#!/usr/bin/env bash
# 60-sanity — final read-only report + recommended manual actions.

step_name="sanity"
step_desc="report system state + suggest manual follow-ups"
step_run="run_sanity"

run_sanity() {
  log "sanity report"

  echo "  distribution : $DISTRO"
  echo "  arch         : $ARCH"
  echo "  user         : $USER (shell: $(getent passwd "$USER" | cut -d: -f7))"
  echo "  uptime       : $(uptime -p 2>/dev/null || uptime)"
  echo "  memory       : $(free -h | awk '/^Mem/ {print $2}') total"
  echo "  swap         : $(swapon --show 2>/dev/null | awk 'NR>1{print $3; found=1} END{if(!found) print "none"}')"
  echo "  timezone     : $(timedatectl show -p Timezone --value 2>/dev/null || cat /etc/timezone 2>/dev/null || echo '?')"
  echo "  hostname     : $(hostname)"
  echo "  locale       : $(locale 2>/dev/null | awk -F= '/^LANG/ {print $2}')"
  echo "  ufw          : $(sudo_ ufw status 2>/dev/null | head -1 || echo 'not installed')"
  echo "  fail2ban     : $(sudo_ fail2ban-client status 2>/dev/null | head -2 || echo 'not running')"
  echo "  docker       : $(docker --version 2>/dev/null || echo 'not installed')"

  echo
  log "recommended manual follow-ups:"
  cat <<'EOF'
  - Test a fresh SSH login (new session) before closing the current one,
    especially after ssh hardening.
  - If you use keys: confirm your public key is in ~/.ssh/authorized_keys
    for the target user.
  - Fill ~/.config/zsh/aliases-extras.zsh with your personal aliases.
  - Add starship config if you want a custom prompt: starship preset list
    (defaults ship with the bootstrap).
  - Consider 'newgrp docker' or re-login to activate the docker group.
  - Install domain + TLS for angie separately (certbot/acme.sh), not handled here.
EOF
  ok "bootstrap sanity report done."
}