#!/bin/bash
# 14-capture-state.sh — snapshot guest + PVE state for rebuild docs (#615)
# Read-only; regenerates docs/state/* (stable names, diff-friendly).
# Runs as reachableceo on the workstation; uses the two root ssh paths.
set -euo pipefail
cd "$(dirname "$0")"
OUT=docs/state
GUEST_SSH="timeout 60 ssh root@100.101.187.119"   # this VM, privileged
PVE_SSH="timeout 60 ssh root@100.87.135.12"       # pfv-tsys5
mkdir -p "$OUT"

echo "== guest: packages"
apt-mark showmanual | sort > "$OUT/guest-apt-manual.txt"
dpkg -l | tail -n +6 | wc -l > "$OUT/guest-dpkg-count.txt"
timeout 30 ssh root@100.101.187.119 'apt-cache policy docker-ce docker.io 2>/dev/null | grep -E "^[a-z]|Installed|Candidate" | head -8' > "$OUT/guest-docker-pkg.txt" 2>&1 || true

echo "== guest: users/groups"
timeout 30 ssh root@100.101.187.119 'getent passwd | awk -F: "\$3>=1000 && \$3<65534"; echo ---; for u in reachableceo reachableceo-offstage; do id $u; done' > "$OUT/guest-users.txt"

echo "== guest: units + sysctl + fstab"
timeout 60 ssh root@100.101.187.119 '
systemctl list-unit-files --state=enabled | sort;
echo ===CUSTOM-UNITS;
find /etc/systemd/system -maxdepth 2 \( -type f -o -type l \) | sort;
echo ===SYSCONTROL;
for f in /etc/sysctl.d/*.conf; do echo "-- $f"; cat "$f"; done;
echo ===FSTAB;
cat /etc/fstab;
echo ===SUDOERS;
ls -la /etc/sudoers.d/;
echo ===XRDP-DROPIN;
cat /etc/systemd/system/xrdp.service.d/*.conf 2>/dev/null' > "$OUT/guest-system.txt"

echo "== guest: disks + docker"
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT > "$OUT/guest-disks.txt"
df -h | grep -vE "tmpfs|udev|overlay|squashfs" >> "$OUT/guest-disks.txt"
{ docker images --format "{{.Repository}}:{{.Tag}}  {{.Size}}"; echo ---; docker ps -a --format "{{.Names}}  {{.Image}}  {{.Status}}"; } > "$OUT/guest-docker.txt" 2>/dev/null || echo "docker unavailable" > "$OUT/guest-docker.txt"

echo "== PVE: VM 5111 + host"
timeout 60 ssh -o ConnectTimeout=10 root@100.87.135.12 '
echo "=== qm config 5111 (live)"; qm config 5111 --current 2>/dev/null || qm config 5111;
echo "=== qm list"; qm list;
echo "=== storage.cfg"; cat /etc/pve/storage.cfg;
echo "=== pool usage"; df -h /mnt/nvme /mnt/ssd2 /mnt/pfv-tsys5/ssd 2>/dev/null;
echo "=== host"; grep -m1 "model name" /proc/cpuinfo; free -g | head -2; uname -r;
echo "=== nested"; cat /sys/module/kvm_intel/parameters/nested' > "$OUT/pve-5111.txt" || echo "PVE host unreachable — rerun later" > "$OUT/pve-5111.txt"

echo "== done: $(ls "$OUT" | wc -l) files in $OUT/"
ls -la "$OUT"