#!/bin/bash
# Clean agent scratch on koopa host (/root, /home/hernani, /tmp) + taler containers.
# KEEP: passwords, koopa-admin-log, user media, container configs/data/logs essential.
# Run as root on koopa.
set +e
[ "$(id -u)" -eq 0 ] || { echo "root only"; exit 1; }
OUT="${1:-/tmp/cleanup-koopa-all.out}"
exec > >(tee "$OUT") 2>&1
n=0
rmf() {
  for f in "$@"; do
    [ -e "$f" ] || [ -L "$f" ] || continue
    rm -rf -- "$f" && n=$((n+1)) && echo "RM $f"
  done
}

echo "=== A. /tmp agent files ==="
# delete known agent patterns only (not systemd private dirs)
find /tmp -maxdepth 1 -type f \( \
  -name 'bench-*' -o -name 'settle-*' -o -name 'extreme-*' -o -name 'deploy-*' \
  -o -name 'force-*' -o -name 'fix-*' -o -name 'fix2*' -o -name 'wd*' \
  -o -name 'ord*' -o -name 'ex-*' -o -name 'tok*' -o -name 'facade*' \
  -o -name 'rev*' -o -name 'acc*' -o -name 'acw*' -o -name 'at.*' \
  -o -name 'et-*' -o -name '*settle*' -o -name '*wire*' -o -name '*offline*' \
  -o -name '*denom*' -o -name '*probe*' -o -name '*diag*' -o -name '*e2e*' \
  -o -name 'oid*' -o -name 'otok*' -o -name 'wuri*' -o -name 'wid*' \
  -o -name 'pay*' -o -name 'mk-*' -o -name 'koopa-*' -o -name 'incont*' \
  -o -name 'in-container*' -o -name 'credit*' -o -name 'apply-*' -o -name 'tos*' \
  -o -name 'redeploy*' -o -name 'ensure*' -o -name 'xfer*' -o -name 'tpl*' \
  -o -name 'future-keys.json' -o -name 'signed-keys.json' -o -name 'keys.json' \
  -o -name 'ex-acc*' -o -name 'bpw*' -o -name 'mpw*' -o -name 'wg*' \
  -o -name 'cleanup-*' -o -name 'koopa-clean-*' -o -name 'force-confirm*' \
  -o -name 'denom-probe*' -o -name 'deploy-large*' -o -name 'bench-setup*' \
  -o -name '*.out' -o -name '*.sh' -o -name '*.json' -o -name '*.sql' \
  -o -name '*.uri' \
  \) -print -delete 2>/dev/null
# leftover txt from agent (not system)
find /tmp -maxdepth 1 -type f -name '*.txt' \( -user root -o -user hernani \) -print -delete 2>/dev/null
echo "tmp files left: $(find /tmp -maxdepth 1 -type f 2>/dev/null | wc -l)"

echo "=== B. /root loose agent files (keep *password*) ==="
for f in /root/*; do
  base=$(basename "$f")
  [ -e "$f" ] || continue
  case "$base" in
    *password*|*secret*|koopa-admin-log|.ssh|.bashrc|.profile|.bash_history)
      echo "KEEP $f"; continue ;;
  esac
  # keep directories that look like system (not agent one-offs)
  if [ -d "$f" ]; then
    case "$base" in
      koopa-admin-log|go|.cache|.config|.local) echo "KEEP dir $f"; continue ;;
    esac
    # only remove empty agent-looking dirs
    continue
  fi
  case "$base" in
    *.sh|*.out|*.json|*.uri|*.py|*.sql|*.log|*.conf)
      rmf "$f" ;;
    c1|chk-order|mk-order|d3|d4|d5|d6|d7|d8|dd|dd2|f1|fdo|fsn|ps|rl|sc|ss|ww4)
      rmf "$f" ;;
  esac
done
rmf /root/.tmp /root/.tmp-cleanup

echo "=== C. /home/hernani agent staging ==="
H=/home/hernani
rmf "$H/ex-acc.secret.conf" "$H/ex-acc2.secret.conf"
rmf "$H/bank-bench-fat-password.txt"
find "$H" -maxdepth 1 -type f \( \
  -name '*.sh' -o -name '*.out' -o -name '*.json' -o -name '*.uri' -o -name '*.sql' \
  -o -name 'ex-acc*' -o -name 'exchange-coins.conf' -o -name 'bench-*' \
  -o -name 'oid-*' -o -name 'otok-*' -o -name 'wuri.txt' -o -name 'wid.txt' \
  -o -name 'pay*.uri' -o -name 'e2e-*' -o -name 'd[0-9]*' -o -name 'f[0-9]*' \
  -o -name 'ww*' -o -name 'dd*' -o -name 'fix-*' -o -name 'mk-*' \
  -o -name 'cycle-*' -o -name 'inside-*' -o -name 'curl' -o -name 'et-long.json' \
  -o -name 'find-delay*' -o -name 'deploy-delays*' -o -name 'offline-sign*' \
  -o -name 'in-container*' -o -name 'facade*' -o -name '*password*' \
  \) -print -delete 2>/dev/null
# chown anything we might have left wrong
chown -R hernani:hernani "$H" 2>/dev/null || true

echo "=== D. containers (tmp/scratch only) ==="
# list
su - hernani -c 'podman ps --format "{{.Names}}"' | tee /tmp/pod-names.txt
while read -r c; do
  [ -n "$c" ] || continue
  echo "--- clean container $c ---"
  su - hernani -c "podman exec -u root $c bash -c '
    set +e
    # agent scratch in /tmp and /root
    find /tmp -maxdepth 1 -type f \( -name \"*.out\" -o -name \"*.sh\" -o -name \"*.json\" -o -name \"future-keys.json\" -o -name \"signed-keys.json\" -o -name \"bench*\" -o -name \"settle*\" -o -name \"facade*\" -o -name \"ex-acc*\" -o -name \"wd*\" -o -name \"ord*\" -o -name \"tpl*\" -o -name \"keys.json\" -o -name \"in-container*\" -o -name \"offline*\" \) -delete 2>/dev/null
    find /root -maxdepth 1 -type f \( -name \"*.out\" -o -name \"*.sh\" -o -name \"*.json\" -o -name \"in-container*\" -o -name \"offline-sign*\" -o -name \"bench*\" -o -name \"facade*\" \) ! -name \".bashrc\" ! -name \".profile\" -delete 2>/dev/null
    # never delete /etc configs, /var/lib data, password secrets under /etc
    echo tmp_files=\$(find /tmp -maxdepth 1 -type f 2>/dev/null | wc -l)
    echo root_loose=\$(find /root -maxdepth 1 -type f 2>/dev/null | wc -l)
  '" 2>&1 | tail -20
done < /tmp/pod-names.txt

echo "=== E. summary host ==="
echo "root:"; ls -la /root | head -40
echo "hernani top:"; ls -la /home/hernani | head -30
echo "tmp count: $(find /tmp -maxdepth 1 -type f 2>/dev/null | wc -l)"
echo "passwords:"; ls -la /root/*password* 2>/dev/null
echo "n_rm_hostish=$n"
echo CLEAN_ALL_OK