Add repair/cleanup script for half-installed RMM and Zabbix hosts

[MarkLFT]

Stacked on #1 (base is trmm-linux-no-mesh, so this shows only its own commit). GitHub will retarget it to main automatically once #1 merges.

What this is

repair-rmm-zabbix-linux.sh — diagnoses and repairs a client server left half-installed by an interrupted or failed TacticalRMM agent or Zabbix Agent 2 install, and can strip either stack back to nothing so a clean install can follow.

It never installs either agent. That stays with install-tacticalrmm-agent-linux.sh and install-zabbix-agent-linux-tactical-rmm.sh; this script's job is to get a messy host back to a known state so those can run cleanly.

Actions

Action	What it does
report	Read-only diagnosis (default). Exit 0 = healthy/absent, 1 = problems found — so it doubles as a TacticalRMM check
repair	Fixes what can be fixed safely, then re-reports
clean-trmm / clean-zabbix / clean-all	Removes the named stack(s)

What it detects

RMM agent: binary present but never registered · config present with the binary missing · missing or orphaned systemd unit · failed service · an empty /opt/tacticalmesh left by a failed mesh install (exactly the wreckage the bug in #1 produced) · stale build leftovers in /tmp.

Zabbix: half-installed package · broken dpkg state · legacy v1 zabbix-agent alongside Agent 2, which conflicts on port 10050 · config missing Server=/ServerActive=/Hostname= · missing plugins.d Include · CHANGE_ME placeholder credentials · apt repo added without the agent · and the classic crash loop, a plugin config referencing a loadable plugin whose package is not installed.

repair reconciles a broken dpkg state, recreates the tacticalagent unit, starts services that should be running, renames orphaned plugin configs to .disabled so the agent stops crash-looping, adds the missing Include, and clears build leftovers. Anything it cannot fix safely is reported with a next step rather than guessed at.

Safety

This script deletes things, so the defaults are deliberately conservative:

• report is the default and is read-only — nothing is removed by accident.
• Every destructive action writes a timestamped config backup to /var/backupsfirst, and aborts if the backup fails.
• A clean-* action refuses to touch a stack that looks healthy unless force is passed. A scheduled run that drifts onto a healthy host must not wipe a working agent.
• Non-interactive runs are refused outright without an explicit yes. Interactive runs require typing REMOVE.
• clean-zabbix leaves the apt repo in place (a reinstall needs it); clean-trmm leaves /usr/local/go.

Uses set -uo pipefail with explicit || die / || warn rather than -e, matching the TRMM installer and updater in this repo — on a deliberately broken host, a probe returning non-zero is normal input, not a failure.

Test results

Debian 12 containers — 9 scenarios, 29 assertions, all passing:

Scenario	Verified
Clean host	both stacks reported absent, exit 0
Binary present, never registered	detected, state partial, exit 1
Binary + config, no unit	detected as auto-repairable; repair writes the unit with the correct ExecStart
Config present, binary missing	detected as broken
Stale build leftovers	detected and cleared by repair
Empty /opt/tacticalmesh	detected and removed
Zabbix partial config	missing Server=, ServerActive=, CHANGE_ME placeholder and missing Include all detected; repair adds the Include and backs the config up first
Destructive safety	refuses without confirmation and leaves the agent untouched; with yes takes a backup then removes
Unknown action	rejected, non-zero exit

The healthy-stack guard was verified separately (5/5): yes will not remove a healthy stack — only force will, and neither empty nor yes gets through.

The container has systemd installed but not booted, which also confirmed the script degrades sanely when systemctl cannot work at all.

Not yet exercised on a real host: anything needing a live systemd — the service-restart paths and the healthy state itself. Progress.md records that.

bash -n and shellcheck 0.10.0 clean. README and CLAUDE.md updated.