
  pub "zfs/zpool-list.txt"     zpool list -v
  pub "zfs/zpool-history.txt"  zpool history
  pub "zfs/zfs-list.txt"       zfs list -t all -o name,used,avail,refer,mountpoint,type
  pub "zfs/zfs-properties.txt" zfs get all
  pub "zfs/zfs-snapshots.txt"  zfs list -t snapshot -o name,used,creation -s creation
  pub_copy /etc/zfs            "zfs/etc-zfs"
  log "done"
else
  warn "zpool not found — skipping ZFS"
fi

# --------------------------------------------------------------------------- #
#  P3. NETWORK
# --------------------------------------------------------------------------- #
section "P3 network"

pub "network/ip-addr.txt"      ip -s addr show
pub "network/ip-route.txt"     ip route show table all
pub "network/ip-rule.txt"      ip rule show
pub "network/ss-listening.txt" ss -tlnpue

pub_copy /etc/network         "network/etc-network"
pub_copy /etc/netplan         "network/etc-netplan"
pub_copy /etc/systemd/network "network/systemd-network"
pub_copy /etc/nsswitch.conf   "network/nsswitch.conf"
pub_copy /etc/hosts.allow     "network/hosts.allow"
pub_copy /etc/hosts.deny      "network/hosts.deny"

log "done"

# --------------------------------------------------------------------------- #
#  P4. FIREWALL
# --------------------------------------------------------------------------- #
section "P4 firewall"

pub "firewall/nft-ruleset.txt"  nft list ruleset
pub "firewall/nft-ruleset.json" nft -j list ruleset

pub_copy /etc/nftables.conf "firewall/nftables.conf"
pub_copy /etc/nftables.d    "firewall/nftables.d"

log "done"

# --------------------------------------------------------------------------- #
#  P5. WIREGUARD — public info only
# --------------------------------------------------------------------------- #
section "P5 wireguard"

if command -v wg &>/dev/null; then
  pub "wireguard/wg-show.txt"       wg show
  pub "wireguard/wg-interfaces.txt" ip link show type wireguard

  # Redacted public copy (PrivateKey + PresharedKey scrubbed)
  if ! $DRY_RUN && [[ -d /etc/wireguard ]]; then
    mkdir -p "${PUBLIC_DIR}/wireguard/etc-wireguard"
    for f in /etc/wireguard/*.conf; do
      [[ -f "$f" ]] || continue
      base="$(basename "$f")"
      sed \
        -e 's/^\(PrivateKey\s*=\s*\).*/\1<REDACTED>/' \
        -e 's/^\(PresharedKey\s*=\s*\).*/\1<REDACTED>/' \
        "$f" > "${PUBLIC_DIR}/wireguard/etc-wireguard/${base}" 2>/dev/null \
        || warn "could not sanitize ${f}"
    done
    log "public: PrivateKey + PresharedKey redacted"
  fi
  log "done"
else
  warn "wg not found — skipping WireGuard"
fi

# --------------------------------------------------------------------------- #
#  P6. DNS
# --------------------------------------------------------------------------- #
section "P6 dns"

if [[ -f /etc/dnsmasq.conf ]] || command -v dnsmasq &>/dev/null; then
  command -v dnsmasq &>/dev/null && pub "dns/dnsmasq-version.txt" dnsmasq --version
  pub_copy /etc/dnsmasq.conf "dns/dnsmasq.conf"
  pub_copy /etc/dnsmasq.d    "dns/dnsmasq.d"
fi

if [[ -d /etc/unbound ]]; then
  command -v unbound &>/dev/null && pub "dns/unbound-version.txt" unbound -V
  pub_copy /etc/unbound "dns/etc-unbound"
fi

pub_copy /etc/resolv.conf "dns/resolv.conf"

log "done"

# --------------------------------------------------------------------------- #
#  P7. TLS — cert metadata only (no key material)
# --------------------------------------------------------------------------- #
section "P7 tls"

if command -v certbot &>/dev/null; then
  pub "tls/certbot-version.txt"      certbot --version
  pub "tls/certbot-certificates.txt" certbot certificates
fi

pub_copy /etc/letsencrypt/renewal "tls/renewal-configs"
pub_copy /etc/letsencrypt/cli.ini "tls/cli.ini"

# Cert expiry summary
if ! $DRY_RUN && [[ -d /etc/letsencrypt/live ]]; then
  {
    printf "# TLS certificate expiry — %s\n" "${TIMESTAMP}"
    printf "# %-40s  %-28s  %-28s  %s\n" "domain" "not_before" "not_after" "days_left"
    echo ""
    for cert in /etc/letsencrypt/live/*/fullchain.pem; do
      [[ -f "$cert" ]] || continue
      domain="$(basename "$(dirname "$cert")")"
      not_before="$(openssl x509 -noout -startdate -in "$cert" 2>/dev/null | cut -d= -f2)"
      not_after="$(openssl x509  -noout -enddate   -in "$cert" 2>/dev/null | cut -d= -f2)"
      expiry_epoch="$(date -d "$not_after" +%s 2>/dev/null || echo 0)"
      days_left=$(( (expiry_epoch - $(date +%s)) / 86400 ))
      printf "%-42s  %-28s  %-28s  %d\n" \
        "$domain" "$not_before" "$not_after" "$days_left"
    done
  } > "${PUBLIC_DIR}/tls/cert-expiry.txt"
fi

log "done"

# --------------------------------------------------------------------------- #
#  P8. NGINX — config (may reference secrets but config itself is public)
# --------------------------------------------------------------------------- #
section "P8 nginx"

if command -v nginx &>/dev/null; then
  pub "nginx/nginx-version.txt" nginx -v
  pub "nginx/nginx-T.txt"       nginx -T
  pub "nginx/nginx-t.txt"       nginx -t
  pub_copy /etc/nginx           "nginx/etc-nginx"

  if ! $DRY_RUN; then
    # Remove auth files from the public copy
    find "${PUBLIC_DIR}/nginx/etc-nginx" \
      \( -name "*.htpasswd" -o -name "htpasswd-*" -o -name ".htpasswd" -o -name "lufi.htpasswd" \) \
      -delete 2>/dev/null || true

    # Remove local backup trees from the public copy
    find "${PUBLIC_DIR}/nginx/etc-nginx" \
      -maxdepth 1 -type d -name 'sites-available.bak.*' \
      -exec rm -rf {} + 2>/dev/null || true

    log "htpasswd files removed from public nginx copy"
    log "nginx backup dirs removed from public copy"
  fi

  log "done"
else
  warn "nginx not found"
fi

# --------------------------------------------------------------------------- #
#  P9. DOCKER — sanitized inventory
# --------------------------------------------------------------------------- #
section "P9 docker"

if command -v docker &>/dev/null; then
  pub "docker/docker-version.txt"    docker version
  pub "docker/docker-info.txt"       docker info
  pub "docker/docker-ps.txt"         docker ps -a \
    --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"
  pub "docker/docker-images.txt"     docker images \
    --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}\t{{.CreatedAt}}"
  pub "docker/docker-volumes.txt"    docker volume ls
  pub "docker/docker-networks.txt"   docker network ls \
    --format "table {{.Name}}\t{{.Driver}}\t{{.Scope}}\t{{.ID}}"
  pub "docker/docker-compose-ls.txt" docker compose ls 2>/dev/null || true
  pub_copy /etc/docker/daemon.json   "docker/daemon.json"

  # Inspect with Env[] stripped
  if ! $DRY_RUN && command -v jq &>/dev/null; then
    mkdir -p "${PUBLIC_DIR}/docker/inspect"
    docker ps -aq 2>/dev/null | while read -r cid; do
      name="$(docker inspect --format '{{.Name}}' "$cid" \
              | tr '/' '_' | sed 's/^_//')"
      docker inspect "$cid" 2>/dev/null \
        | jq '.[0] | del(.Config.Env, .HostConfig.Env)' \
        > "${PUBLIC_DIR}/docker/inspect/${name}.json" 2>/dev/null || true
    done
    log "inspect captured (Env[] stripped)"
  fi

  # Compose files — redact secret-looking values
  if ! $DRY_RUN; then
    mkdir -p "${PUBLIC_DIR}/docker/compose-redacted"
    find /srv /opt /home /root -maxdepth 3 \
      \( -name "docker-compose.yml" -o -name "docker-compose.yaml" \
         -o -name "compose.yml"     -o -name "compose.yaml" \) \
      -not -path "*/sanctum-rebuild/*" \
      -not -path "*/labunix-infra/*" \
      -not -path "*/\.*" \
      2>/dev/null \
      | while read -r f; do
          rel="$(echo "$f" | sed 's|^/||; s|/|__|g')"
          sed -E \
            -e 's/(PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|AUTH_KEY|PRIVATE_KEY|DB_PASS|MYSQL_PASS|POSTGRES_PASS|REDIS_PASS|SMTP_PASS)[[:space:]]*=[[:space:]]*[^[:space:]#].*/\1=<REDACTED>/gI' \
            -e 's/(PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|AUTH_KEY|PRIVATE_KEY|DB_PASS|MYSQL_PASS|POSTGRES_PASS|REDIS_PASS|SMTP_PASS):[[:space:]]*"[^"]*"/\1: "<REDACTED>"/gI' \
            "$f" > "${PUBLIC_DIR}/docker/compose-redacted/${rel}" 2>/dev/null || true
        done
    log "compose files collected (secrets redacted)"
  fi

  log "done"
else
  warn "docker not found"
fi

# --------------------------------------------------------------------------- #
#  P10. PACKAGES
# --------------------------------------------------------------------------- #
section "P10 packages"

pub "packages/dpkg-list.txt"       dpkg -l
pub "packages/dpkg-selections.txt" dpkg --get-selections
pub "packages/apt-mark-manual.txt" apt-mark showmanual
pub "packages/apt-mark-auto.txt"   apt-mark showauto

pub_copy /etc/apt/sources.list   "packages/apt/sources.list"
pub_copy /etc/apt/sources.list.d "packages/apt/sources.list.d"
pub_copy /etc/apt/preferences    "packages/apt/preferences"
pub_copy /etc/apt/preferences.d  "packages/apt/preferences.d"
pub_copy /etc/apt/apt.conf.d     "packages/apt/apt.conf.d"

command -v pip3    &>/dev/null && pub "packages/pip3-list.txt"    pip3 list --format=columns
command -v npm     &>/dev/null && pub "packages/npm-global.txt"   npm list -g --depth=0
command -v cargo   &>/dev/null && pub "packages/cargo-list.txt"   cargo install --list
command -v gem     &>/dev/null && pub "packages/gem-list.txt"     gem list

log "done"

# --------------------------------------------------------------------------- #
#  P11. SYSTEMD SERVICES
# --------------------------------------------------------------------------- #
section "P11 services"

pub "services/units-enabled.txt"  systemctl list-unit-files --state=enabled  --no-pager
pub "services/units-running.txt"  systemctl list-units --type=service --state=running --no-pager
pub "services/units-failed.txt"   systemctl list-units --state=failed --no-pager
pub "services/timers.txt"         systemctl list-timers --all --no-pager
pub "services/unit-files-all.txt" systemctl list-unit-files --no-pager

if ! $DRY_RUN; then
  mkdir -p "${PUBLIC_DIR}/services/custom-units"
  for f in /etc/systemd/system/*.service \
            /etc/systemd/system/*.timer   \
            /etc/systemd/system/*.socket  \
            /etc/systemd/system/*.mount   \
            /etc/systemd/system/*.target  \
            /etc/systemd/system/*.path; do
    [[ -f "$f" ]] || continue
    cp "$f" "${PUBLIC_DIR}/services/custom-units/" 2>/dev/null || true
  done
  for d in /etc/systemd/system/*.d; do
    [[ -d "$d" ]] || continue
    cp -a "$d" "${PUBLIC_DIR}/services/custom-units/" 2>/dev/null || true
  done
  log "custom units + drop-ins copied"
fi

pub_copy /etc/systemd/journald.conf  "services/journald.conf"
pub_copy /etc/systemd/logind.conf    "services/logind.conf"
pub_copy /etc/systemd/system.conf    "services/system.conf"
pub_copy /etc/systemd/timesyncd.conf "services/timesyncd.conf"

log "done"

# --------------------------------------------------------------------------- #
#  P12. CRON
# --------------------------------------------------------------------------- #
section "P12 cron"

pub_copy /etc/crontab           "cron/crontab"
pub_copy /etc/cron.d            "cron/cron.d"
pub_copy /etc/cron.daily        "cron/cron.daily"
pub_copy /etc/cron.weekly       "cron/cron.weekly"
pub_copy /etc/cron.monthly      "cron/cron.monthly"

log "done"

# --------------------------------------------------------------------------- #
#  P13. USERS — sanitized (no hashes)
# --------------------------------------------------------------------------- #
section "P13 users"

if ! $DRY_RUN; then
  mkdir -p "${PUBLIC_DIR}/users"
  awk -F: '{print $1":"$3":"$4":"$5":"$6":"$7}' /etc/passwd \
    > "${PUBLIC_DIR}/users/passwd-sanitized.txt" 2>/dev/null || true
  awk -F: '{print $1":"$3}' /etc/group \
    > "${PUBLIC_DIR}/users/groups-sanitized.txt" 2>/dev/null || true
  grep -E '(/bin/bash|/bin/zsh|/bin/sh|/usr/bin/zsh)$' /etc/passwd \
    | awk -F: '{print $1" home="$6" shell="$7}' \
    > "${PUBLIC_DIR}/users/login-users.txt" 2>/dev/null || true
fi

pub_copy /etc/ssh/sshd_config   "users/sshd_config"
pub_copy /etc/ssh/sshd_config.d "users/sshd_config.d"
pub_copy /etc/sudoers           "users/sudoers"
pub_copy /etc/sudoers.d         "users/sudoers.d"
pub_copy /etc/shells            "users/shells"
pub_copy /etc/login.defs        "users/login.defs"

log "done"

# --------------------------------------------------------------------------- #
#  P14–P35: remaining public captures (configs without embedded secrets)
# --------------------------------------------------------------------------- #
section "P14-P35 service configs"

# Kernel
pub "kernel/sysctl-all.txt" sysctl -a
pub "kernel/lsmod.txt"      lsmod
pub_copy /etc/sysctl.conf    "kernel/sysctl.conf"
pub_copy /etc/sysctl.d       "kernel/sysctl.d"
pub_copy /etc/modules        "kernel/modules"
pub_copy /etc/modules-load.d "kernel/modules-load.d"
pub_copy /etc/modprobe.d     "kernel/modprobe.d"

# i2pd (no key material)
if [[ -f /etc/i2pd/i2pd.conf ]]; then
  pub_copy /etc/i2pd "i2pd/etc-i2pd"
fi

# Tor (no private keys)
if [[ -f /etc/tor/torrc ]]; then
  pub_copy /etc/tor/torrc   "tor/torrc"
  pub_copy /etc/tor/torrc.d "tor/torrc.d"
  if ! $DRY_RUN && [[ -d /var/lib/tor ]]; then
    mkdir -p "${PUBLIC_DIR}/tor/hidden-services"
    find /var/lib/tor -name "hostname" 2>/dev/null \
      | while read -r hf; do
          svc="$(basename "$(dirname "$hf")")"
          cp "$hf" "${PUBLIC_DIR}/tor/hidden-services/${svc}.hostname" 2>/dev/null || true
        done
  fi
fi

# Hugo
command -v hugo &>/dev/null && pub "hugo/hugo-version.txt" hugo version
for site_dir in /srv/www/labunix /srv/www/labunix.xyz; do
  [[ -d "$site_dir" ]] || continue
  pub_copy "${site_dir}/hugo.toml"  "hugo/hugo.toml"
  pub_copy "${site_dir}/config"     "hugo/config-dir"
  pub_copy "${site_dir}/go.mod"     "hugo/go.mod"
  break
done

# Agate
if [[ -f /home/lukasz/apps/agate/agate ]]; then
  pub "agate/agate-version.txt" /home/lukasz/apps/agate/agate --version
  if ! $DRY_RUN && [[ -d /srv/gemini-capsule ]]; then
    find /srv/gemini-capsule -not -path "*/.certificates*" \
      | sort > "${PUBLIC_DIR}/agate/capsule-structure.txt" 2>/dev/null || true
  fi
fi

# Pygopherd
pub_copy /etc/pygopherd "pygopherd/etc-pygopherd"

# Agate service unit
pub_copy /etc/systemd/system/agate.service "agate/agate.service"

# Postfix (main.cf is public, sasl_passwd goes to secret)
if [[ -d /etc/postfix ]]; then
  pub_copy /etc/postfix/main.cf   "postfix/main.cf"
  pub_copy /etc/postfix/master.cf "postfix/master.cf"
  pub "postfix/postconf.txt" postconf 2>/dev/null || true
fi

# MariaDB (config only, no credentials)
pub_copy /etc/mysql "mariadb/etc-mysql"
if ! $DRY_RUN; then
  mariadb --defaults-file=/etc/mysql/debian.cnf \
    -e "SHOW DATABASES;" 2>/dev/null \
    > "${PUBLIC_DIR}/mariadb/databases.txt" || true
fi

# Alloy
pub_copy /etc/alloy         "alloy/etc-alloy"
pub_copy /etc/default/alloy "alloy/etc-default-alloy"

# Prometheus
pub_copy /etc/prometheus "prometheus/etc-prometheus"
pub_copy /etc/default/prometheus-node-exporter "prometheus/node-exporter-defaults"

# Fail2ban
pub_copy /etc/fail2ban "fail2ban/etc-fail2ban"

# Prosody
pub_copy /etc/prosody "prosody/etc-prosody"

# Grafana (provisioning configs, no secrets)
pub_copy /etc/grafana "grafana/etc-grafana"

# Loki + Promtail
pub_copy /etc/loki    "loki/etc-loki"
pub_copy /etc/promtail "loki/etc-promtail"

# Mumble
pub_copy /etc/mumble "mumble/etc-mumble"

# AppArmor
command -v aa-status &>/dev/null \
  && pub "apparmor/aa-status.txt" aa-status 2>/dev/null || true
pub_copy /etc/apparmor.d "apparmor/apparmor.d"

# Boot / initramfs — critical for LUKS+ZFS rebuild
pub_copy /etc/default/grub         "boot/grub-default"
pub_copy /etc/grub.d               "boot/grub.d"
pub_copy /etc/kernel               "boot/etc-kernel"
pub_copy /etc/cryptsetup-initramfs "boot/cryptsetup-initramfs"
pub_copy /etc/initramfs-tools      "boot/initramfs-tools"
pub_copy /etc/default              "boot/etc-default"

# Lufi
pub_copy /srv/lufi/cpanfile "lufi/cpanfile"
if ! $DRY_RUN && [[ -d /srv/lufi ]]; then
  git -C /srv/lufi log --oneline -5 2>/dev/null \
    > "${PUBLIC_DIR}/lufi/git-log.txt" || true
fi

# Environment
pub_copy /etc/profile   "environment/profile"
pub_copy /etc/profile.d "environment/profile.d"
pub_copy /etc/zsh       "environment/zsh"

# Logging
pub_copy /etc/logrotate.conf "logging/logrotate.conf"
pub_copy /etc/logrotate.d    "logging/logrotate.d"
pub_copy /etc/rsyslog.conf   "logging/rsyslog.conf"
pub_copy /etc/rsyslog.d      "logging/rsyslog.d"

# Hardware
command -v lshw  &>/dev/null && pub "hardware/lshw.txt"  lshw -short
command -v lspci &>/dev/null && pub "hardware/lspci.txt" lspci -v
command -v lsusb &>/dev/null && pub "hardware/lsusb.txt" lsusb
pub "hardware/cpuinfo.txt"   cat /proc/cpuinfo
pub "hardware/meminfo.txt"   cat /proc/meminfo

log "done"

# =========================================================================== #
#  SECRET TIER — full secrets, will be GPG-encrypted
# =========================================================================== #

section "SECRET TIER"
log "Staging secret material..."

# ── WireGuard — real private keys ───────────────────────────────────────────
if [[ -d /etc/wireguard ]]; then
  sec "wireguard/etc-wireguard" /etc/wireguard
  index_secret "wireguard/etc-wireguard" "WireGuard interface configs with PrivateKey + PresharedKey"
fi

# ── TLS private keys ─────────────────────────────────────────────────────────
if [[ -d /etc/letsencrypt ]]; then
  sec "tls/letsencrypt" /etc/letsencrypt
  index_secret "tls/letsencrypt" "Full Let's Encrypt dir including private keys"
fi

# ── SSH host keys ────────────────────────────────────────────────────────────
if [[ -d /etc/ssh ]]; then
  sec "ssh/etc-ssh" /etc/ssh
  index_secret "ssh/etc-ssh" "SSH host keys (id_* private key files)"
fi

# ── User SSH keys + authorized_keys ─────────────────────────────────────────
if ! $DRY_RUN; then
  while IFS=: read -r user _ _ _ _ homedir _; do
    [[ -d "${homedir}/.ssh" ]] || continue
    sec "ssh/user-${user}" "${homedir}/.ssh"
    index_secret "ssh/user-${user}" "SSH keys and authorized_keys for ${user}"
  done < /etc/passwd
fi

# ── Docker compose files — full unredacted ──────────────────────────────────
if ! $DRY_RUN; then
  mkdir -p "${SECRET_DIR}/docker/compose-full"
  find /srv /opt /home /root -maxdepth 3 \
    \( -name "docker-compose.yml" -o -name "docker-compose.yaml" \
       -o -name "compose.yml"     -o -name "compose.yaml" \
       -o -name ".env"            -o -name "*.env" \) \
    -not -path "*/sanctum-rebuild/*" \
    -not -path "*/labunix-infra/*" \
    -not -path "*/\.*env.example" \
    2>/dev/null \
    | while read -r f; do
        rel="$(echo "$f" | sed 's|^/||; s|/|__|g')"
        cp "$f" "${SECRET_DIR}/docker/compose-full/${rel}" 2>/dev/null || true
      done
  index_secret "docker/compose-full" "All compose files + .env files with real secrets"
fi

# ── MariaDB credentials + dumps ──────────────────────────────────────────────
if [[ -f /etc/mysql/debian.cnf ]]; then
  sec "mariadb/debian.cnf" /etc/mysql/debian.cnf
  index_secret "mariadb/debian.cnf" "MariaDB debian-sys-maint credentials"
fi

# Dump all database schemas (structure only, no data) — for rebuild reference
if ! $DRY_RUN && command -v mysqldump &>/dev/null; then
  mkdir -p "${SECRET_DIR}/mariadb"
  mariadb --defaults-file=/etc/mysql/debian.cnf \
    -e "SHOW DATABASES;" 2>/dev/null \
    | grep -v "^Database\|information_schema\|performance_schema\|sys" \
    | while read -r db; do
        mysqldump --defaults-file=/etc/mysql/debian.cnf \
          --no-data --routines --triggers \
          "$db" 2>/dev/null \
          > "${SECRET_DIR}/mariadb/schema-${db}.sql" || true
      done
  index_secret "mariadb/schema-*.sql" "MariaDB schema dumps (structure only, no data)"
fi

# ── Postfix SASL credentials ─────────────────────────────────────────────────
if [[ -f /etc/postfix/sasl_passwd ]]; then
  sec "postfix/sasl_passwd" /etc/postfix/sasl_passwd
  index_secret "postfix/sasl_passwd" "Postfix SASL relay credentials"
fi

# ── GPG keys (export secret keyring) ────────────────────────────────────────
if ! $DRY_RUN && command -v gpg &>/dev/null; then
  mkdir -p "${SECRET_DIR}/gpg"
  # Export all secret keys for all users with home dirs
  while IFS=: read -r user _ _ _ _ homedir _; do
    [[ -d "${homedir}/.gnupg" ]] || continue
    # Run gpg as the actual user, not as root, so it can access their keyring
    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export-secret-keys --armor       > "${SECRET_DIR}/gpg/${user}-secret-keys.asc" 2>/dev/null || true
    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export --armor       > "${SECRET_DIR}/gpg/${user}-public-keys.asc" 2>/dev/null || true
    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export-ownertrust       > "${SECRET_DIR}/gpg/${user}-ownertrust.txt" 2>/dev/null || true
  done < /etc/passwd
  index_secret "gpg/" "GPG secret + public keyrings and ownertrust for all users"
fi

# ── i2pd destination keys ────────────────────────────────────────────────────
if [[ -d /var/lib/i2pd ]]; then
  sec "i2pd/var-lib-i2pd" /var/lib/i2pd
  index_secret "i2pd/var-lib-i2pd" "i2pd full data dir including destination private keys"
fi

# ── Tor hidden service keys ──────────────────────────────────────────────────
if [[ -d /var/lib/tor ]]; then
  sec "tor/var-lib-tor" /var/lib/tor
  index_secret "tor/var-lib-tor" "Tor full data dir including hidden service private keys"
fi

# ── Nginx htpasswd files ─────────────────────────────────────────────────────
if ! $DRY_RUN; then
  mkdir -p "${SECRET_DIR}/nginx"
  find /etc/nginx -name "*.htpasswd" -o -name "htpasswd-*" -o -name ".htpasswd" \
    2>/dev/null \
    | while read -r f; do
        cp "$f" "${SECRET_DIR}/nginx/" 2>/dev/null || true
      done
  index_secret "nginx/" "nginx htpasswd files (bcrypt password hashes)"
fi

# ── User shell configs (may contain tokens/API keys) ────────────────────────
for user_home in /root /home/lukasz; do
  user="$(basename "$user_home")"
  [[ "$user" == "root" ]] && user="root"
  if ! $DRY_RUN; then
    mkdir -p "${SECRET_DIR}/shell/${user}"
    for f in .bashrc .zshrc .profile .bash_profile .zprofile \
              .netrc .ssh/config; do
      [[ -f "${user_home}/${f}" ]] \
        && cp "${user_home}/${f}" \
              "${SECRET_DIR}/shell/${user}/$(basename "$f")" 2>/dev/null || true
    done
  fi
  index_secret "shell/${user}" "Shell configs for ${user} (may contain tokens/API keys)"
done

# ── Lufi app config (contains app secret + DB path) ─────────────────────────
if [[ -f /srv/lufi/lufi.conf ]]; then
  sec "lufi/lufi.conf" /srv/lufi/lufi.conf
  index_secret "lufi/lufi.conf" "Lufi app config (secret key, DB path, domain)"
fi

# ── Grafana secrets ──────────────────────────────────────────────────────────
if [[ -f /etc/grafana/grafana.ini ]]; then
  sec "grafana/grafana.ini" /etc/grafana/grafana.ini
  index_secret "grafana/grafana.ini" "Grafana config (admin password, secret key)"
fi

# ── Alloy config (may contain remote write credentials) ─────────────────────
if [[ -d /etc/alloy ]]; then
  sec "alloy/etc-alloy" /etc/alloy
  index_secret "alloy/etc-alloy" "Grafana Alloy config (may contain remote write tokens)"
fi

# ── Borg backup passphrase / config ─────────────────────────────────────────
if [[ -d /etc/borg ]]; then
  sec "borg/etc-borg" /etc/borg
  index_secret "borg/etc-borg" "Borg backup config (repo paths, passphrase)"
fi
for f in /root/.config/borg/config /root/.borgmatic.yaml /etc/borgmatic.d; do
  if [[ -e "$f" ]]; then
    sec "borg/$(basename "$f")" "$f"
    index_secret "borg/$(basename "$f")" "Borgmatic config"
  fi
done

# ── User crontabs (may contain tokens in commands) ──────────────────────────
if [[ -d /var/spool/cron/crontabs ]]; then
  sec "cron/user-crontabs" /var/spool/cron/crontabs
  index_secret "cron/user-crontabs" "User crontabs (may contain API keys in commands)"
fi

# ── Prosody secrets (SSL certs + account data location) ─────────────────────
if [[ -d /etc/prosody ]]; then
  sec "prosody/etc-prosody" /etc/prosody
  index_secret "prosody/etc-prosody" "Full Prosody config including any embedded credentials"
fi

# ── LUKS header backup ───────────────────────────────────────────────────────
# Backing up the LUKS header is critical for recovery if the header gets corrupted
if ! $DRY_RUN && command -v cryptsetup &>/dev/null; then
  mkdir -p "${SECRET_DIR}/luks"
  # Find LUKS devices
  lsblk -o NAME,TYPE,FSTYPE -J 2>/dev/null \
    | jq -r '.blockdevices[] | .. | objects | select(.fstype=="crypto_LUKS") | .name' \
    2>/dev/null \
    | while read -r dev; do
        rm -f "${SECRET_DIR}/luks/${dev}-header.bin"
        cryptsetup luksHeaderBackup "/dev/${dev}" \
          --header-backup-file "${SECRET_DIR}/luks/${dev}-header.bin" \
          2>/dev/null \
          && log "LUKS header backup: /dev/${dev}" \
          || warn "could not backup LUKS header for /dev/${dev}"
      done
  index_secret "luks/" "LUKS header backups — critical for encrypted volume recovery"
fi

log "Secret staging complete"

# =========================================================================== #
#  ENCRYPT SECRET TIER
# =========================================================================== #

section "finalise secrets"

if ! $DRY_RUN; then
  # Lock down permissions — secret dir readable only by root
  chmod 700 "${SECRET_DIR}"
  find "${SECRET_DIR}" -type f -exec chmod 600 {} \;
  find "${SECRET_DIR}" -type d -exec chmod 700 {} \;
  log "Secret dir locked: chmod 700 ${SECRET_DIR}"

  log "Secret files written to ${SECRET_DIR}/"
else
  log "[dry] secret files would be written to ${SECRET_DIR}/ (chmod 700)"
  log "[dry] staging area would be wiped after encryption"
fi

# =========================================================================== #
#  WRITE .gitignore
# =========================================================================== #

if ! $DRY_RUN; then
  cat > "${CAPTURE_DIR}/.gitignore" << 'GITIGNORE'
# Secret tier — NEVER commit (contains private keys, credentials, LUKS headers)
db/secret/

# Exception: the index is safe to commit (shows what exists, not values)
!db/secret/secrets.index
GITIGNORE
fi

# =========================================================================== #
#  WRITE db/README.md
# =========================================================================== #

if ! $DRY_RUN; then
  OS_NAME="$(grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d '"')"
  cat > "${CAPTURE_DIR}/db/README.md" << EOF
# sanctum — full state database

| | |
|---|---|
| **Host** | ${HOSTNAME_SHORT} |
| **OS** | ${OS_NAME} |
| **Kernel** | $(uname -r) |
| **Captured** | ${TIMESTAMP} |

## Structure

\`\`\`
db/
├── public/         Safe inventory — no secret values, git-trackable
└── secret/
    ├── <category>/     Secret files in plain subdirectories
    └── secrets.index   Index of what is inside (no values)
\`\`\`

## Decrypt secrets

\`\`\`bash
# List contents without extracting
  find /srv/sanctum-rebuild/db/secret -type f | sort

# Extract to a directory
mkdir /tmp/secrets-out
  sudo cat /srv/sanctum-rebuild/db/secret/wireguard/etc-wireguard/wg0.conf

# Wipe after use
find /tmp/secrets-out -type f -exec shred -u {} \\;
rm -rf /tmp/secrets-out
\`\`\`

## What is in the secret archive

See \`db/secret/secrets.index\` for a full list.

Key items:
- WireGuard private + preshared keys
- TLS private keys (Let's Encrypt)
- SSH host keys + user SSH keys
- GPG secret keyrings (all users)
- Docker .env files and full unredacted compose files
- MariaDB credentials + schema dumps
- i2pd destination private keys
- Tor hidden service private keys
- LUKS header backups
- Lufi app secret, Grafana credentials, Alloy tokens
- Postfix SASL credentials
- nginx htpasswd files

## Warnings during capture
$(if [[ ${#WARNINGS[@]} -gt 0 ]]; then
  for w in "${WARNINGS[@]}"; do echo "- ${w}"; done
else
  echo "None"
fi)
EOF
fi

# =========================================================================== #
#  DONE
# =========================================================================== #

echo ""
echo "╔══════════════════════════════════════════════════════╗"
if $DRY_RUN; then
  echo "║  dry run complete — nothing written                  ║"
else
  echo "║  capture-full complete ✓                             ║"
  echo "║                                                      ║"
  printf "║  public:  %-42s║\n" "${PUBLIC_DIR}"
  printf "║  secret:  %-42s║\n" "${SECRET_DIR}/"
  if [[ ${#WARNINGS[@]} -gt 0 ]]; then
    printf "║  ⚠  %-47s║\n" "${#WARNINGS[@]} warning(s) — see db/README.md"
  fi
fi
echo "╚══════════════════════════════════════════════════════╝"
echo ""
echo "  Next step: bootstrap.sh will read this database to"
echo "  reproduce this machine on a fresh Debian 13 install."
echo ""