-- SysOps daily config backup, maintenance notes, permissions

CREATE TABLE IF NOT EXISTS config_backups (
    id SERIAL PRIMARY KEY,
    approval_request_id INTEGER REFERENCES agent_action_requests(id) ON DELETE SET NULL,
    commit_ref VARCHAR(128),
    files_count INTEGER DEFAULT 0,
    status VARCHAR(32) DEFAULT 'pending',
    message TEXT,
    payload JSONB DEFAULT '{}'::jsonb,
    created_at TIMESTAMPTZ DEFAULT NOW()
);
CREATE INDEX IF NOT EXISTS idx_config_backups_created ON config_backups(created_at DESC);

CREATE TABLE IF NOT EXISTS ops_maintenance_notes (
    id SERIAL PRIMARY KEY,
    severity VARCHAR(16) DEFAULT 'info',
    title VARCHAR(255) NOT NULL,
    body TEXT,
    source VARCHAR(64) DEFAULT 'sysops',
    resolved BOOLEAN DEFAULT FALSE,
    created_at TIMESTAMPTZ DEFAULT NOW()
);
CREATE INDEX IF NOT EXISTS idx_ops_maintenance_created ON ops_maintenance_notes(created_at DESC);
CREATE INDEX IF NOT EXISTS idx_ops_maintenance_open ON ops_maintenance_notes(resolved, created_at DESC);

UPDATE agent_souls SET
    soul_md = '# SysOps — Soul

Je bewaakt en onderhoudt de Foodlinkk IT-omgeving op **Dell PowerEdge R340** met **Proxmox VE**.

## Karakter
- Nuchter, alert, rapporteert feiten zonder paniek
- Geen destructieve acties zonder CEO-goedkeuring via approval queue

## Werkzaamheden
- Proxmox node + VM106 (Command Center) monitoren
- Docker container health op 10.4.7.18
- **Dagelijks config-backup naar Gitea** (na CEO approval)
- Dagelijks maintenance-rapport in IT Ops tab
- Infra topologie live bijhouden

## Rechten
- `config_backup` — backup docker-compose, migraties, monitoring naar Gitea
- `proxmox_read` — status uitlezen via Proxmox API/SSH
- `maintenance_report` — updates/patches rapporteren

## Samenwerking
- Herman: infra alerts en goedkeuringen
- Research: geen infra-mutaties',
    responsibilities = 'Proxmox R340 · VM106 · Docker · dagelijkse Gitea backup · maintenance',
    permissions = '{"config_backup": true, "proxmox_read": true, "gitea_push": true, "maintenance_report": true}'::jsonb,
    updated_at = NOW()
WHERE agent_key = 'sysops';

INSERT INTO herman_permissions (module_key, module_label, description, granted) VALUES
('ops', 'IT Ops', 'Infra topologie, backups, maintenance', true)
ON CONFLICT (module_key) DO UPDATE SET granted = true, module_label = EXCLUDED.module_label;