pixop-pack-config

Advanced support component. Build a standalone, sanitized tarball of Pixop runtime configuration under /etc/pixop-live (or a custom source tree). For normal escalations, operators should run pixop-support-bundle instead, which nests the same packer as config-archive/pixop-config-*.tar.gz with --include-systemd --label support.

Availability: Verify this tool on your appliance with command -v pixop-pack-config and pixop-version. Installed path when present: /opt/pixop/bin/pixop-pack-config (also invoked by pixop-support-bundle).

Purpose and scope

Use when support asks only for configuration (for example after a config-only change) without re-collecting GPU, network, or full preflight output. The script creates one new archive under the output directory; it does not restart services or call license or Marketplace APIs.

Contents are not a restore bundle for production secrets: JWT bodies, Docker Hub env, and Pulse credential files are never packed. The packer reads only --source (default /etc/pixop-live); it does not include /var/lib/pixop-live/parameters/params.json and is not a source for restoring picture profiles or SRT passphrases.

Usage

pixop-pack-config [options]

Option	Default	Description
`-o`, `--output DIR`	`/var/lib/pixop-live/support`	Directory for the `.tar.gz`
`-s`, `--source DIR`	`/etc/pixop-live`	Config tree to copy into the archive
`--include-systemd`	off	Add `systemctl cat` snapshots for `pixop-live`, `tsduck-in@`, `tsduck-out@`
`-l`, `--label TEXT`	(none)	Sanitized suffix in the archive filename
`-h`, `--help`		Show usage

There is no --include-secrets flag; passing it prints an error and exits 2.

Output filename:

/var/lib/pixop-live/support/pixop-config-<hostname>-<UTC-timestamp>[-<label>].tar.gz

UTC timestamp format: YYYYMMDDTHHMMSSZ. The tool prints Wrote: <path> and optional sha256sum. Archive mode is 0600 (umask 077).

Permissions and sudo

If you are not root, the script re-execs via sudo only when it cannot read the source directory, or when the output directory exists but is not writable. Otherwise it may run as your user (for example tests with a readable fixture tree).

pixop-redact must be executable at /opt/pixop/bin/pixop-redact (override with REDACT_BIN). Missing redactor exits 1. Redaction is best-effort—review archives before sharing. Missing source directory exits 1.

Archive layout and redaction

Path in archive	Notes
`config/`	Copy of source files after exclusions and `pixop-redact --in-place`
`config/*.jwt`	Removed; replaced by `*.meta` (path, size, mode, `contents=excluded`)
`config/docker.env`, `config/pulse.env`	Removed; `*.meta` records presence only
`meta/manifest.txt`	`created_utc`, host, source, `include_secrets=0`, systemd flag, kernel, optional Docker version
`systemd/`	Present only with `--include-systemd`; unit dumps redacted
`marketplace/state.json`	Copied from `PIXOP_MARKETPLACE_STATE` (default `/var/lib/pixop-live/marketplace/state.json`) when present; `*.jwt` and `pulse.env` stripped, then redacted
`README.txt`	Short notice that secrets are redacted

pixop-redact replaces values for keys whose names contain (case-insensitive): PASSWORD, PASSPHRASE, TOKEN, SECRET, API_KEY, PRIVATE_KEY, DOCKERHUB_TOKEN, PULSE_USER, PULSE_PASSWORD. It also redacts URL passphrase= segments and Authorization: Bearer headers in text. Pattern redaction is not perfect: review the tarball before sending. Never paste raw license.jwt, pixop-license token output (same compact license JWT), pulse.env credentials, or SRT passphrases into tickets.

pixop-redact is the shared sanitizer used by packers; it is not the primary operator CLI.

Operator workflow

df -h /var/lib/pixop-live/support
pixop-pack-config --include-systemd --label mycase
ls -l /var/lib/pixop-live/support/pixop-config-*.tar.gz
tar -tzf /var/lib/pixop-live/support/pixop-config-*.tar.gz | head

Unpack on a trusted host only: tar -xzf pixop-config-....tar.gz -C /path/to/scratch. Confirm no unexpected secret-shaped strings, then upload via your approved channel.

vs full support bundle

`pixop-pack-config` alone	pixop-support-bundle
Config (+ optional systemd units, marketplace state copy)	Above plus host/OS, NVIDIA, Docker, network, systemd status, marketplace status JSON, preflight, nested logs pack
CLI flags for output/source/label	No flags; always full collection

Troubleshooting

Issue	Action
`ERROR: pixop-redact not found`	Install AMI tools or set `REDACT_BIN`
`ERROR: ... does not exist`	Fix `--source` or deploy config under `/etc/pixop-live`
Empty or missing archive	Check disk space on output filesystem; see Monitoring and troubleshooting