#!/usr/bin/env bash
# deep-audit-netboot.sh — READ-ONLY deep inspection. Uses `sudo` for docker/root files.
set -u
DG="sudo docker"

hdr() { printf '\n=== %s ===\n' "$1"; }

hdr "COMPOSE FILES: /root/pihole and /root/NTP"
for f in /root/pihole/docker-compose.yml /root/NTP/docker-compose.yml; do
    printf '\n--- %s ---\n' "$f"
    sudo cat "$f" 2>&1
done

hdr "DIR LAYOUT of compose project dirs"
sudo ls -la /root/pihole 2>&1
sudo ls -la /root/NTP 2>&1
sudo ls -la /root 2>&1

hdr "SEARCH entire FS for any technitium / dns compose files"
sudo find / -xdev -maxdepth 6 \( -iname 'docker-compose.y*ml' -o -iname 'compose.y*ml' \) -print 2>/dev/null \
    | grep -Ei 'dns|technitium|tsys' || true

hdr "ALL CONTAINERS with compose labels"
$DG ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\tWDIR={{.Label "com.docker.compose.project.working_dir"}}\tCFG={{.Label "com.docker.compose.project.config_files"}}\tSVC={{.Label "com.docker.compose.service"}}' 2>&1

hdr "DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container)"
for c in $($DG ps -aq 2>/dev/null); do
    nm=$($DG inspect --format '{{.Name}} | image={{.Config.Image}} | proj={{index .Config.Labels "com.docker.compose.project"}}' "$c" 2>/dev/null)
    printf '\n###### %s ######\n' "$nm"
    $DG inspect "$c" 2>&1
done

hdr "PI-HOLE internal config (sudo docker exec, READ-ONLY)"
echo "-- ls /etc/pihole --";          $DG exec pihole ls -la /etc/pihole 2>&1 || true
echo "-- ls /etc/dnsmasq.d --";       $DG exec pihole ls -la /etc/dnsmasq.d 2>&1 || true
for f in setupVars.conf pihole-FTL.conf adlists.list custom.list local.list regex.list dhcp.leases static_ip.conf; do
    echo "--- /etc/pihole/$f ---"; $DG exec pihole cat "/etc/pihole/$f" 2>&1 || true
done
echo "-- /etc/dnsmasq.d/* --"
# shellcheck disable=SC2016 # $f/$t expand inside the container's sh, not locally — single quotes are intentional
$DG exec pihole sh -c 'for f in /etc/dnsmasq.d/*; do echo "--- $f ---"; cat "$f"; done' 2>&1 || true
echo "-- pihole version --";          $DG exec pihole pihole -v 2>&1 || true
echo "-- gravity row counts --"
# shellcheck disable=SC2016 # $t expands inside the container's sh, not locally
$DG exec pihole sh -c 'for t in adlist domainlist client "group" info; do printf "%s=" "$t"; sqlite3 /etc/pihole/gravity.db "SELECT COUNT(*) FROM $t;" 2>/dev/null; done' 2>&1 || true
echo "-- adlist addresses --"
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT address,enabled,comment FROM adlist;" 2>&1 || true
echo "-- domainlist (allow+deny, first 60) --"
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT type,domain,enabled,comment FROM domainlist LIMIT 60;" 2>&1 || true

hdr "CHRONY/NTP container config (tsys-ntp)"
$DG exec tsys-ntp sh -c 'echo "--- chrony.conf ---"; cat /etc/chrony/chrony.conf 2>/dev/null || cat /etc/chrony.conf 2>/dev/null || echo none; echo "--- ls /etc ---"; ls -la /etc 2>/dev/null | head -30' 2>&1 || true
$DG exec tsys-ntp chronyc -n sources 2>&1 || true
$DG exec tsys-ntp chronyc -n tracking 2>&1 || true
echo "-- bare metal ntpsec.conf --"; sudo cat /etc/ntpsec/ntp.conf 2>&1

hdr "TECHNITIUM volumes"
for v in dns_tsys-dns-config dns_tyss-dns-config; do
    mnt=$($DG volume inspect --format '{{.Mountpoint}}' "$v" 2>/dev/null)
    printf '\n--- volume %s -> %s ---\n' "$v" "$mnt"
    [ -n "$mnt" ] || continue
    sudo find "$mnt" -maxdepth 4 -type f 2>/dev/null | head -80
    echo "-- config dir listing --"
    sudo ls -laR "$mnt"/config 2>/dev/null | head -60 || sudo ls -laR "$mnt" 2>/dev/null | head -60 || true
    echo "-- config.xml --"
    sudo cat "$mnt"/config/config.xml 2>/dev/null | head -250 || true
done

hdr "DONE"