#!/bin/sh
# pivot-probe.sh — runs ON a Proxmox host (tsys5).
# Tests whether THIS host's root key grants SSH (root/localuser) into the
# GA-NO / no-SSH VMs over Tailscale. Output: "ip name user PIVOT-OK|FAIL reason"
IPS="
100.125.183.68:tsys-proxmox-datacenter:105
100.109.13.110:tsys-ucs-01:108
100.114.81.107:pfv-proxmox-backup-server:400
100.77.14.7:preprod-hfnoc-uisp:515
100.108.121.18:sectestbed-siem:5101
100.80.72.71:sectestbed-proxmox-pve:5102
100.94.1.34:sectestbed-proxmox-datacenter:5103
100.127.238.29:sectestbed-proxmox-pbs:5104
100.97.140.105:sectestbed-cloudron:51011
100.117.24.21:sectestbed-proxmox-mailgw:51014
100.113.245.124:sectestbed-ca:51015
100.86.176.105:sectestbed-voip:51016
100.98.162.14:preprod-siem:53101
100.114.9.49:preprod-proxmox-mailgw:53103
100.94.119.5:preprod-ca:53104
100.101.250.10:preprod-proxmox-datacenter:53105
100.79.52.34:preprod-librenms:53106
100.109.99.109:preprod-voip:53107
100.95.69.89:preprod-cloudron:53108
100.94.188.89:hfnoc-uisp:702
100.72.35.113:tsys-siem:707
100.82.30.115:kali-tsys:708
"
for line in $IPS; do
  ip="${line%%:*}"; rest="${line#*:}"; name="${rest%%:*}"; vmid="${rest##*:}"
  if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "root@${ip}" 'true' >/dev/null 2>&1; then
    printf '%s\t%s\t%s\troot\tPIVOT-OK\n' "$ip" "$name" "$vmid"
  elif ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "localuser@${ip}" 'true' >/dev/null 2>&1; then
    printf '%s\t%s\t%s\tlocaluser\tPIVOT-OK\n' "$ip" "$name" "$vmid"
  else
    printf '%s\t%s\t%s\t-\tPIVOT-FAIL\n' "$ip" "$name" "$vmid"
  fi
done