# Check all pod status
make status

# Validate all service health endpoints
make validate

# View overall system state
podman pod ps
podman ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# Stream logs for a specific pod
make logs POD=core
make logs POD=database
make logs POD=temporal

# Tail specific container logs
podman logs -f --tail 100 aegis-core-aegis-runtime
podman logs -f --tail 100 aegis-database-postgres

# Search logs for errors
podman logs aegis-core-aegis-runtime 2>&1 | grep -i error

1. pod-database (PostgreSQL)         <- Everything depends on this
   +-- 2. pod-secrets (OpenBao)      <- Core needs secrets
       +-- 3. pod-iam (Keycloak)     <- Needs PostgreSQL
           +-- 4. pod-core           <- Needs DB, secrets, optionally IAM
               |-- 5. pod-temporal   <- Worker needs core gRPC
               |-- 6. pod-storage    <- Core connects to filer
               +-- 7. pod-seal-gateway <- Needs DB, Podman socket
8. pod-observability                  <- Independent, but needs targets running

# Check logs
make logs POD=core

# Common causes:
# 1. Database unreachable
podman exec aegis-database-postgres pg_isready -U aegis

# 2. Invalid aegis-config.yaml
# Look for YAML parse errors in logs

# 3. SEAL keys not generated
ls -la /path/to/seal-keys/
make generate-keys  # if missing

# Check if database is running
podman pod ps | grep database

# Check PostgreSQL logs
podman logs aegis-database-postgres

# Test connectivity
podman exec aegis-database-postgres pg_isready -U aegis

# Common fix: ensure pod-database started before pod-core
make redeploy POD=database
sleep 10
make redeploy POD=core

# Check Temporal health
podman exec aegis-temporal-temporal temporal operator cluster health

# Check Temporal logs
podman logs aegis-temporal-temporal

# Verify Temporal UI is accessible
curl -s http://localhost:8233 | head -1

# Check Podman socket
ls -la /run/user/$(id -u)/podman/podman.sock

# Verify socket is active
systemctl --user status podman.socket

# Check if images are available
podman images | grep python

# Test manual container creation
podman run --rm python:3.11-slim python -c "print('ok')"

# Check AEGIS network exists
podman network ls | grep aegis

# Check NFS port is listening
ss -tlnp | grep 2049

# Verify from container perspective
podman run --rm --network aegis-network alpine ping -c1 host.containers.internal

# Check runtime logs for NFS errors
make logs POD=core | grep -i nfs

# Check seal status
curl -s http://localhost:8200/v1/sys/health | jq .sealed

# If sealed, unseal with your keys
# See: Disaster Recovery guide

# Check Keycloak logs
podman logs aegis-iam-keycloak

# Common cause: database not available when Keycloak started
make redeploy POD=iam

# Verify health
curl -s http://localhost:8180/health/ready | jq

# Check pod network connectivity
podman exec aegis-core-aegis-runtime curl -s http://aegis-database:5432 || echo "expected - not HTTP"
podman exec aegis-core-aegis-runtime curl -s http://aegis-temporal:7233 || echo "expected - not HTTP"

# DNS resolution within pods
podman exec aegis-core-aegis-runtime getent hosts aegis-database

# Check network
podman network inspect aegis-network

# Check disk usage
df -h
podman system df

# Check memory usage per container
podman stats --no-stream

# Clean up unused images and containers
podman system prune -f

# Check PostgreSQL connections
podman exec aegis-database-postgres psql -U aegis -c "SELECT count(*) FROM pg_stat_activity;"

# System info
uname -a
podman version
podman info

# Pod status
make status > diagnostics.txt 2>&1

# Recent logs (last 500 lines per service)
for pod in core database temporal secrets iam storage observability seal-gateway; do
  echo "=== $pod ===" >> diagnostics.txt
  make logs POD=$pod 2>&1 | tail -500 >> diagnostics.txt
done

# Health check results
make validate >> diagnostics.txt 2>&1