# config/verification.yaml
backup_sources:
  - name: "mysql-primary"
    type: "database"
    source:
      engine: "mysql"
      host: "db-primary"
      port: 3306
      database: "app_production"
    backup_path: "/backups/mysql/latest.sql.gz"
    verification:
      check_integrity: true
      check_constraints: true
      check_row_count: true
      restore_to: "sandbox-mysql"

  - name: "file-storage"
    type: "filesystem"
    source:
      paths:
        - "/var/www/html/uploads"
        - "/etc/nginx/sites-enabled"
    backup_path: "/backups/files/latest.tar.gz"
    verification:
      check_integrity: true
      check_permissions: true
      restore_to: "sandbox-files"

  - name: "docker-volumes"
    type: "volume"
    source:
      volumes:
        - "postgres_data"
        - "redis_data"
    backup_path: "/backups/volumes/latest.tar.gz"
    verification:
      check_integrity: true
      restore_to: "sandbox-docker"

ai_analysis:
  model: "qwen2.5:7b"
  endpoint: "http://ollama:11434"
  prompt_template: "configs/prompts/verification_analysis.txt"

notifications:
  slack_webhook: "https://hooks.slack.com/..."
  pagerduty_key: "..."
  email: ["ops@yourdomain.com"]
  fail_threshold: 2  # 连续失败N次才告警

scheduling:
  full_verification: "0 3 * * 0"      # 每周日凌晨3点全量验证
  incremental_check: "0 3 * * 1-6"    # 周一到周六轻量检查

# docker-compose.yml
version: "3.8"

services:
  verifier:
    build: ./
    container_name: backup-verifier
    volumes:
      - ./config:/app/config:ro
      - ./reports:/app/reports
      - ./logs:/app/logs
      - /backups:/backups:ro
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - OLLAMA_HOST=http://ollama:11434
      - SLACK_WEBHOOK=${SLACK_WEBHOOK}
    depends_on:
      - ollama
    networks:
      - verifier-net

  sandbox-mysql:
    image: mysql:8.0
    container_name: sandbox-mysql
    environment:
      MYSQL_ROOT_PASSWORD: sandbox_root_123
    volumes:
      - sandbox_mysql_data:/var/lib/mysql
    networks:
      - verifier-net
    tmpfs:
      - /var/lib/mysql

  sandbox-redis:
    image: redis:7-alpine
    container_name: sandbox-redis
    networks:
      - verifier-net
    tmpfs:
      - /data

  ollama:
    image: ollama/ollama:latest
    container_name: ollama-verifier
    volumes:
      - ollama_model:/root/.ollama
    networks:
      - verifier-net
    ports:
      - "11434:11434"

volumes:
  sandbox_mysql_data:
  ollama_model:

networks:
  verifier-net:
    driver: bridge

# scripts/extract_backup.py
#!/usr/bin/env python3
"""从备份存储中提取待验证的备份文件"""

import gzip
import hashlib
import json
import shutil
import tarfile
from datetime import datetime
from pathlib import Path
import psycopg2  # for MySQL/MariaDB dumps

BACKUP_DIR = Path("/backups")
METADATA_FILE = BACKUP_DIR / "metadata.json"


def calculate_checksum(filepath: Path) -> dict:
    """计算文件校验和"""
    hashes = {
        "md5": hashlib.md5(),
        "sha256": hashlib.sha256(),
    }
    size = 0
    with open(filepath, "rb") as f:
        while chunk := f.read(8192):
            for h in hashes.values():
                h.update(chunk)
            size += len(chunk)
    return {
        "size": size,
        "md5": hashes["md5"].hexdigest(),
        "sha256": hashes["sha256"].hexdigest(),
    }


def extract_mysql_backup(backup_path: Path, dest_dir: Path) -> dict:
    """提取 MySQL 备份并验证结构"""
    result = {
        "type": "mysql",
        "status": "unknown",
        "tables": [],
        "row_counts": {},
        "errors": [],
    }

    dest_dir.mkdir(parents=True, exist_ok=True)

    # 解压备份
    if backup_path.suffix == ".gz":
        with gzip.open(backup_path, "rb") as f_in:
            with open(dest_dir / "backup.sql", "wb") as f_out:
                shutil.copyfileobj(f_in, f_out)
        sql_file = dest_dir / "backup.sql"
    else:
        sql_file = backup_path

    # 解析 SQL 文件获取表信息
    result["checksum"] = calculate_checksum(sql_file)
    result["file_size"] = sql_file.stat().st_size

    # 基础完整性检查
    content = sql_file.read_text(errors="replace")

    # 检查是否有 CREATE TABLE 语句
    create_tables = [
        line for line in content.split("\n")
        if line.strip().upper().startswith("CREATE TABLE")
    ]
    result["tables_found"] = len(create_tables)

    # 检查 INSERT 语句
    insert_count = content.count("INSERT INTO")
    result["insert_statements"] = insert_count

    # 检查是否有语法错误标记
    if "ERROR" in content.upper():
        result["errors"].append("SQL file contains ERROR markers")

    # 尝试连接 sandbox 验证可导入
    try:
        import subprocess
        # 这里实际会连接到 sandbox-mysql 容器
        proc = subprocess.run(
            ["mysql", "-h", "sandbox-mysql", "-u", "root",
             "-psandbox_root_123", "--one-database", "test_verify",
             "<", str(sql_file)],
            capture_output=True, text=True, timeout=300
        )
        if proc.returncode == 0:
            result["status"] = "integrity_ok"
        else:
            result["status"] = "integrity_failed"
            result["errors"].append(proc.stderr[:500])
    except Exception as e:
        result["status"] = "integrity_skipped"
        result["errors"].append(f"Connection check skipped: {e}")

    return result


def extract_file_backup(backup_path: Path, dest_dir: Path) -> dict:
    """提取文件备份并验证"""
    result = {
        "type": "filesystem",
        "status": "unknown",
        "files": [],
        "total_size": 0,
        "errors": [],
    }

    dest_dir.mkdir(parents=True, exist_ok=True)

    # 解压并验证
    try:
        with tarfile.open(backup_path, "r:gz") as tar:
            # 安全检查：防止路径穿越
            for member in tar.getmembers():
                member_path = Path(member.name)
                if member_path.is_absolute() or ".." in member_path.parts:
                    result["errors"].append(
                        f"Security: suspicious path {member.name}"
                    )
                    continue
                tar.extract(member, dest_dir)

        # 统计提取结果
        extracted_files = list(dest_dir.rglob("*"))
        result["files"] = [str(f.relative_to(dest_dir)) for f in extracted_files if f.is_file()]
        result["total_size"] = sum(f.stat().st_size for f in extracted_files if f.is_file())
        result["status"] = "integrity_ok"
        result["checksum"] = calculate_checksum(backup_path)
    except (tarfile.TarError, gzip.BadGzipFile) as e:
        result["status"] = "integrity_failed"
        result["errors"].append(f"Archive corruption: {e}")

    return result


def main():
    """主入口"""
    config_path = Path("/app/config/verification.yaml")
    output_dir = Path("/app/reports")
    output_dir.mkdir(parents=True, exist_ok=True)

    print(f"[{datetime.now()}] Starting backup extraction...")

    all_results = {}

    # 遍历所有备份源
    for source_name, source_config in config["backup_sources"].items():
        backup_path = Path(source_config["backup_path"])
        if not backup_path.exists():
            print(f"  SKIP {source_name}: backup not found at {backup_path}")
            continue

        print(f"  PROCESSING {source_name}...")
        dest_dir = Path(f"/tmp/verify-{source_name}-{datetime.now().strftime('%Y%m%d-%H%M%S')}")

        if source_config["type"] == "database":
            all_results[source_name] = extract_mysql_backup(backup_path, dest_dir)
        elif source_config["type"] == "filesystem":
            all_results[source_name] = extract_file_backup(backup_path, dest_dir)

        # 清理临时目录
        shutil.rmtree(dest_dir, ignore_errors=True)

    # 保存提取结果
    output_file = output_dir / f"extraction-{datetime.now().strftime('%Y%m%d-%H%M%S')}.json"
    with open(output_file, "w") as f:
        json.dump({
            "timestamp": datetime.now().isoformat(),
            "sources": all_results,
        }, f, indent=2, ensure_ascii=False)

    print(f"Extraction report saved to {output_file}")
    return all_results


if __name__ == "__main__":
    main()

# scripts/restore_sandbox.py
#!/usr/bin/env python3
"""在隔离 Docker 容器中恢复备份"""

import asyncio
import json
from datetime import datetime
from pathlib import Path
import docker
import mysql.connector

client = docker.from_env()


async def restore_mysql_backup(backup_sql: Path, sandbox_name: str) -> dict:
    """将 MySQL 备份恢复到隔离容器"""
    result = {"status": "unknown", "details": []}

    try:
        # 确保 sandbox 容器运行
        try:
            container = client.containers.get(sandbox_name)
            if container.status != "running":
                container.start()
        except docker.errors.NotFound:
            container = client.containers.run(
                "mysql:8.0",
                name=sandbox_name,
                detach=True,
                environment={
                    "MYSQL_ROOT_PASSWORD": "sandbox_root_123",
                    "MYSQL_DATABASE": "verify_db",
                },
                networks=["verifier-net"],
                tmpfs={"/var/lib/mysql": "size=1g"},
            )
            # 等待 MySQL 就绪
            for _ in range(30):
                await asyncio.sleep(1)
                inspect = container.attrs
                if "ready" in str(inspect.get("State", {})).lower() or True:
                    break

        # 复制备份文件到容器
        tar_bytes = backup_sql.read_bytes()
        import io
        with io.BytesIO() as tar_stream:
            import tarfile
            with tarfile.open(fileobj=tar_stream, mode="w") as tar:
                tar.add(backup_sql, arcname="backup.sql")
            tar_stream.seek(0)
            container.put_archive("/", tar_stream.read())

        # 执行恢复
        proc = await container.exec_run(
            ["mysql", "-u", "root", "-psandbox_root_123",
             "verify_db", "<", "/backup.sql"],
            workdir="/tmp"
        )
        stdout, stderr = proc.output.decode(), proc.output.decode()

        if proc.exit_code == 0:
            result["status"] = "restored"
            result["details"].append("MySQL restore successful")
        else:
            result["status"] = "restore_failed"
            result["details"].append(f"Restore error: {stderr[:500]}")

        # 验证数据
        cursor = mysql.connector.connect(
            host="sandbox-mysql", user="root", password="sandbox_root_123",
            database="verify_db"
        ).cursor()
        cursor.execute("SHOW TABLES")
        tables = [t[0] for t in cursor.fetchall()]
        result["tables_restored"] = tables
        result["table_count"] = len(tables)

        # 检查关键表是否有数据
        for table in tables[:5]:  # 检查前5个表
            try:
                cursor.execute(f"SELECT COUNT(*) FROM `{table}`")
                count = cursor.fetchone()[0]
                result[f"{table}_rows"] = count
            except Exception as e:
                result["details"].append(f"Check {table}: {e}")

        cursor.close()

    except Exception as e:
        result["status"] = "error"
        result["details"].append(str(e))

    return result


async def restore_file_backup(backup_tar: Path, sandbox_name: str) -> dict:
    """将文件备份恢复到隔离容器"""
    result = {"status": "unknown", "restored_paths": [], "errors": []}

    try:
        container = client.containers.run(
            "alpine:latest",
            name=sandbox_name,
            detach=True,
            command=["tail", "-f", "/dev/null"],
            tmpfs={"/restore": "size=1g"},
        )

        # 解压备份
        with open(backup_tar, "rb") as f:
            container.put_archive("/restore", f.read())

        # 验证解压结果
        proc = await container.exec_run(["tar", "tzf", "/restore/latest.tar.gz"])
        files = proc.output.decode().strip().split("\n")
        result["restored_paths"] = files[:20]  # 记录前20个文件
        result["total_files"] = len(files)
        result["status"] = "restored"

        container.stop()
        container.remove()

    except Exception as e:
        result["status"] = "error"
        result["errors"].append(str(e))

    return result


async def main():
    """主入口"""
    report_dir = Path("/app/reports")
    timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")

    print(f"[{timestamp}] Starting sandbox restoration...")

    all_results = {}

    for source_name, config in CONFIG["backup_sources"].items():
        print(f"  Restoring {source_name}...")
        backup_path = Path(config["backup_path"])

        if config["type"] == "database":
            all_results[source_name] = await restore_mysql_backup(
                backup_path, f"sandbox-{source_name}"
            )
        elif config["type"] == "filesystem":
            all_results[source_name] = await restore_file_backup(
                backup_path, f"sandbox-{source_name}"
            )

    # 保存结果
    output = report_dir / f"restoration-{timestamp}.json"
    with open(output, "w") as f:
        json.dump({"timestamp": timestamp, "results": all_results}, f, indent=2)

    print(f"Restoration report: {output}")
    return all_results


if __name__ == "__main__":
    asyncio.run(main())

# scripts/health_check.py
#!/usr/bin/env python3
"""验证恢复后的服务健康状态"""

import asyncio
import json
from datetime import datetime
from pathlib import Path
import httpx
import mysql.connector
import redis

REPORT_DIR = Path("/app/reports")


async def check_mysql_health(sandbox_name: str) -> dict:
    """检查 MySQL 恢复状态"""
    result = {
        "service": "mysql",
        "checks": {},
        "overall": "unknown",
    }

    try:
        # 连接测试
        conn = mysql.connector.connect(
            host="sandbox-mysql",
            user="root",
            password="sandbox_root_123",
            database="verify_db",
            connect_timeout=5,
        )
        cursor = conn.cursor()

        # 基础检查
        cursor.execute("SELECT VERSION()")
        result["checks"]["version"] = cursor.fetchone()[0]
        result["checks"]["connection"] = "ok"

        # 表数量检查
        cursor.execute("SHOW TABLES")
        tables = cursor.fetchall()
        result["checks"]["table_count"] = len(tables)

        # 数据一致性检查
        for table_name, in tables[:3]:
            try:
                cursor.execute(f"SELECT COUNT(*) FROM `{table_name}`")
                count = cursor.fetchone()[0]
                result["checks"][f"{table_name}_rows"] = count
                if count == 0:
                    result["checks"][f"{table_name}_warning"] = "empty table"
            except Exception as e:
                result["checks"][f"{table_name}_error"] = str(e)

        cursor.close()
        conn.close()
        result["overall"] = "healthy"

    except Exception as e:
        result["overall"] = "unhealthy"
        result["error"] = str(e)

    return result


async def check_file_integrity(sandbox_name: str) -> dict:
    """检查文件恢复完整性"""
    result = {
        "service": "filesystem",
        "checks": {},
        "overall": "unknown",
    }

    try:
        import docker
        client = docker.from_env()
        container = client.containers.get(sandbox_name)

        # 检查关键文件是否存在
        critical_files = [
            "/restore/etc/nginx/nginx.conf",
            "/restore/var/www/html/index.html",
        ]

        for fpath in critical_files:
            proc = await container.exec_run(["test", "-f", fpath])
            result["checks"][fpath] = "exists" if proc.exit_code == 0 else "missing"

        # 检查文件大小合理性
        proc = await container.exec_run(["du", "-sh", "/restore"])
        result["checks"]["total_size"] = proc.output.decode().split()[0]

        result["overall"] = "healthy"
        container.stop()
        container.remove()

    except Exception as e:
        result["overall"] = "unhealthy"
        result["error"] = str(e)

    return result


async def check_service_connectivity() -> dict:
    """检查外部服务可达性（如果恢复的环境需要对外提供服务）"""
    result = {"checks": {}, "overall": "healthy"}

    # 检查恢复的 Web 服务是否可访问
    try:
        async with httpx.AsyncClient(timeout=5) as client:
            resp = await client.get("http://sandbox-web:8080/health", follow_redirects=True)
            result["checks"]["web_service"] = {
                "status_code": resp.status_code,
                "reachable": resp.status_code == 200,
            }
    except Exception as e:
        result["checks"]["web_service"] = {"error": str(e), "reachable": False}
        result["overall"] = "unhealthy"

    return result


async def main():
    """主入口"""
    timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
    print(f"[{timestamp}] Running health checks...")

    all_checks = {}

    # MySQL 恢复验证
    all_checks["mysql"] = await check_mysql_health("sandbox-mysql")

    # 文件恢复验证
    all_checks["filesystem"] = await check_file_integrity("sandbox-files")

    # 服务连通性
    all_checks["connectivity"] = await check_service_connectivity()

    # 保存结果
    output = REPORT_DIR / f"healthcheck-{timestamp}.json"
    with open(output, "w") as f:
        json.dump({
            "timestamp": timestamp,
            "checks": all_checks,
            "summary": {
                "total": len(all_checks),
                "healthy": sum(1 for c in all_checks.values() if c["overall"] == "healthy"),
                "unhealthy": sum(1 for c in all_checks.values() if c["overall"] == "unhealthy"),
            }
        }, f, indent=2, ensure_ascii=False)

    print(f"Health check report: {output}")
    return all_checks


if __name__ == "__main__":
    asyncio.run(main())

# scripts/ai_analyze.py
#!/usr/bin/env python3
"""使用本地 LLM 分析验证结果并生成建议"""

import json
import httpx
from datetime import datetime
from pathlib import Path

OLLAMA_ENDPOINT = "http://ollama:11434/api/generate"
PROMPT_TEMPLATE = Path("/app/configs/prompts/verification_analysis.txt")


def load_prompt_template() -> str:
    return PROMPT_TEMPLATE.read_text()


def build_analysis_prompt(verification_data: dict) -> str:
    """构建分析 prompt"""
    template = load_prompt_template()

    # 格式化验证数据
    summary = verification_data.get("summary", {})
    checks = verification_data.get("checks", {})

    details = []
    for service, result in checks.items():
        details.append(f"### {service}")
        details.append(f"状态: {result.get('overall', 'unknown')}")
        for check_name, check_result in result.get("checks", {}).items():
            details.append(f"- {check_name}: {check_result}")

    prompt = template.format(
        timestamp=datetime.now().isoformat(),
        summary=json.dumps(summary, ensure_ascii=False, indent=2),
        details="\n".join(details),
    )
    return prompt


async def analyze_with_llm(prompt: str, model: str = "qwen2.5:7b") -> dict:
    """调用 LLM 进行分析"""
    payload = {
        "model": model,
        "prompt": prompt,
        "stream": False,
        "options": {
            "temperature": 0.3,
            "num_predict": 2048,
        }
    }

    async with httpx.AsyncClient(timeout=120) as client:
        resp = await client.post(OLLAMA_ENDPOINT, json=payload)
        resp.raise_for_status()
        return resp.json()


def parse_llm_response(response: dict) -> dict:
    """解析 LLM 返回，提取结构化结果"""
    text = response.get("response", "")

    # 简单解析（实际项目可以用更复杂的 parsing）
    result = {
        "risk_level": "low",
        "issues": [],
        "recommendations": [],
        "summary": text[:500],
        "full_analysis": text,
    }

    # 提取风险等级
    if "critical" in text.lower() or "严重" in text:
        result["risk_level"] = "critical"
    elif "high" in text.lower() or "高危" in text:
        result["risk_level"] = "high"
    elif "medium" in text.lower() or "中等" in text:
        result["risk_level"] = "medium"

    # 提取建议（简单按行分割）
    lines = text.split("\n")
    for line in lines:
        line = line.strip()
        if line.startswith("-") or line.startswith("•"):
            result["recommendations"].append(line[1:].strip())
        elif "问题" in line or "issue" in line.lower():
            result["issues"].append(line)

    return result


async def main():
    """主入口"""
    report_dir = Path("/app/reports")
    timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")

    # 读取最新的验证报告
    health_files = sorted(report_dir.glob("healthcheck-*.json"))
    if not health_files:
        print("No health check reports found")
        return

    latest_report = json.loads(health_files[-1].read_text())

    print(f"Analyzing verification data from {latest_report.get('timestamp')}...")

    # 构建 prompt
    prompt = build_analysis_prompt(latest_report)

    # 调用 LLM
    print("Calling LLM for analysis...")
    llm_response = await analyze_with_llm(prompt)

    # 解析结果
    analysis = parse_llm_response(llm_response)

    # 保存分析结果
    output = report_dir / f"analysis-{timestamp}.json"
    with open(output, "w") as f:
        json.dump({
            "timestamp": timestamp,
            "model": "qwen2.5:7b",
            "risk_level": analysis["risk_level"],
            "issues": analysis["issues"],
            "recommendations": analysis["recommendations"],
            "llm_raw": llm_response.get("response", ""),
        }, f, indent=2, ensure_ascii=False)

    print(f"Analysis saved to {output}")
    print(f"Risk level: {analysis['risk_level']}")
    print(f"Issues found: {len(analysis['issues'])}")
    print(f"Recommendations: {len(analysis['recommendations'])}")


if __name__ == "__main__":
    import asyncio
    asyncio.run(main())

# scripts/generate_report.py
#!/usr/bin/env python3
"""生成人类可读的验证报告"""

from datetime import datetime
from pathlib import Path
import json
import jinja2

REPORT_DIR = Path("/app/reports")
TEMPLATE_DIR = Path("/app/configs/templates")


def load_reports(timestamp: str) -> dict:
    """加载本次验证的所有报告"""
    reports = {}

    for pattern, key in [
        ("extraction-*.json", "extraction"),
        ("restoration-*.json", "restoration"),
        ("healthcheck-*.json", "health_check"),
        ("analysis-*.json", "analysis"),
    ]:
        files = sorted(REPORT_DIR.glob(pattern))
        if files:
            reports[key] = json.loads(files[-1].read_text())

    return reports


def generate_markdown_report(reports: dict) -> str:
    """生成 Markdown 报告"""
    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")

    analysis = reports.get("analysis", {})
    risk_level = analysis.get("risk_level", "unknown")
    risk_colors = {
        "critical": "🔴",
        "high": "🟠",
        "medium": "🟡",
        "low": "🟢",
    }

    md = f"""# 📋 VPS 备份验证报告

**生成时间**: {timestamp}  
**风险等级**: {risk_colors.get(risk_level, "⚪")} {risk_level.upper()}

---

## 一、验证摘要

| 指标 | 结果 |
|------|------|
| 备份提取 | {'✅ 成功' if reports.get('extraction', {}).get('summary', {}).get('status') == 'integrity_ok' else '❌ 失败'} |
| 隔离恢复 | {'✅ 成功' if reports.get('restoration', {}).get('summary', {}).get('status') == 'restored' else '❌ 失败'} |
| 健康检查 | {'✅ 通过' if reports.get('health_check', {}).get('summary', {}).get('healthy', 0) > 0 else '⚠️ 部分异常'} |
| AI 分析 | {'✅ 低风险' if risk_level in ['low', 'medium'] else '⚠️ 需关注'} |

---

## 二、详细验证结果

"""

    # 提取阶段
    if "extraction" in reports:
        md += "### 2.1 备份提取阶段\n\n"
        ext = reports["extraction"]
        for source, result in ext.get("sources", {}).items():
            status_icon = "✅" if result.get("status") == "integrity_ok" else "❌"
            md += f"- {status_icon} **{source}**: {result.get('status', 'unknown')}\n"
            if result.get("checksum"):
                md += f"  - 校验和: `{result['checksum'].get('sha256', 'N/A')[:16]}...`\n"
        md += "\n"

    # 恢复阶段
    if "restoration" in reports:
        md += "### 2.2 隔离恢复阶段\n\n"
        rest = reports["restoration"]
        for source, result in rest.get("results", {}).items():
            status_icon = "✅" if result.get("status") == "restored" else "❌"
            md += f"- {status_icon} **{source}**: {result.get('status', 'unknown')}\n"
            if result.get("tables_restored"):
                md += f"  - 恢复表: {', '.join(result['tables_restored'][:5])}\n"
        md += "\n"

    # 健康检查
    if "health_check" in reports:
        md += "### 2.3 健康检查阶段\n\n"
        hc = reports["health_check"]
        summary = hc.get("summary", {})
        md += f"- 总体健康: {summary.get('healthy', 0)}/{summary.get('total', 0)} 项通过\n"
        for service, result in hc.get("checks", {}).items():
            icon = "✅" if result.get("overall") == "healthy" else "❌"
            md += f"- {icon} **{service}**: {result.get('overall', 'unknown')}\n"
        md += "\n"

    # AI 分析结果
    if "analysis" in reports:
        md += "### 2.4 AI 分析结果\n\n"
        md += f"**风险等级**: {risk_colors.get(risk_level, '⚪')}{risk_level.upper()}\n\n"

        if analysis.get("issues"):
            md += "#### 发现的问题\n\n"
            for issue in analysis["issues"][:5]:
                md += f"- {issue}\n"
            md += "\n"

        if analysis.get("recommendations"):
            md += "#### AI 建议\n\n"
            for rec in analysis["recommendations"][:5]:
                md += f"- {rec}\n"
            md += "\n"

    # 原始 LLM 输出（可选）
    if analysis.get("llm_raw"):
        md += "---\n\n## 附录：AI 完整分析\n\n"
        md += "```\n"
        md += analysis["llm_raw"][:2000]
        if len(analysis["llm_raw"]) > 2000:
            md += "\n... (truncated)"
        md += "\n```\n"

    md += f"\n---\n\n*本报告由 AI 智能备份验证系统自动生成*\n"

    return md


def main():
    """主入口"""
    timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
    reports = load_reports(timestamp)

    # 生成 Markdown
    md_content = generate_markdown_report(reports)

    # 保存
    md_path = REPORT_DIR / f"report-{timestamp}.md"
    md_path.write_text(md_content, encoding="utf-8")

    print(f"Report generated: {md_path}")
    print(f"Risk Level: {reports.get('analysis', {}).get('risk_level', 'unknown').upper()}")

    # 同时保存 JSON 便于程序处理
    json_path = REPORT_DIR / f"report-{timestamp}.json"
    with open(json_path, "w") as f:
        json.dump({
            "timestamp": timestamp,
            "report_file": str(md_path),
            "risk_level": reports.get("analysis", {}).get("risk_level", "unknown"),
            "summary": reports.get("health_check", {}).get("summary", {}),
        }, f, indent=2, ensure_ascii=False)

    print(f"Summary saved: {json_path}")


if __name__ == "__main__":
    main()

# 克隆项目
git clone https://github.com/yourorg/vps-backup-verifier.git
cd vps-backup-verifier

# 配置环境变量
cp .env.example .env
# 编辑 .env 填入 Slack Webhook 等

# 拉取 LLM 模型
docker exec -it ollama-verifier ollama pull qwen2.5:7b

# 启动
docker compose up -d

# 首次手动运行
docker compose run --rm verifier python3 /app/scripts/generate_report.py

# 添加到 crontab
# 每周日 3:00 全量验证
0 3 * * 0 /usr/bin/docker compose -f /opt/backup-verifier/docker-compose.yml run --rm verifier python3 /app/scripts/main.py --full

# 周一至周六 3:00 轻量检查
0 3 * * 1-6 /usr/bin/docker compose -f /opt/backup-verifier/docker-compose.yml run --rm verifier python3 /app/scripts/main.py --light

# 备份完成后自动触发（需要备份脚本支持）
# 在备份脚本末尾添加：
curl -X POST http://localhost:8080/api/trigger/verify

# 手动触发验证
curl -X POST http://localhost:8080/api/verify \
  -H "Content-Type: application/json" \
  -d '{"source": "mysql-primary", "full": true}'

# 查看验证历史
curl http://localhost:8080/api/history?limit=10