import json, subprocess, pathlib, hashlib, os
os.umask(0o077)
root=pathlib.Path('/backup/contextra/deployment-inbox/icerti-incremental-20260921-r01')
root.mkdir(mode=0o700)
def call(*a): return subprocess.check_output(a,text=True,timeout=30)
items=json.loads(call('docker','inspect',*call('docker','ps','-aq').split()))
safe={c['Name']:dict(id=c['Id'],image=c['Image'],started=c['State']['StartedAt']) for c in items}
(root/'containers-before.json').write_text(json.dumps(safe,indent=2))
analytics=next(c for c in items if c['Name']=='/contextra-icerti-analytics-1')
compose=pathlib.Path(analytics['Config']['Labels']['com.docker.compose.project.config_files'])
cfg=json.loads(compose.read_text())
(root/'compose-before.private.json').write_text(compose.read_text())
protected={}
for parent in ['/data/contextra/site/bridge','/data/contextra/site/tls','/data/contextra/site/redis']:
    for p in pathlib.Path(parent).rglob('*'):
        if p.is_file(): protected[str(p)]=hashlib.sha256(p.read_bytes()).hexdigest()
(root/'protected-hashes.json').write_text(json.dumps(protected))
print(json.dumps({'compose':str(compose),'services':{k:{'environment_keys':list(v.get('environment',{})),
    'image':v.get('image'),'ports':v.get('ports'),'entrypoint':v.get('entrypoint'),
    'memory':v.get('mem_limit')} for k,v in cfg['services'].items()},'state':{
    p.name:json.loads(p.read_text()) for p in pathlib.Path('/opt/contextra/state').glob('active.json')},
    'template_keys':list(json.loads(pathlib.Path('/data/contextra/site/camera-template.json').read_text())),
    'runtime_files':[str(p) for p in pathlib.Path('/data/contextra/runtime').rglob('*') if p.is_file()]},indent=2))