WRKLOG-2026-07-01

adb devices -l

adb shell ls -la /sdcard/
adb shell ls -la /sdcard/Download/
adb shell ls -la /sdcard/DCIM/Camera/ | wc -l
adb shell ls -laR /sdcard/DCIM/Screenshots/
adb shell ls -laR /sdcard/Pictures/
adb shell ls -laR /sdcard/Documents/
adb shell ls -laR /sdcard/Movies/
adb shell ls -laR /sdcard/Recordings/
adb shell ls -laR /sdcard/Music/

mkdir -p ~/atelier/_captures/zfold7-pull-$(date +%Y-%m-%d)/{photos/camera,photos/screenshots,photos/messages,video,audio/recordings,literature,career,personal,infra,trash}

PULL=~/atelier/_captures/zfold7-pull-$(date +%Y-%m-%d)

adb pull /sdcard/DCIM/Camera/ "$PULL/photos/camera/"
adb pull /sdcard/DCIM/Screenshots/ "$PULL/photos/screenshots/"
adb pull /sdcard/Recordings/ "$PULL/audio/recordings/"
adb pull /sdcard/Pictures/ "$PULL/photos/messages/"
adb pull /sdcard/Movies/ "$PULL/video/"

adb pull /sdcard/Download/filename.pdf "$PULL/literature/"

find "$PULL" -type f | wc -l
du -sh "$PULL"/*/

adb shell 'rm -rf /sdcard/DCIM/Camera/*'
adb shell 'rm -rf /sdcard/DCIM/Screenshots/*'
adb shell 'rm -rf /sdcard/Recordings/*'
adb shell 'rm -rf /sdcard/Pictures/Mensajes/*'
adb shell 'rm -rf /sdcard/Pictures/Messages/*'
adb shell 'rm -rf /sdcard/Movies/*'
adb shell 'rm -rf /sdcard/Download/*'

adb shell 'find /sdcard/ -maxdepth 3 -type f 2>/dev/null | grep -v "/Android/" | grep -v "/.thumbnails/"'

pkg list-installed 2>/dev/null | wc -l

pkg list-installed 2>/dev/null | grep upgradable

TOOLS=(
  # === Shell ===
  zsh bash fish
  # === Editor ===
  neovim nano vim
  # === Multiplexer ===
  tmux
  # === Git ===
  git
  # === Search & Filter ===
  fzf fd ripgrep jq yq bat grep gawk sed
  # === Network ===
  curl wget rsync openssh nmap netcat-openbsd dnsutils iproute2 lsof w3m
  # === Crypto & Secrets ===
  gnupg pass gopass age openssl-tool
  # === Dev Languages ===
  python nodejs-lts rust golang clang make
  # === Dev Tools ===
  lua-language-server rust-analyzer luarocks strace
  # === LSP & Treesitter ===
  tree-sitter tree-sitter-parsers
  # === Prompt ===
  oh-my-posh
  # === File Management ===
  stow tree unzip tar
  # === Misc ===
  tealdeer tesseract aerc dos2unix
  # === Android Integration ===
  termux-api
)

printf "\n%-25s %-10s %s\n" "PACKAGE" "STATUS" "VERSION"
printf "%-25s %-10s %s\n" "-------" "------" "-------"

for tool in "${TOOLS[@]}"; do
  [[ "$tool" =~ ^#.*$ ]] && { printf "\n%s\n" "$tool"; continue; }
  ver=$(pkg show "$tool" 2>/dev/null | awk -F': ' '/^Version/{print $2; exit}')
  if dpkg -s "$tool" &>/dev/null; then
    upg=$(apt list --upgradable 2>/dev/null | grep "^${tool}/" | awk -F' ' '{print $2}')
    if [ -n "$upg" ]; then
      printf "%-25s %-10s %s → %s\n" "$tool" "UPGRADE" "$(dpkg -s "$tool" | awk -F': ' '/^Version/{print $2}')" "$upg"
    else
      printf "%-25s %-10s %s\n" "$tool" "OK" "$(dpkg -s "$tool" | awk -F': ' '/^Version/{print $2}')"
    fi
  else
    if [ -n "$ver" ]; then
      printf "%-25s %-10s %s\n" "$tool" "MISSING" "(available: $ver)"
    else
      printf "%-25s %-10s\n" "$tool" "NOT FOUND"
    fi
  fi
done

BINS=(
  zsh bash fish
  nvim nano vim
  tmux
  git
  fzf fd rg jq yq bat grep awk sed
  curl wget rsync ssh nmap nc dig ip lsof w3m
  gpg pass gopass age openssl
  python3 node rustc go clang make
  lua-language-server rust-analyzer luarocks strace
  oh-my-posh
  stow tree unzip tar
  tldr tesseract aerc dos2unix
  termux-api-battery-status
)

printf "\n%-25s %-10s %s\n" "BINARY" "STATUS" "PATH"
printf "%-25s %-10s %s\n" "------" "------" "----"

for bin in "${BINS[@]}"; do
  loc=$(which "$bin" 2>/dev/null)
  if [ -n "$loc" ]; then
    printf "%-25s %-10s %s\n" "$bin" "OK" "$loc"
  else
    printf "%-25s %-10s\n" "$bin" "MISSING"
  fi
done

printf "\n%-40s %-10s %s\n" "KEY" "PERMS" "TYPE"
printf "%-40s %-10s %s\n" "---" "-----" "----"

for key in ~/.ssh/id_*; do
  [ -f "$key" ] || continue
  perms=$(stat -c '%a' "$key")
  type=$(head -1 "$key" | awk '{print $1}' | sed 's/.*BEGIN //' | sed 's/ KEY.*//')
  printf "%-40s %-10s %s\n" "$(basename "$key")" "$perms" "$type"
done

if [ -f ~/.ssh/id_ed25519_vault-cert.pub ]; then
  echo "=== Vault SSH Cert ==="
  ssh-keygen -L -f ~/.ssh/id_ed25519_vault-cert.pub 2>&1 | grep -E 'Type|Valid|Principals'

  # Check if expired
  expiry=$(ssh-keygen -L -f ~/.ssh/id_ed25519_vault-cert.pub 2>&1 | awk '/Valid/{print $5}')
  now=$(date -u +%Y-%m-%dT%H:%M:%S)
  if [[ "$now" > "$expiry" ]]; then
    echo "STATUS: EXPIRED (expired $expiry)"
  else
    echo "STATUS: VALID (until $expiry)"
  fi
else
  echo "=== Vault SSH Cert ==="
  echo "STATUS: NOT FOUND"
fi

REPOS=(
  ~/atelier/_bibliotheca/domus-captures
  ~/atelier/_bibliotheca/domus-infra-ops
  ~/atelier/_bibliotheca/domus-netapi-docs
  ~/atelier/_bibliotheca/domus-secrets-ops
  ~/atelier/_bibliotheca/domus-asciidoc-build
  ~/atelier/_projects/personal/dotfiles-optimus
  ~/atelier/_projects/personal/dots-quantum
  ~/.config/nvim
  ~/.secrets
)

printf "\n%-50s %-10s %s\n" "REPO" "STATUS" "LAST COMMIT"
printf "%-50s %-10s %s\n" "----" "------" "-----------"

for repo in "${REPOS[@]}"; do
  if [ -d "$repo/.git" ]; then
    last=$(git -C "$repo" log --oneline -1 2>/dev/null)
    behind=$(git -C "$repo" rev-list HEAD..origin/main --count 2>/dev/null)
    if [ "$behind" -gt 0 ] 2>/dev/null; then
      printf "%-50s %-10s %s (%d behind)\n" "$repo" "STALE" "$last" "$behind"
    else
      printf "%-50s %-10s %s\n" "$repo" "OK" "$last"
    fi
  else
    printf "%-50s %-10s\n" "$repo" "MISSING"
  fi
done

echo "=== gopass mounts ==="
gopass mounts
echo ""
echo "=== v3 entry count ==="
gopass ls --flat v3 2>/dev/null | wc -l
echo ""
echo "=== v4 entry count ==="
gopass ls --flat v4 2>/dev/null | wc -l

echo "=== Stow symlinks ==="
for f in ~/.zshrc ~/.zshenv ~/.zprofile ~/.gitconfig ~/.fzf ~/.vimrc; do
  if [ -L "$f" ]; then
    target=$(readlink "$f")
    if [ -e "$f" ]; then
      printf "%-20s → %s\n" "$(basename "$f")" "$target"
    else
      printf "%-20s → %s (BROKEN)\n" "$(basename "$f")" "$target"
    fi
  elif [ -f "$f" ]; then
    printf "%-20s (not symlink — stow conflict)\n" "$(basename "$f")"
  else
    printf "%-20s MISSING\n" "$(basename "$f")"
  fi
done

echo "=== SSH config ==="
head -3 ~/.ssh/config
echo ""
echo "=== config.d/ ==="
ls -la ~/.ssh/config.d/ 2>/dev/null || echo "NOT DEPLOYED"

echo "=== Home directory ==="
ls -la ~/

echo ""
echo "=== ~/.config/ ==="
ls ~/.config/

echo ""
echo "=== ~/.local/share/ ==="
ls ~/.local/share/

echo ""
echo "=== ~/.local/state/ ==="
ls ~/.local/state/

echo ""
echo "=== atelier tree ==="
find ~/atelier -maxdepth 3 -type d | grep -v '.git' | sort

echo ""
echo "=== Stale dirs outside atelier ==="
for d in ~/downloads ~/src; do
  [ -d "$d" ] && echo "STALE: $d" || echo "clean: $d"
done

echo ""
echo "=== Stale files in ~ ==="
for f in ~/cprom.adoc ~/test.lua; do
  [ -f "$f" ] && echo "STALE: $f" || echo "clean: $f"
done

rm -rf ~/.config/domus-nvim
rm -rf ~/.local/share/domus-nvim
rm -rf ~/.local/state/domus-nvim
rm -rf ~/.local/share/nvim-domus
rm -rf ~/.local/state/nvim-domus
rm -f ~/.config/nvim/nvim-domus
ln -s ~/.config/nvim ~/.config/domus-nvim

rm -f ~/.config/starship.toml

rm -rf ~/downloads
rm -rf ~/src

rm -f ~/cprom.adoc
rm -f ~/test.lua

echo "=== ~ ==="
ls ~/

echo ""
echo "=== ~/.config/ ==="
ls ~/.config/

echo ""
echo "=== ~/.local/share/ ==="
ls ~/.local/share/

echo ""
echo "=== ~/.local/state/ ==="
ls ~/.local/state/

for pkg in neovim tmux fzf fd ripgrep yq wget golang nmap netcat-openbsd git-lfs; do
  command -v "${pkg}" &>/dev/null || {
    echo "--- Installing $pkg ---"
    pkg install -y "$pkg"
  }
done

for bin in nvim tmux fzf fd rg yq wget go nmap nc; do
  printf "%-10s " "$bin"
  command -v "$bin" 2>/dev/null || echo "MISSING"
done

pkg upgrade -y

pkg install openssh git neovim tmux curl wget rsync stow \
  pass gnupg age \
  python nodejs golang rust \
  jq yq fzf fd ripgrep bat \
  nmap netcat-openbsd dnsutils \
  termux-api oh-my-posh

mkdir -p ~/.termux/boot
cat > ~/.termux/boot/start-sshd.sh << 'EOF'
#!/data/data/com.termux/files/usr/bin/bash
sshd
EOF
chmod +x ~/.termux/boot/start-sshd.sh

adb shell 'ip addr show wlan0' | awk '/inet / {split($2,a,"/"); print a[1]}'

adb push ~/.ssh/id_ed25519_d000.pub /sdcard/authorized_key.pub

mkdir -p ~/.ssh
cat ~/storage/shared/authorized_key.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
rm ~/storage/shared/authorized_key.pub

scp -r ~/.ssh/config.d fold7:~/.ssh/

wc -l ~/.ssh/config
cp ~/.ssh/config ~/.ssh/config.bak.2026-07-01
echo 'Include config.d/*.conf' | tee ~/.ssh/config > /dev/null
chmod 600 ~/.ssh/config

ls -la ~/.ssh/config.d/

ssh -G fold7 | grep -E 'hostname|user|identityfile|port'

ds d000 dev/vault

for node in vault-01 vault-02 vault-03; do
  printf "%-12s " "$node"
  curl -sk "https://$node.inside.domusdigitalis.dev:8200/v1/sys/health" \
    | jq -r '"\(if .sealed then "SEALED" else "unsealed" end)  \(if .standby then "standby" else "ACTIVE" end)  v\(.version)"' \
    2>/dev/null || echo "UNREACHABLE"
done

vault write -field=signed_key ssh/sign/domus-client \
  public_key=@$HOME/.ssh/id_ed25519_d000.pub \
  valid_principals="u0_a385,evanusmodestus" \
  cert_type=user | tee /tmp/zfold7-ssh-cert.pub > /dev/null

ssh-keygen -L -f /tmp/zfold7-ssh-cert.pub

adb push /tmp/zfold7-ssh-cert.pub /sdcard/

cp ~/storage/shared/zfold7-ssh-cert.pub ~/.ssh/id_ed25519_d000-cert.pub
chmod 600 ~/.ssh/id_ed25519_d000-cert.pub
rm ~/storage/shared/zfold7-ssh-cert.pub

ssh kvm-02

rm -f /tmp/zfold7-ssh-cert.pub

ssh -T git@github.com
ssh -T git@gitlab.com
ssh -T git@gitea-01
ssh kvm-02 hostname

awk '/^Host fold7/,/^$/' ~/.ssh/config.d/80-d000-hosts.conf

# Verify before
awk '/^Host fold7/,/^$/' ~/.ssh/config.d/80-d000-hosts.conf

# Delete the old fold7 block (safe: grep first to confirm it exists)
grep -q '^Host fold7' ~/.ssh/config.d/80-d000-hosts.conf && \
  sed -i '/^Host fold7$/,/^$/d' ~/.ssh/config.d/80-d000-hosts.conf

# Append the new block
cat >> ~/.ssh/config.d/80-d000-hosts.conf << 'EOF'

Host fold7
    HostName 10.50.10.145
    Port 8022
    IdentityFile ~/.ssh/id_ed25519_vault
    CertificateFile ~/.ssh/id_ed25519_vault-cert.pub
    IdentityFile ~/.ssh/id_ed25519_d000
EOF

# Verify after
awk '/^Host fold7/,/^$/' ~/.ssh/config.d/80-d000-hosts.conf

ssh -G fold7 | grep -E 'hostname|user|identityfile|certificatefile|port'

rm ~/.ssh/config.d/80-d000-hosts.conf.age
age -e -R ~/.age/recipients/self.txt -o ~/.ssh/config.d/80-d000-hosts.conf.age ~/.ssh/config.d/80-d000-hosts.conf

stat --printf='%n\n  Size: %s bytes\n  Modified: %y\n  Permissions: %A (%a)\n  Inode: %i\n' ~/.ssh/config.d/80-d000-hosts.conf ~/.ssh/config.d/80-d000-hosts.conf.age

# Confirm age encryption (magic bytes)
file ~/.ssh/config.d/80-d000-hosts.conf.age

# Decrypt → diff against plaintext (process sub — never writes to disk)
diff <(age -d -i ~/.age/identities/self.txt ~/.ssh/config.d/80-d000-hosts.conf.age) \
     ~/.ssh/config.d/80-d000-hosts.conf \
  && echo "MATCH" || echo "DRIFT"

kill $(lsof -i @10.50.10.145 -t) 2>/dev/null
rm -f ~/.ssh/sockets/*10.50.10.145* 2>/dev/null
ssh fold7

adb push ~/.ssh/id_ed25519_d000.pub /sdcard/authorized_key.pub

mkdir -p ~/.ssh
cat ~/storage/shared/authorized_key.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
rm ~/storage/shared/authorized_key.pub

echo "=== Phone atelier tree ==="
find ~/atelier -maxdepth 3 -type d 2>/dev/null | grep -v '.git'

echo "=== Workstation atelier tree ==="
find ~/atelier -maxdepth 2 -type d | grep -v '.git' | sort

mkdir -p ~/atelier/_bibliotheca
mkdir -p ~/atelier/_projects/personal
mkdir -p ~/.secrets

REPOS=(
  ~/atelier/_bibliotheca/domus-captures
  ~/atelier/_bibliotheca/domus-infra-ops
  ~/atelier/_bibliotheca/domus-netapi-docs
  ~/atelier/_bibliotheca/domus-secrets-ops
  ~/atelier/_bibliotheca/domus-asciidoc-build
  ~/atelier/_projects/personal/dots-quantum
  ~/.config/nvim
  ~/.secrets
)

printf "\n%-55s %-10s %s\n" "REPO" "STATUS" "LAST COMMIT"
printf "%-55s %-10s %s\n" "----" "------" "-----------"

for repo in "${REPOS[@]}"; do
  if [ -d "$repo/.git" ]; then
    last=$(git -C "$repo" log --oneline -1 2>/dev/null)
    printf "%-55s %-10s %s\n" "$repo" "OK" "$last"
  else
    printf "%-55s %-10s\n" "$repo" "MISSING"
  fi
done

git -C ~/atelier/_projects/personal/dots-quantum pull
git -C ~/atelier/_bibliotheca/domus-infra-ops pull
git -C ~/.config/nvim pull

command -v git-lfs &>/dev/null || pkg install -y git-lfs
git lfs install
git clone git@github.com:EvanusModestus/domus-captures.git ~/atelier/_bibliotheca/domus-captures
git clone git@github.com:EvanusModestus/domus-secrets-ops.git ~/atelier/_bibliotheca/domus-secrets-ops
git clone git@github.com:evanusmodestus/domus-asciidoc-build.git ~/atelier/_bibliotheca/domus-asciidoc-build
git clone git@github.com:EvanusModestus/domus-netapi-docs.git ~/atelier/_bibliotheca/domus-netapi-docs

mkdir -p ~/.secrets
git clone git@github.com:EvanusModestus/secrets.git ~/.secrets

REPOS=(
  ~/atelier/_bibliotheca/domus-captures
  ~/atelier/_bibliotheca/domus-infra-ops
  ~/atelier/_bibliotheca/domus-netapi-docs
  ~/atelier/_bibliotheca/domus-secrets-ops
  ~/atelier/_bibliotheca/domus-asciidoc-build
  ~/atelier/_projects/personal/dots-quantum
  ~/.config/nvim
  ~/.secrets
)

for repo in "${REPOS[@]}"; do
  if [ -d "$repo/.git" ]; then
    printf "%-60s %s\n" "$repo" "$(git -C "$repo" log --oneline -1 2>/dev/null)"
  else
    printf "%-60s MISSING\n" "$repo"
  fi
done

mkdir -p ~/atelier/_bibliotheca
mkdir -p ~/atelier/_projects/personal
mkdir -p ~/.secrets

git clone git@github.com:EvanusModestus/dots-quantum.git ~/atelier/_projects/personal/dots-quantum

for pkg in ~/atelier/_projects/personal/dots-quantum/*/; do
  name=$(basename "$pkg")
  [[ "$name" == .* ]] && continue
  files=$(find "$pkg" -type f | wc -l)
  printf "%-25s %4d files\n" "$name" "$files"
done

for f in ~/.zshrc ~/.zshenv ~/.zprofile ~/.gitconfig ~/.fzf ~/.vimrc \
         ~/.vimrc-minimal ~/.vimrc-ide-alt ~/.vimrc-server \
         ~/.fdignore ~/.ripgreprc ~/.bashrc ~/.inputrc; do
  if [ -L "$f" ]; then
    target=$(readlink "$f")
    if [ -e "$f" ]; then
      printf "%-20s → %s\n" "$(basename "$f")" "$target"
    else
      printf "%-20s → %s (BROKEN)\n" "$(basename "$f")" "$target"
    fi
  elif [ -f "$f" ]; then
    printf "%-20s (plain file — stow conflict)\n" "$(basename "$f")"
  else
    printf "%-20s MISSING\n" "$(basename "$f")"
  fi
done

cd ~/atelier/_projects/personal/dotfiles-optimus/base
stow -D -t ~ zsh git fzf fd ripgrep vim

mv ~/.zshrc ~/.zshrc.bak
mv ~/.config/omp-theme.toml ~/.config/omp-theme.toml.bak

cd ~/atelier/_projects/personal/dots-quantum
stow -t ~ zsh bash git vim fzf fd ripgrep oh-my-posh shell share bin

for f in ~/.zshrc ~/.zshenv ~/.zprofile ~/.gitconfig ~/.fzf ~/.vimrc \
         ~/.fdignore ~/.ripgreprc ~/.bashrc ~/.inputrc; do
  if [ -L "$f" ]; then
    printf "%-20s → %s\n" "$(basename "$f")" "$(readlink "$f")"
  else
    printf "%-20s NOT SYMLINKED\n" "$(basename "$f")"
  fi
done

rm -rf ~/atelier/_projects/personal/dotfiles-optimus
rm -f ~/.zshrc.bak
rm -f ~/.config/omp-theme.toml.bak

git -C ~/.config/nvim pull

for lsp in lua-language-server rust-analyzer pyright typescript-language-server; do
  printf "%-30s " "$lsp"
  command -v "$lsp" 2>/dev/null || echo "MISSING"
done

diff <(git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort) \
     <(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort')

REPOS=(
  ~/atelier/_bibliotheca/domus-captures
  ~/atelier/_bibliotheca/domus-infra-ops
  ~/atelier/_bibliotheca/domus-netapi-docs
  ~/atelier/_bibliotheca/domus-secrets-ops
  ~/atelier/_bibliotheca/domus-asciidoc-build
  ~/atelier/_projects/personal/dots-quantum
  ~/.config/nvim
  ~/.secrets
)

for repo in "${REPOS[@]}"; do
  name=$(basename "$repo")
  echo "=== $name ==="
  diff <(git -C "$repo" ls-files 2>/dev/null | sort) \
       <(ssh fold7 "git -C $repo ls-files 2>/dev/null | sort") \
    && echo "IDENTICAL" \
    || true
  echo ""
done

for repo in "${REPOS[@]}"; do
  name=$(basename "$repo")
  local_head=$(git -C "$repo" rev-parse HEAD 2>/dev/null)
  remote_head=$(ssh fold7 "git -C $repo rev-parse HEAD 2>/dev/null")
  if [ "$local_head" = "$remote_head" ]; then
    printf "%-25s SYNCED  %s\n" "$name" "${local_head:0:7}"
  else
    printf "%-25s DRIFTED  local=%s  phone=%s\n" "$name" "${local_head:0:7}" "${remote_head:0:7}"
  fi
done

for repo in "${REPOS[@]}"; do
  name=$(basename "$repo")
  local_count=$(git -C "$repo" ls-files 2>/dev/null | wc -l)
  remote_count=$(ssh fold7 "git -C $repo ls-files 2>/dev/null | wc -l")
  if [ "$local_count" -eq "$remote_count" ]; then
    printf "%-25s OK     %d files\n" "$name" "$local_count"
  else
    printf "%-25s DRIFT  local=%d  phone=%d\n" "$name" "$local_count" "$remote_count"
  fi
done

diff <(cat ~/atelier/_bibliotheca/domus-captures/docs/antora.yml) \
     <(ssh fold7 'cat ~/atelier/_bibliotheca/domus-captures/docs/antora.yml')

# ── diff two commands ────────────────────────────────────
# Compare package lists between two machines
diff <(pacman -Qq | sort) <(ssh fold7 'pkg list-installed 2>/dev/null | awk -F/ "{print \$1}" | sort')

# Compare directory trees
diff <(find ~/atelier -maxdepth 2 -type d | sort) \
     <(ssh fold7 'find ~/atelier -maxdepth 2 -type d | sort')

# Compare SSH config resolution between hosts
diff <(ssh -G kvm-02 | sort) <(ssh fold7 'ssh -G kvm-02 | sort')

# ── paste: side-by-side columns ─────────────────────────
# Local vs remote file counts per repo, side by side
paste <(du -sh ~/atelier/_bibliotheca/*/  2>/dev/null) \
      <(ssh fold7 'du -sh ~/atelier/_bibliotheca/*/ 2>/dev/null')

# ── comm: set operations (requires sorted input) ────────
# Files only on workstation (not on phone)
comm -23 <(git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort) \
         <(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort')

# Files only on phone (not on workstation)
comm -13 <(git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort) \
         <(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort')

# Files on both
comm -12 <(git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort) \
         <(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | sort')

# ── wc + paste: count comparison ─────────────────────────
# One-liner file count comparison
paste <(git -C ~/atelier/_bibliotheca/domus-captures ls-files | wc -l) \
      <(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | wc -l')

# ── vimdiff: visual ─────────────────────────────────────
# Side-by-side visual diff in neovim
nvim -d <(ssh fold7 'cat ~/.ssh/config') <(cat ~/.ssh/config)

# ── variables from commands ──────────────────────────────
PHONE_IP=$(adb shell 'ip addr show wlan0' | awk '/inet / {split($2,a,"/"); print a[1]}')
TERMUX_USER=$(ssh fold7 'whoami')
REPO_COUNT=$(ssh fold7 'find ~/atelier -name .git -type d | wc -l')

echo "Phone: $PHONE_IP  User: $TERMUX_USER  Repos: $REPO_COUNT"

# ── inline in commands ───────────────────────────────────
# Open the file that contains a pattern
nvim $(grep -rl 'vault-ssh-sign' ~/atelier/_bibliotheca/domus-captures/data/)

# cd to the directory of a binary
cd $(dirname $(which vault-ssh-sign))

# SSH to whatever IP the phone currently has
ssh -p 8022 $(adb shell 'ip addr show wlan0' | awk '/inet / {split($2,a,"/"); print a[1]}')

# Git log for the repo containing a specific file
git -C $(dirname $(find ~/atelier -name 'antora.yml' -path '*/domus-captures/*' | head -1)) log --oneline -5

# ── conditional execution ────────────────────────────────
# Install only if missing (idempotent)
command -v yq &>/dev/null || pkg install -y yq

# Clone only if not present
[ -d ~/atelier/_bibliotheca/domus-captures ] || git clone git@github.com:EvanusModestus/domus-captures.git ~/atelier/_bibliotheca/domus-captures

# ── arithmetic ───────────────────────────────────────────
# How many commits ahead is workstation vs phone?
echo "$(git -C ~/atelier/_bibliotheca/domus-captures rev-list --count HEAD) local vs $(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures rev-list --count HEAD') phone"

# ── nested: command sub inside process sub ───────────────
# Diff the SSH keys authorized on two hosts
diff <(ssh kvm-01 'cat ~/.ssh/authorized_keys' | ssh-keygen -lf - 2>/dev/null) \
     <(ssh kvm-02 'cat ~/.ssh/authorized_keys' | ssh-keygen -lf - 2>/dev/null)

# ── heredoc with command sub ─────────────────────────────
# Generate a report with live values
cat <<EOF
Phone Report — $(date +%Y-%m-%d)
IP:       $(adb shell 'ip addr show wlan0' | awk '/inet / {split($2,a,"/"); print a[1]}')
MAC:      $(adb shell 'ip addr show wlan0' | awk '/ether/ {print $2}')
Termux:   $(ssh fold7 'whoami')
Packages: $(ssh fold7 'pkg list-installed 2>/dev/null | wc -l')
Repos:    $(ssh fold7 'find ~/atelier -name .git -type d 2>/dev/null | wc -l')
gopass:   v3=$(ssh fold7 'gopass ls --flat v3 2>/dev/null | wc -l') v4=$(ssh fold7 'gopass ls --flat v4 2>/dev/null | wc -l')
EOF

# ── indirect parameter expansion ─────────────────────────
# ${(P)var} — expand variable name stored in another variable
# Used in tmux env push:
for var in WAYLAND_DISPLAY DISPLAY HYPRLAND_INSTANCE_SIGNATURE; do
  tmux setenv "$var" "${(P)var}"
done
# Bash equivalent: ${!var}

# ── glob qualifiers ──────────────────────────────────────
# Files modified in last 24h
ls -la ~/atelier/_bibliotheca/domus-captures/**/*.adoc(.m-1)

# Directories only, sorted by modification time
ls -d ~/atelier/**/*(/:om)

# ── parameter expansion flags ────────────────────────────
# Uppercase: ${(U)var}   Lowercase: ${(L)var}
MAC=${(U)$(adb shell 'ip addr show wlan0' | awk '/ether/ {print $2}')}
echo "MAC: $MAC"

# Split string into array: ${(s:/:)var}
path_parts=(${(s:/:)PWD})
echo "Depth: ${#path_parts}"

# ── =() for writing process sub (zsh only) ──────────────
# Creates a temp file that persists until command finishes
# Useful when tool requires a real file path, not /dev/fd
vimdiff =(ssh fold7 'cat ~/.zshrc') ~/.zshrc

# ── sequences ────────────────────────────────────────────
echo {1..10}             # 1 2 3 4 5 6 7 8 9 10
echo {01..05}            # 01 02 03 04 05 (zero-padded)
echo {a..f}              # a b c d e f
echo {1..20..3}          # 1 4 7 10 13 16 19 (step)

# ── multiple items ───────────────────────────────────────
mkdir -p ~/atelier/{_bibliotheca,_projects/personal,_captures,_vaults}

# Create month directories
mkdir -p docs/modules/ROOT/pages/2026/{01..12}

# Backup before editing
cp ~/.ssh/config{,.bak}
# Expands to: cp ~/.ssh/config ~/.ssh/config.bak

# Rename extension
mv report.{txt,adoc}
# Expands to: mv report.txt report.adoc

# ── cartesian product ───────────────────────────────────
echo {vault,kvm,bind}-{01,02}
# vault-01 vault-02 kvm-01 kvm-02 bind-01 bind-02

# SSH health check across cluster
for host in {vault,kvm,bind}-{01,02}; do
  printf "%-15s " "$host"
  ssh "$host" 'uptime -s' 2>/dev/null || echo "UNREACHABLE"
done

# ── diff two configs ─────────────────────────────────────
diff ~/.ssh/config.d/{20-d000-key-hierarchy,80-d000-hosts}.conf

echo ~                    # /home/evanusmodestus
echo ~root                # /root
echo ~+                   # $PWD (current directory)
echo ~-                   # $OLDPWD (previous directory)

# cd back and forth
cd ~/atelier/_bibliotheca/domus-captures
cd ~/atelier/_projects/personal/dots-quantum
cd ~-                     # back to domus-captures
cd ~-                     # back to dots-quantum

# Use in commands
diff ~+/docs/antora.yml ~-/docs/antora.yml

# ── basic math ───────────────────────────────────────────
echo $(( 8760 / 24 ))        # 365 — hours to days
echo $(( 1024 * 1024 ))      # 1048576 — KB to bytes

# ── variables ────────────────────────────────────────────
local_count=$(git -C ~/atelier/_bibliotheca/domus-captures ls-files | wc -l)
remote_count=$(ssh fold7 'git -C ~/atelier/_bibliotheca/domus-captures ls-files | wc -l')
echo "Delta: $(( local_count - remote_count )) files"

# ── conditional in arithmetic ────────────────────────────
ttl=8
echo "Cert expires in $(( ttl * 3600 )) seconds"

# ── increment/assign ─────────────────────────────────────
count=0
for repo in ~/atelier/_bibliotheca/*/; do (( count++ )); done
echo "Repos: $count"

# ── base conversion ──────────────────────────────────────
echo $(( 16#FF ))             # 255 — hex to decimal
echo $(( 2#11010 ))           # 26 — binary to decimal
echo $(( 8#755 ))             # 493 — octal to decimal (file perms)

# ── defaults ─────────────────────────────────────────────
echo ${PHONE_IP:-10.50.10.145}     # Use default if unset
echo ${EDITOR:=nvim}               # Set AND use default if unset
echo ${VAULT_TOKEN:?Not sourced}   # Error and exit if unset

# ── string manipulation ──────────────────────────────────
file=/home/evanusmodestus/atelier/_bibliotheca/domus-captures/docs/antora.yml
echo ${file##*/}          # antora.yml          (strip longest prefix)
echo ${file%/*}           # .../docs            (strip shortest suffix)
echo ${file%.yml}.json    # ...antora.json      (replace extension)
echo ${file#/home/}       # evanusmodestus/...  (strip prefix)

# ── pattern replacement ──────────────────────────────────
mac="9c:83:06:ce:89:46"
echo ${mac//:/-}          # 9c-83:06:ce:89:46   (first match)
echo ${mac//:/}           # 9c8306ce8946         (all colons removed)
echo ${(U)mac//:/}        # 9C8306CE8946         (zsh: uppercase + strip)

# ── length ───────────────────────────────────────────────
echo ${#mac}              # 17

# ── array slicing (zsh) ─────────────────────────────────
repos=(domus-captures domus-infra-ops dots-quantum domus-nvim secrets)
echo ${repos[1,3]}        # first three
echo ${repos[-1]}         # last element
echo ${#repos}            # count: 5

# ── basic globs ──────────────────────────────────────────
ls ~/atelier/_bibliotheca/domus-*/docs/antora.yml

# ── recursive (zsh **) ──────────────────────────────────
ls ~/atelier/**/*.adoc(.m-1)      # all .adoc modified in last 24h
ls ~/atelier/**/*.adoc(.L+100k)   # all .adoc larger than 100KB

# ── glob qualifiers (zsh) ───────────────────────────────
ls ~/atelier/**/*(/)              # directories only
ls ~/atelier/**/*(.)              # regular files only
ls ~/atelier/**/*(@)              # symlinks only
ls ~/atelier/**/*(.om[1,5])       # 5 most recently modified files

# ── negation ─────────────────────────────────────────────
ls ~/atelier/_bibliotheca/^domus-captures/     # everything except domus-captures (zsh)

# ── null glob (no error on no match) ────────────────────
setopt nullglob
for f in ~/.ssh/id_*.pub; do echo "$f"; done
# Without nullglob, zsh errors: "no matches found"

!!                        # Repeat last command
sudo !!                   # Re-run last command with sudo
!$                        # Last argument of previous command
!^                        # First argument of previous command
!*                        # All arguments of previous command
!grep                     # Last command starting with "grep"
!?vault?                  # Last command containing "vault"
^old^new                  # Replace "old" with "new" in last command
# Example: ran `ssh kvm-01` → type `^01^02` → runs `ssh kvm-02`

# ── safe preview before executing ────────────────────────
!!:p                      # Print last command without running
!grep:p                   # Print last grep command without running

pkg install yq
yq --version

git clone git@github.com:EvanusModestus/gopass-v4.git ~/.local/share/gopass/stores/v4
gopass mounts add v4 ~/.local/share/gopass/stores/v4

gopass sync
gopass ls v4 | head -20

gopass show v4/domains/d000/identity/ssh/github | yq 'keys'
gopass show v4/domains/d000/identity/ssh/github | yq '.credentials.ssh | keys'

gpg --edit-key 28A3183647525597
# setpref AES256 AES192 AES CAST5 3DES SHA512 SHA384 SHA256 SHA224 SHA1 ZIP ZLIB Uncompressed
# save

gpg --export-secret-keys --armor > /tmp/gpg-private.asc
adb push /tmp/gpg-private.asc /sdcard/
rm /tmp/gpg-private.asc

gpg --import ~/storage/shared/gpg-private.asc
rm ~/storage/shared/gpg-private.asc

git clone git@github.com:EvanusModestus/gopass-v3.git ~/.local/share/gopass/stores/v3
gopass mounts add v3 ~/.local/share/gopass/stores/v3
git clone git@github.com:EvanusModestus/gopass-v4.git ~/.local/share/gopass/stores/v4
gopass mounts add v4 ~/.local/share/gopass/stores/v4
gopass sync

adb shell 'ip addr show wlan0' | awk '/inet / {print $2}; /link\/ether/ {print $2}'

cat >> ~/.ssh/config.d/80-d000-hosts.conf << 'EOF'

Host fold7
    HostName 10.50.10.145
    Port 8022
EOF

awk '/fold7/,/^$/' ~/.ssh/config.d/80-d000-hosts.conf

# On VyOS (configure mode):
# set service dhcp-server shared-network-name DATA subnet 10.50.10.0/24 static-mapping zfold7 mac-address 9c:83:06:ce:89:46
# set service dhcp-server shared-network-name DATA subnet 10.50.10.0/24 static-mapping zfold7 ip-address 10.50.10.145

rm ~/.ssh/config.d/80-d000-hosts.conf.age
age -e -R ~/.age/recipients/self.txt -o ~/.ssh/config.d/80-d000-hosts.conf.age ~/.ssh/config.d/80-d000-hosts.conf

ds d000 dev/vault

for node in vault-01 vault-02 vault-03; do
  printf "%-12s " "$node"
  curl -sk "https://$node.inside.domusdigitalis.dev:8200/v1/sys/health" \
    | jq -r '"\(if .sealed then "SEALED" else "unsealed" end)  \(if .standby then "standby" else "ACTIVE" end)  v\(.version)"' \
    2>/dev/null || echo "UNREACHABLE"
done

gopass show v4/domains/d000/identity/vault/cluster 2>/dev/null \
  | sed -n '/^type:/,$ p' | yq -r '.credentials.unseal."key-1"' | wl-copy
vault operator unseal -address="https://<node>.inside.domusdigitalis.dev:8200"
wl-copy ''

gopass show v4/domains/d000/identity/vault/cluster 2>/dev/null \
  | sed -n '/^type:/,$ p' | yq -r '.credentials.unseal."key-2"' | wl-copy
vault operator unseal -address="https://<node>.inside.domusdigitalis.dev:8200"
wl-copy ''

vault status | grep -E 'Sealed|HA Mode|Active Node'
vault token lookup | awk '/display_name|expire_time|policies/'

vault read -format=json pki_int/roles/domus-client \
  | jq '.data | {allowed_domains, organization, ou, key_type, key_bits, max_ttl}'

vault read -field=certificate pki/cert/ca > /tmp/vault-root-ca.pem
vault read -field=certificate pki_int/cert/ca > /tmp/vault-intermediate-ca.pem
openssl x509 -in /tmp/vault-root-ca.pem -noout -subject -dates
openssl x509 -in /tmp/vault-intermediate-ca.pem -noout -subject -issuer -dates
openssl verify -CAfile /tmp/vault-root-ca.pem /tmp/vault-intermediate-ca.pem

vault write -format=json pki_int/issue/domus-client \
  common_name="zfold7.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/zfold7-cert.json

jq -r '.data.certificate' /tmp/zfold7-cert.json > /tmp/zfold7.pem
jq -r '.data.private_key' /tmp/zfold7-cert.json > /tmp/zfold7-key.pem
jq -r '.data.ca_chain[]' /tmp/zfold7-cert.json > /tmp/zfold7-ca-chain.pem

openssl x509 -in /tmp/zfold7.pem -noout -subject -issuer -dates
openssl verify -CAfile /tmp/vault-root-ca.pem -untrusted /tmp/vault-intermediate-ca.pem /tmp/zfold7.pem

openssl pkcs12 -export \
  -in /tmp/zfold7.pem \
  -inkey /tmp/zfold7-key.pem \
  -certfile /tmp/zfold7-ca-chain.pem \
  -out /tmp/zfold7.p12 \
  -name "Domus EAP-TLS"

openssl pkcs12 -in /tmp/zfold7.p12 -info -nokeys 2>/dev/null | grep -E 'subject|issuer'

adb push /tmp/vault-root-ca.pem /sdcard/Download/
adb push /tmp/vault-intermediate-ca.pem /sdcard/Download/
adb push /tmp/zfold7.p12 /sdcard/Download/

adb shell 'ip addr show wlan0' | awk '/link\/ether/{print $2}'

ds d000 dev/vault

vault write -field=signed_key ssh/sign/domus-client \
  public_key=@$HOME/.ssh/id_ed25519_d000.pub \
  valid_principals="<termux-user>,evanusmodestus" \
  cert_type=user > /tmp/zfold7-ssh-cert.pub

ssh-keygen -L -f /tmp/zfold7-ssh-cert.pub

adb push /tmp/zfold7-ssh-cert.pub /sdcard/

cp ~/storage/shared/zfold7-ssh-cert.pub ~/.ssh/id_ed25519-cert.pub
chmod 600 ~/.ssh/id_ed25519-cert.pub
rm ~/storage/shared/zfold7-ssh-cert.pub

gopass edit v4/domains/d000/network/devices/mobile/zfold7

type: "mobile"
hostname: "zfold7"
model: "SM_F966U1"
serial: "R3GYB0J7YHY"
os: "Android + Termux"
mac:
  wifi: "9c:83:06:ce:89:46"
ip: "10.50.10.145"
vlan: "10"
location: "Domus Digitalis"
credentials:
  ssh:
    _use: "Termux sshd — port 8022, ed25519 key"
    port: "8022"
    user: "<termux-user>"
    key_file: "~/.ssh/id_ed25519"
  eap-tls:
    _use: "802.1X WiFi — Vault-issued cert"
    cn: "zfold7.inside.domusdigitalis.dev"
    ca: "Domus Root CA + Intermediate"
    identity: "anonymous@inside.domusdigitalis.dev"
    cert_ttl: "8760h"
network:
  ssid: "Domus-Secure"
  security: "WPA2/WPA3-Enterprise EAP-TLS"
  mac_randomization: "disabled"
pki:
  client_cert_cn: "zfold7.inside.domusdigitalis.dev"
  issuer: "pki_int/issue/domus-client"
  ssh_signer: "ssh/sign/domus-client"
created: "2026-07-01"
updated: "2026-07-01"

gps v4/domains/d000/network/devices/mobile/zfold7 'keys'
gps v4/domains/d000/network/devices/mobile/zfold7 '.credentials | keys'
gps v4/domains/d000/network/devices/mobile/zfold7 -r '.hostname + " (" + .ip + ")"'
gps v4/domains/d000/network/devices/mobile/zfold7 -r '.credentials.ssh.port'
gps v4/domains/d000/network/devices/mobile/zfold7 -r '.mac.wifi'

dsource d000 dev/network/ise
MAC="9C:83:06:CE:89:46"
full-endpoint-profile.sh "$MAC"

rm -f /tmp/zfold7-cert.json /tmp/zfold7.pem /tmp/zfold7-key.pem \
      /tmp/zfold7-ca-chain.pem /tmp/zfold7.p12 /tmp/zfold7-ssh-cert.pub \
      /tmp/vault-root-ca.pem /tmp/vault-intermediate-ca.pem

adb shell 'rm -f /sdcard/Download/vault-root-ca.pem /sdcard/Download/vault-intermediate-ca.pem /sdcard/Download/zfold7.p12'

# All SSH connections from this machine
lsof -i :22 -i :8022

# SSH connections to a specific host
lsof -i @10.50.10.145

# SSH connections by a specific user
lsof -u evanusmodestus -c ssh

# Mux sockets — SSH ControlMaster files
lsof +D ~/.ssh/sockets/

# All established SSH connections
ss -tnp | grep ':22\|:8022'

# Connections to fold7 specifically
ss -tnp dst 10.50.10.145

# Show process info + timer state
ss -tnpo dst 10.50.10.145

# All ESTABLISHED + process name
ss -tnp state established | grep ssh

# Listening sockets (what's accepting connections)
ss -tlnp | grep ssh

# What process holds port 8022 connections
fuser 8022/tcp

# What process has the mux socket open
fuser ~/.ssh/sockets/*10.50.10.145* 2>/dev/null

# lsof — PIDs, file descriptors, connection state
lsof -i @10.50.10.145 -n -P

COMMAND     PID           USER FD   TYPE   DEVICE SIZE/OFF NODE NAME
ssh     3294350 evanusmodestus 4u  IPv4 22617601      0t0  TCP 10.50.1.204:44758->10.50.10.145:8022 (CLOSE_WAIT)
ssh     3688247 evanusmodestus 3u  IPv4 23534403      0t0  TCP 10.50.1.204:52086->10.50.10.145:8022 (ESTABLISHED)
ssh     3725216 evanusmodestus 3u  IPv4 23627288      0t0  TCP 10.50.1.204:45236->10.50.10.145:8022 (ESTABLISHED)
ssh     3727906 evanusmodestus 3u  IPv4 23627288      0t0  TCP 10.50.1.204:45236->10.50.10.145:8022 (ESTABLISHED)

# ss — socket state, timer info, process mapping
ss -tnpo dst 10.50.10.145

State      Recv-Q Send-Q  Local Address:Port    Peer Address:Port  Process
CLOSE-WAIT 1      0         10.50.1.204:44758   10.50.10.145:8022  users:(("ssh",pid=3294350,fd=4))
ESTAB      0      0         10.50.1.204:45236   10.50.10.145:8022  users:(("ssh",pid=3727906,fd=3),("ssh",pid=3725216,fd=3))
ESTAB      0      0         10.50.1.204:52086   10.50.10.145:8022  users:(("ssh",pid=3688247,fd=3))

# fuser — just PIDs for a port (local listeners only — empty here because we're the client)
fuser 8022/tcp

# lsof approach — kill only CLOSE_WAIT PIDs
lsof -i @10.50.10.145 -n -P | awk '/CLOSE_WAIT/ {print $2, $NF}'
kill $(lsof -i @10.50.10.145 -n -P | awk '/CLOSE_WAIT/ {print $2}')

# ss approach — extract PID from CLOSE_WAIT using awk match() capture group
kill $(ss -tnp dst 10.50.10.145 | awk '/CLOSE-WAIT/ {match($0,/pid=([0-9]+)/,a); print a[1]}')

# Verify dead session is gone
lsof -i @10.50.10.145 -n -P | awk '/CLOSE_WAIT/ {print $2}' && echo "STILL ALIVE" || echo "CLEAN"

# 1. Inspect — what are we about to kill?
lsof -i @10.50.10.145 -n -P

# 2. Kill only dead sessions (CLOSE_WAIT)
kill $(lsof -i @10.50.10.145 -n -P | awk '/CLOSE_WAIT/ {print $2}')

# 3. If killing ALL sessions — graceful SIGTERM first
kill $(lsof -i @10.50.10.145 -t)

# 4. Verify
lsof -i @10.50.10.145 -t && echo "STILL ALIVE" || echo "CLEAN"

# 5. Force only if graceful failed — SIGKILL (no cleanup, mux socket orphaned)
kill -9 $(lsof -i @10.50.10.145 -t) 2>/dev/null

# 6. Clean up orphaned mux sockets after force kill
rm -f ~/.ssh/sockets/*10.50.10.145* 2>/dev/null

# Get PIDs with context — identify master vs child
lsof -i @10.50.10.145 -n -P | awk 'NR>1 {printf "PID %-8s DEVICE %-10s %-12s %s\n", $2, $8, $NF, $9}'

# Kill mux master (children die automatically)
kill $(lsof -i @10.50.10.145 -n -P | awk '/ESTABLISHED/ {print $2}' | sort -u | head -1)

# Kill all except the newest session
kill $(lsof -i @10.50.10.145 -t | sort -n | head -n -1)

# Kill only sessions older than the mux master (stale pre-mux connections)
kill $(lsof -i @10.50.10.145 -n -P | awk '/CLOSE_WAIT/ || /ESTABLISHED/ && $8 != latest_device {print $2}')

echo "=== SSH processes ===" && \
lsof -c ssh -i @10.50.10.145 -n -P 2>/dev/null && \
echo "" && echo "=== Socket state ===" && \
ss -tnpo dst 10.50.10.145 && \
echo "" && echo "=== Mux sockets ===" && \
ls -la ~/.ssh/sockets/*10.50.10.145* 2>/dev/null || echo "none"

~.        # Disconnect (must be first char on a new line — hit Enter first)
~?        # List all escape sequences
~#        # List forwarded connections
~C        # Open command line (add/remove port forwards)
~&        # Background SSH (when waiting for connections to close)

ds d000 dev/vault
vault write -field=signed_key ssh/sign/domus-client \
  public_key=@$HOME/.ssh/id_ed25519_vault.pub \
  valid_principals="Administrator,admin,adminerosado,ansible,evanusmodestus,gabriel,root,u0_a385" \
  cert_type=user | tee ~/.ssh/id_ed25519_vault-cert.pub > /dev/null

ssh-keygen -L -f ~/.ssh/id_ed25519_vault-cert.pub | grep -A 15 'Principals'

cat ~/.local/bin/vault-ssh-sign
# Find the valid_principals line and add u0_a385, remove u0_a361

# Kill stuck sessions + stale sockets
kill $(lsof -i @10.50.10.145 -t) 2>/dev/null
rm -f ~/.ssh/sockets/*10.50.10.145* 2>/dev/null
ssh -v fold7 2>&1 | grep -E 'Offering|Accepted'

ls ~/atelier/_bibliotheca/domus-asciidoc-build/

pkg install ruby
gem install asciidoctor asciidoctor-pdf asciidoctor-diagram

# Adjust based on where build-adoc lives
ln -sf ~/atelier/_bibliotheca/domus-asciidoc-build/build-adoc ~/bin/build-adoc

build-adoc $(find ~/atelier/_bibliotheca/domus-captures/data -maxdepth 3 -name '*.adoc' | head -1) html --variant light-cyan

# The chain:
on-timeout  → brightnessctl -s set 0     ← saves + dims (works initially)
on-resume   → brightnessctl -r            ← restore fails — permission denied, silent
lid close   → brightnessctl -s set 0      ← same
lid open    → brightnessctl -r            ← same silent failure

# Current permissions — user has no write access
-rw-r--r-- root root /sys/class/backlight/intel_backlight/brightness

# 1. Add user to video group
sudo usermod -aG video evanusmodestus

# 2. Create udev rule — sets backlight group to video with g+w on boot
echo 'ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chgrp video /sys/class/backlight/%k/brightness", RUN+="/bin/chmod g+w /sys/class/backlight/%k/brightness"' \
  | sudo tee /etc/udev/rules.d/90-backlight.rules

# Confirm group membership
groups | grep video

# Confirm permissions changed
ls -la /sys/class/backlight/intel_backlight/brightness
# Should show: -rw-rw-r-- root video

# Confirm brightnessctl works without sudo
brightnessctl set 50%
brightnessctl set 100%

# Timeout dimming (saves + restores)
on-timeout = brightnessctl -s set 10%
on-resume = brightnessctl -r

# Deep sleep — full blackout
on-timeout = brightnessctl -s set 0
on-resume = brightnessctl -r

# Lid switch — lock + blackout / restore
bindl = , switch:on:Lid Switch, exec, loginctl lock-session && brightnessctl -s set 0
bindl = , switch:off:Lid Switch, exec, brightnessctl -r

# Manual brightness keys
bindle = , XF86MonBrightnessUp, exec, brightnessctl set +5%
bindle = , XF86MonBrightnessDown, exec, brightnessctl set 5%-

# Sleep resume — re-enable monitor
after_sleep_cmd = hyprctl keyword monitor "eDP-1, preferred, auto, 2" && hyprctl dispatch dpms on

# Quick fix — needs sudo
sudo brightnessctl set 50%

# Hyprland DPMS toggle (if compositor issue, not backlight)
hyprctl dispatch dpms off eDP-1 && sleep 1 && hyprctl dispatch dpms on eDP-1

# Force mode reset
hyprctl keyword monitor eDP-1,3200x2000@60,0x0,2
hyprctl dispatch focusmonitor eDP-1

hyprctl monitors -j | jq -r '.[] | "\(.name)  dpms=\(.dpmsStatus)  focused=\(.focused)  \(.width)x\(.height)@\(.refreshRate)"'
brightnessctl info

#!/bin/bash
# steam-safe — launch Steam with unprivileged user namespaces enabled,
#              disable them again on exit.
#
# Why: Steam requires kernel.unprivileged_userns_clone=1 for its sandbox.
#      This machine disables it by default (99-hardening.conf) because
#      user namespaces have been a privilege escalation vector:
#        - CVE-2022-0185: heap overflow via user namespace
#        - CVE-2023-2640: Ubuntu OverlayFS user namespace escalation
#      This script limits the exposure window to the Steam session only.

set -euo pipefail

enable_userns() { sudo sysctl -q -w kernel.unprivileged_userns_clone=1; }
disable_userns() { sudo sysctl -q -w kernel.unprivileged_userns_clone=0; }

# Ensure we disable on exit, even if Steam crashes
trap disable_userns EXIT

echo "[steam-safe] Enabling unprivileged user namespaces..."
enable_userns

echo "[steam-safe] Launching Steam..."
/usr/bin/steam "$@"

# trap EXIT handles disable_userns
echo "[steam-safe] Steam exited. User namespaces disabled."

# Create the script
cat > ~/.local/bin/steam-safe << 'SCRIPT'
#!/bin/bash
set -euo pipefail
enable_userns() { sudo sysctl -q -w kernel.unprivileged_userns_clone=1; }
disable_userns() { sudo sysctl -q -w kernel.unprivileged_userns_clone=0; }
trap disable_userns EXIT
echo "[steam-safe] Enabling unprivileged user namespaces..."
enable_userns
echo "[steam-safe] Launching Steam..."
/usr/bin/steam "$@"
echo "[steam-safe] Steam exited. User namespaces disabled."
SCRIPT

# Make executable
chmod +x ~/.local/bin/steam-safe

# Verify
which steam-safe && steam-safe --help 2>&1 | head -3

# Confirm multilib is enabled
grep -A1 '^\[multilib\]' /etc/pacman.conf

# Confirm NVIDIA driver stack + Vulkan (no conflicting drivers)
pacman -Q nvidia-open nvidia-utils lib32-nvidia-utils vulkan-icd-loader lib32-vulkan-icd-loader

# Confirm locale
locale -a | grep -i en_US

# Confirm vm.max_map_count
sysctl vm.max_map_count

# Confirm unprivileged user namespaces
sysctl kernel.unprivileged_userns_clone

# Confirm AppArmor is active
systemctl is-active apparmor && aa-enabled

# Before — confirm not installed
pacman -Q steam 2>/dev/null && echo "Already installed" || echo "Ready to install"

# Install Steam (lib32-vulkan-icd-loader already present)
sudo pacman -S steam

# After — verify
pacman -Q steam

# Launch Steam, log in, let it update, then close
steam

# After Steam first launch, record home directory footprint
du -sh ~/.local/share/Steam/ ~/.steam/

# AppArmor profile for Steam (Arch Linux, pacman install)
# Replaces the default unconfined placeholder.
# Strategy: allow Steam's own directories + GPU/audio/input + network.
#           Deny access to sensitive dotfiles and credential stores.

abi <abi/4.0>,
include <tunables/global>

profile steam /usr/{lib/steam/bin_steam.sh,games/steam} flags=(complain) { (1)
  include <abstractions/base>
  include <abstractions/fonts>
  include <abstractions/nameservice>
  include <abstractions/dbus-session-strict>
  include <abstractions/audio>
  include <abstractions/vulkan>
  include <abstractions/mesa>

  # ── User namespaces (Steam requires this) ──
  userns,

  # ── Network (multiplayer, downloads, auth) ──
  network inet stream,
  network inet dgram,
  network inet6 stream,
  network inet6 dgram,
  network unix stream,
  network unix dgram,

  # ── Steam's own directories ──
  owner @{HOME}/.local/share/Steam/** rwkl,
  owner @{HOME}/.steam/** rwkl,
  owner @{HOME}/.steampath r,
  owner @{HOME}/.steampid r,

  # ── Game content (GMod addons, saves, configs) ──
  owner @{HOME}/.local/share/Garry's Mod/** rwk,

  # ── Steam runtime and Proton ──
  /usr/lib/steam/** rmix,
  /usr/share/steam/** r,
  /tmp/.X11-unix/** rw,
  /tmp/steam* rwk,
  /tmp/dumps/** rwk,
  /tmp/proton_* rwk,
  owner /tmp/vdpau-drivers-* rw,

  # ── GPU access (NVIDIA) ──
  /dev/nvidia* rw,
  /dev/dri/** rw,
  /dev/shm/** rwk,
  /proc/driver/nvidia/** r,
  /sys/devices/pci**/{vendor,device,class,config,resource*} r,
  /sys/class/drm/** r,
  /usr/lib/libGL*.so* rm,
  /usr/lib/libEGL*.so* rm,
  /usr/lib/libvulkan*.so* rm,
  /usr/lib/libnvidia*.so* rm,
  /usr/lib32/lib*.so* rm,

  # ── System reads Steam needs ──
  /etc/machine-id r,
  /etc/hostname r,
  /etc/hosts r,
  /etc/resolv.conf r,
  /etc/nsswitch.conf r,
  /etc/ld.so.cache r,
  /etc/ld.so.preload r,
  /proc/ r,
  /proc/** r,
  /sys/devices/system/cpu/** r,
  /sys/fs/cgroup/** r,
  owner /proc/*/fd/ r,
  owner /proc/*/maps r,

  # ── Input devices (controllers, keyboard for games) ──
  /dev/input/** rw,
  /dev/uinput rw,
  /run/udev/data/** r,
  /sys/class/input/** r,

  # ── Shared libraries ──
  /usr/lib/** rm,
  /usr/lib32/** rm,

  # ── XDG desktop integration ──
  owner @{HOME}/.config/unity3d/** rwk,
  owner @{HOME}/.config/cef_user_data/** rwk,

  # ── Deny sensitive paths explicitly ── (2)
  deny @{HOME}/.ssh/** rwklx,
  deny @{HOME}/.gnupg/** rwklx,
  deny @{HOME}/.age/** rwklx,
  deny @{HOME}/.config/gopass/** rwklx,
  deny @{HOME}/.local/share/gopass/** rwklx,
  deny @{HOME}/.secrets/** rwklx,
  deny @{HOME}/.claude/** rwklx,
  deny @{HOME}/.aws/** rwklx,
  deny @{HOME}/.kube/** rwklx,
  deny @{HOME}/.vault-token rwklx,
  deny @{HOME}/.netrc rwklx,
  deny @{HOME}/.gitconfig rwklx,

  # Site-specific overrides
  include if exists <local/steam>
}

# Parse the profile for syntax errors
sudo apparmor_parser -Q /etc/apparmor.d/steam

# Load the profile
sudo apparmor_parser -r /etc/apparmor.d/steam

# Verify it loaded in complain mode
sudo aa-status | grep steam

# Check for AppArmor denials (complain mode logs as ALLOWED but flags them)
sudo dmesg | grep -i 'apparmor.*steam' | tail -20

# Or use the audit log
sudo journalctl -k | grep -i 'apparmor.*steam' | tail -20

# Edit the profile: change flags=(complain) to flags=(enforce)
sudo sed -i 's/flags=(complain)/flags=(enforce)/' /etc/apparmor.d/steam

# Verify the change
awk '/^profile steam/' /etc/apparmor.d/steam

# Reload
sudo apparmor_parser -r /etc/apparmor.d/steam
sudo aa-status | grep steam

# Remove Steam and any dependencies that nothing else needs
sudo pacman -Rns steam

# Check if lib32-vulkan-icd-loader is still needed by anything else
pactree -r lib32-vulkan-icd-loader
# If only Steam needed it:
sudo pacman -Rns lib32-vulkan-icd-loader

rm ~/.local/bin/steam-safe

# See what Steam left behind
du -sh ~/.local/share/Steam/ ~/.steam/ ~/.config/unity3d/ 2>/dev/null

# Remove it
rm -rf ~/.local/share/Steam/ ~/.steam/ ~/.steampath ~/.steampid
rm -rf ~/.config/unity3d/
rm -rf ~/.config/cef_user_data/

# Remove desktop entries Steam may have created
rm -f ~/.local/share/applications/steam*.desktop
rm -f ~/.local/share/icons/hicolor/*/apps/steam*.png 2>/dev/null

# Verify nothing remains
find ~ -maxdepth 3 -iname '*steam*' -not -path '*/.local/share/Trash/*' 2>/dev/null

# Unload the profile from the kernel
sudo apparmor_parser -R /etc/apparmor.d/steam

# Remove the profile file and backup
sudo rm /etc/apparmor.d/steam /etc/apparmor.d/steam.unconfined.bak

# Remove local overrides if any were created
sudo rm -f /etc/apparmor.d/local/steam

# Verify
sudo aa-status | grep steam  # should return nothing

# No steam packages
pacman -Q | grep -i steam

# No steam processes
pgrep -a steam

# No steam files in home
find ~ -maxdepth 3 -iname '*steam*' 2>/dev/null

# No apparmor profile
ls /etc/apparmor.d/steam 2>/dev/null

# User namespaces still hardened
sysctl kernel.unprivileged_userns_clone  # should be 0

# No wrapper script
which steam-safe 2>/dev/null  # should return nothing

# Check what Steam is loading from its runtime vs system
for i in $(pgrep steam); do
  awk '/\.local/{print $NF}' /proc/$i/maps
done | sort -u

# If a game crashes, check its specific library requirements
ldd ~/.steam/root/steamapps/common/<GAME>/game_executable 2>&1 | grep 'not found'

# Should show ONLY nvidia-related vulkan packages, no intel/amd
pacman -Q | grep -i vulkan
# Expected: vulkan-icd-loader, lib32-vulkan-icd-loader (loaders only — drivers come from nvidia-utils)

# Capture Steam output for debugging
steam 2>&1 | tee /tmp/steam-debug-$(date +%F).log

# Real-time AppArmor denial monitoring
sudo dmesg -w | grep --line-buffered 'apparmor.*DENIED'

# Or check journal
sudo journalctl -k --since "1 hour ago" | grep -i 'apparmor.*steam'

sudo aa-complain /etc/apparmor.d/steam
# Test Steam, then re-enforce:
sudo aa-enforce /etc/apparmor.d/steam

-- GABRIEL'S COMMAND SYSTEM
-- Type !help in chat to see all commands

local COMMANDS = {} (1)

-- Register a command: name, function, description
local function RegisterCommand(name, fn, desc) (2)
    COMMANDS[name] = {run = fn, help = desc}
end

-- ── Commands ──

RegisterCommand("spawn", function(ply, args) (3)
    local npcType = args[1] or "npc_zombie"
    local count = tonumber(args[2]) or 1
    count = math.Clamp(count, 1, 10) (4)

    for i = 1, count do
        local npc = ents.Create(npcType)
        if IsValid(npc) then
            local pos = ply:GetEyeTrace().HitPos + Vector(0, 0, 10) (5)
                      + Vector(math.random(-50, 50), math.random(-50, 50), 0)
            npc:SetPos(pos)
            npc:Spawn()
        end
    end
    ply:ChatPrint("[CMD] Spawned " .. count .. "x " .. npcType)
end, "!spawn <npc_type> <count> — spawn NPCs where you look")

RegisterCommand("god", function(ply, args)
    if ply:HasGodMode() then
        ply:GodDisable()
        ply:ChatPrint("[CMD] God mode OFF")
    else
        ply:GodEnable()
        ply:ChatPrint("[CMD] God mode ON")
    end
end, "!god — toggle god mode")

RegisterCommand("speed", function(ply, args)
    local mult = tonumber(args[1]) or 2
    mult = math.Clamp(mult, 0.5, 10)
    ply:SetRunSpeed(500 * mult) (6)
    ply:SetWalkSpeed(200 * mult)
    ply:ChatPrint("[CMD] Speed set to " .. mult .. "x")
end, "!speed <multiplier> — change move speed")

RegisterCommand("cleanup", function(ply, args)
    local removed = 0
    for _, ent in ipairs(ents.GetAll()) do
        if ent:IsNPC() then
            ent:Remove()
            removed = removed + 1
        end
    end
    ply:ChatPrint("[CMD] Removed " .. removed .. " NPCs")
end, "!cleanup — remove all NPCs")

RegisterCommand("help", function(ply, args)
    ply:ChatPrint("── Gabriel's Commands ──")
    for name, cmd in SortedPairs(COMMANDS) do
        ply:ChatPrint("  " .. cmd.help)
    end
end, "!help — show this list")

-- ── The Hook — this connects chat to our commands ── (7)

hook.Add("PlayerSay", "GabrielCommands", function(ply, text)
    if text:sub(1, 1) ~= "!" then return end (8)

    local parts = string.Explode(" ", text) (9)
    local cmdName = parts[1]:sub(2):lower()  -- strip the "!" and lowercase
    table.remove(parts, 1)                   -- remaining parts are arguments

    local cmd = COMMANDS[cmdName]
    if cmd then
        cmd.run(ply, parts)
        return "" (10)
    else
        ply:ChatPrint("[CMD] Unknown command. Type !help")
    end
end)

print("[GABRIEL] Command system loaded! Type !help in chat.")

-- GABRIEL'S NPC SPAWNER
-- Spawns NPCs with custom AI behaviors

local function SpawnFollower(ply) (1)
    local npc = ents.Create("npc_citizen")
    if not IsValid(npc) then return end

    npc:SetPos(ply:GetEyeTrace().HitPos + Vector(0, 0, 10))
    npc:SetKeyValue("spawnflags", "256") -- long visibility, won't go far
    npc:Spawn()
    npc:Activate()

    -- Make it follow the player
    npc:SetSchedule(SCHED_TARGET_CHASE) (2)
    npc:SetTarget(ply)

    -- Give it a name tag
    npc.GabrielName = "Follower #" .. math.random(100, 999)

    -- Reacquire target every 3 seconds (3)
    timer.Create("follow_" .. npc:EntIndex(), 3, 0, function()
        if IsValid(npc) and IsValid(ply) then
            npc:SetTarget(ply)
            npc:SetSchedule(SCHED_TARGET_CHASE)
        else
            timer.Remove("follow_" .. npc:EntIndex())
        end
    end)

    ply:ChatPrint("[NPC] " .. npc.GabrielName .. " is now following you!")
    return npc
end

local function SpawnPatroller(ply) (4)
    local npc = ents.Create("npc_combine_s")
    if not IsValid(npc) then return end

    local origin = ply:GetEyeTrace().HitPos + Vector(0, 0, 10)
    npc:SetPos(origin)
    npc:Give("weapon_smg1")
    npc:Spawn()
    npc:Activate()

    npc.GabrielName = "Patrol #" .. math.random(100, 999)
    npc.PatrolPoints = {} (5)

    -- Generate a square patrol route around spawn point
    local radius = 300
    local points = {
        origin + Vector(radius, 0, 0),
        origin + Vector(0, radius, 0),
        origin + Vector(-radius, 0, 0),
        origin + Vector(0, -radius, 0),
    }

    local currentPoint = 1
    timer.Create("patrol_" .. npc:EntIndex(), 4, 0, function()
        if not IsValid(npc) then
            timer.Remove("patrol_" .. npc:EntIndex())
            return
        end
        npc:SetLastPosition(points[currentPoint]) (6)
        npc:SetSchedule(SCHED_FORCED_GO_RUN)
        currentPoint = currentPoint % #points + 1 (7)
    end)

    ply:ChatPrint("[NPC] " .. npc.GabrielName .. " patrolling (radius " .. radius .. ")")
    return npc
end

-- Wire into the command system if it exists
hook.Add("PlayerSay", "GabrielNPCSpawner", function(ply, text)
    if text == "!follow" then
        SpawnFollower(ply)
        return ""
    elseif text == "!patrol" then
        SpawnPatroller(ply)
        return ""
    end
end)

print("[GABRIEL] NPC Spawner loaded! Commands: !follow, !patrol")