pixop-support-bundle

Assemble a single compressed archive of host, GPU, Docker, network, systemd, marketplace observability, sanitized configuration, log excerpts, and a pixop-preflight transcript for Pixop support. Designed to avoid shipping license JWTs, Pulse passwords, Docker Hub tokens, or SRT passphrases.

Availability: Verify this tool on your appliance with command -v pixop-support-bundle and pixop-version. Installed path when present: /opt/pixop/bin/pixop-support-bundle.

Purpose and scope

Mutating only in output: writes one .tar.gz under /var/lib/pixop-live/support/ (mode 0600, umask 077). Does not restart services, call AWS Marketplace activation APIs, or run pixop-license doctor / live Pulse clients. Marketplace section uses cached state.json, pixop-license status --json, and refresh-unit journals only.

Usage

pixop-support-bundle

No CLI flags. Non-root users are re-execed via sudo.

Output:

Wrote: /var/lib/pixop-live/support/pixop-support-<hostname>-<UTC-timestamp>.tar.gz

Optional sha256sum line when available.

Archive contents (high level)

Area	Contents
`host/`	`manifest.txt`, `os-release`, `uname`, kernel cmdline
`nvidia/`	`nvidia-smi`, GPU list/query, `/proc/driver/nvidia/version`, `modinfo`
`docker/`	`version`, `info`, `images --digests`, runtimes JSON
`network/`	`ip addr`, routes, `ss` UDP/TCP listeners
`systemd/`	Status for docker, `pixop-live`, marketplace refresh; unit list; journal snippet
`marketplace/`	`state.json`, redacted `status.json` (no `*.jwt`)
`preflight/`	Full `pixop-preflight` text capture
`config-archive/`	`pixop-pack-config --include-systemd --label support` tarball
`logs-archive/`	`pixop-pack-logs` tarball

Nested packs run through pixop-redact (keys matching PASSWORD, PASSPHRASE, TOKEN, SECRET, API_KEY, PRIVATE_KEY, DOCKERHUB_TOKEN, PULSE_USER, PULSE_PASSWORD). license.jwt and pulse.env are excluded from config packs; stray JWT paths under marketplace/ are removed.

Operator workflows

Standard escalation package:

pixop-support-bundle
ls -l /var/lib/pixop-live/support/

Copy the newest pixop-support-*.tar.gz through your secure channel (SFTP, ticket attachment policy, etc.).

Correlate with identity (separate commands, not inside bundle secrets):

pixop-version
pixop-license status    # AWS; use hashes from status, not JWT body

Never add output from pixop-license token or tsduckctl credentials into the bundle or ticket body.

Privacy and security

Safe to share (typical)	Do not paste in chat/email
Bundle file via approved channel	Raw `license.jwt`, `pixop-license token` output, `/etc/pixop-live/pulse.env`
`pixop-version` / preflight summary	SRT passphrases from `tsduckctl credentials`
License file hashes from `pixop-license status`	Unredacted `/etc/pixop-live` tarballs you built manually

Redaction is pattern-based: treat the archive as sensitive until your security team reviews it. IP addresses, instance IDs in journals, and operational metadata remain.

Unpack only on trusted analysis hosts: tar -xzf pixop-support-....tar.gz -C /path/to/scratch

Troubleshooting

Issue	Action
Permission denied on output dir	Run as user in `pixop` with sudo, or as root; confirm `/var/lib/pixop-live/support` exists
Empty `config-archive/`	`pixop-pack-config` failed; check disk space and `/etc/pixop-live` readability in journal
Huge archive	Log window is defined by `pixop-pack-logs`; trim time range only by repacking logs separately if support agrees

Limitations

Does not capture packet traces or full live.log indefinitely — see pixop-flow for live throughput snapshots.
Does not prove external connectivity (SG/NACL).
Observational marketplace data may lag live entitlement.