#!/bin/bash
# ============================================================
# WEBMASTER SERVER HEALTH CHECK
# Save: /opt/health-check.sh
# Run:  bash /opt/health-check.sh
# Cron: 0 9 * * 0 bash /opt/health-check.sh
# ============================================================

# ── CONFIG (edit these) ──────────────────────────────────
DOMAIN="yourdomain.com"
WP_PATH="/var/www/html"
BACKUP_DIR="/backups"
WARN_DISK=80          # % — warn if disk above this
CRIT_DISK=90          # % — fail if disk above this
WARN_SSH_FAILS=20     # daily failed logins before warning
CRIT_SSH_FAILS=100    # daily failed logins before critical

RED='\033[0;31m'; YEL='\033[1;33m'; GRN='\033[0;32m'
BLU='\033[0;34m'; BOLD='\033[1m'; NC='\033[0m'

pass() { echo -e "${GRN}[PASS]${NC} $1"; }
warn() { echo -e "${YEL}[WARN]${NC} $1"; }
fail() { echo -e "${RED}[FAIL]${NC} $1"; }
info() { echo -e "${BLU}[INFO]${NC} $1"; }
section() { echo -e "\n${BOLD}━━━ $1 ━━━${NC}"; }

echo -e "${BOLD}═══════════════════════════════════════════════${NC}"
echo -e "${BOLD}  SERVER HEALTH CHECK — $(date '+%Y-%m-%d %H:%M:%S')${NC}"
echo -e "${BOLD}  Host: $(hostname) | Domain: ${DOMAIN}${NC}"
echo -e "${BOLD}═══════════════════════════════════════════════${NC}"

# ─────────────────────────────────────────────────────────
# 1. DISK USAGE
# ─────────────────────────────────────────────────────────
section "1. DISK USAGE"
while IFS= read -r line; do
    pct=$(echo "$line" | awk '{gsub(/%/,"",$5); print $5}')
    mnt=$(echo "$line" | awk '{print $6}')
    [[ "$pct" =~ ^[0-9]+$ ]] || continue
    [[ "$mnt" == "Mounted" ]] && continue
    if   [ "$pct" -ge "$CRIT_DISK" ]; then fail "$mnt is ${pct}% full — CRITICAL"
    elif [ "$pct" -ge "$WARN_DISK" ]; then warn "$mnt is ${pct}% full"
    else                                    pass "$mnt: ${pct}% used"
    fi
done < <(df -h | grep -v tmpfs | grep -v udev)

# ─────────────────────────────────────────────────────────
# 2. MEMORY
# ─────────────────────────────────────────────────────────
section "2. MEMORY"
read TOTAL USED FREE_MEM < <(free -m | awk '/^Mem:/{print $2, $3, $7}')
SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')
PCT=$((USED * 100 / TOTAL))
if   [ "$PCT" -ge 90 ]; then fail "RAM: ${PCT}% (${USED}/${TOTAL}MB) — critical pressure"
elif [ "$PCT" -ge 75 ]; then warn "RAM: ${PCT}% (${USED}/${TOTAL}MB)"
else                         pass "RAM: ${PCT}% (${USED}/${TOTAL}MB, ${FREE_MEM}MB free)"
fi
if [ "$SWAP_USED" -gt 100 ] 2>/dev/null; then
    warn "Swap in use: ${SWAP_USED}MB — RAM may be too small"
else
    pass "Swap: ${SWAP_USED}MB in use"
fi

# ─────────────────────────────────────────────────────────
# 3. CPU LOAD
# ─────────────────────────────────────────────────────────
section "3. CPU LOAD"
LOAD=$(uptime | awk -F'load average:' '{print $2}' | awk -F',' '{gsub(/ /,"",$1); print $1}')
CORES=$(nproc)
LOAD_X10=$(echo "$LOAD * 10" | bc 2>/dev/null | cut -d. -f1)
THRESHOLD=$((CORES * 10))
info "Load: ${LOAD} on ${CORES} cores (1-min average)"
if   [ "${LOAD_X10:-0}" -ge $((THRESHOLD * 2)) ] 2>/dev/null; then fail "Load critically high: ${LOAD}"
elif [ "${LOAD_X10:-0}" -ge "$THRESHOLD" ] 2>/dev/null;        then warn "Load above core count: ${LOAD}"
else                                                                 pass "Load normal: ${LOAD}"
fi

# ─────────────────────────────────────────────────────────
# 4. SERVICES
# ─────────────────────────────────────────────────────────
section "4. SERVICES"
for svc in nginx mysql php8.2-fpm; do
    if systemctl is-active --quiet "$svc" 2>/dev/null; then
        pass "$svc is running"
    elif systemctl list-units --all 2>/dev/null | grep -q "${svc}.service"; then
        fail "$svc is STOPPED"
    fi
done

# ─────────────────────────────────────────────────────────
# 5. SSL CERTIFICATE
# ─────────────────────────────────────────────────────────
section "5. SSL CERTIFICATE"
EXPIRY=$(echo | timeout 5 openssl s_client -servername "${DOMAIN}" \
         -connect "${DOMAIN}:443" 2>/dev/null \
         | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
if [ -n "$EXPIRY" ]; then
    EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null \
                  || date -j -f "%b %d %H:%M:%S %Y %Z" "$EXPIRY" +%s 2>/dev/null)
    DAYS=$(( (EXPIRY_EPOCH - $(date +%s)) / 86400 ))
    if   [ "$DAYS" -le 7  ]; then fail "SSL expires in ${DAYS} days — RENEW NOW"
    elif [ "$DAYS" -le 30 ]; then warn "SSL expires in ${DAYS} days"
    else                          pass "SSL valid for ${DAYS} days (expires: $EXPIRY)"
    fi
else
    warn "Could not check SSL — verify ${DOMAIN} is reachable"
fi

# ─────────────────────────────────────────────────────────
# 6. BACKUPS
# ─────────────────────────────────────────────────────────
section "6. BACKUPS"
if [ -d "$BACKUP_DIR" ]; then
    LATEST=$(find "$BACKUP_DIR" \
             \( -name "*.tar.gz" -o -name "*.zip" -o -name "*.sql" -o -name "*.sql.gz" \) \
             2>/dev/null | xargs ls -t 2>/dev/null | head -1)
    if [ -n "$LATEST" ]; then
        MOD=$(stat -c %Y "$LATEST" 2>/dev/null || stat -f %m "$LATEST" 2>/dev/null)
        AGE=$(( ($(date +%s) - MOD) / 3600 ))
        if   [ "$AGE" -gt 168 ]; then fail "Backup is ${AGE}h old (>7 days): $(basename "$LATEST")"
        elif [ "$AGE" -gt 48 ];  then warn "Backup is ${AGE}h old: $(basename "$LATEST")"
        else                          pass "Latest backup: $(basename "$LATEST") (${AGE}h ago)"
        fi
    else
        fail "No backup files found in ${BACKUP_DIR}"
    fi
else
    warn "Backup dir ${BACKUP_DIR} not found — set BACKUP_DIR variable"
fi

# ─────────────────────────────────────────────────────────
# 7. FAILED LOGIN ATTEMPTS
# ─────────────────────────────────────────────────────────
section "7. SECURITY — FAILED LOGINS"
if [ -f /var/log/auth.log ]; then
    TODAY=$(date +"%b %e" | sed 's/  / /')
    FAILS=$(grep "Failed password" /var/log/auth.log 2>/dev/null \
            | grep "$TODAY" | wc -l)
    if   [ "$FAILS" -gt "$CRIT_SSH_FAILS" ]; then fail "Brute force: ${FAILS} SSH failures today"
    elif [ "$FAILS" -gt "$WARN_SSH_FAILS" ]; then warn "${FAILS} SSH failures today"
    else                                           pass "SSH failures today: ${FAILS}"
    fi
    # Top attacking IPs:
    TOP_IP=$(grep "Failed password" /var/log/auth.log 2>/dev/null \
             | grep "$TODAY" | awk '{print $(NF-3)}' | sort | uniq -c \
             | sort -rn | head -3)
    [ -n "$TOP_IP" ] && info "Top IPs:\n$TOP_IP"
fi

# ─────────────────────────────────────────────────────────
# 8. SUSPICIOUS PROCESSES
# ─────────────────────────────────────────────────────────
section "8. SECURITY — PROCESSES"
SUSP=$(ps aux 2>/dev/null \
       | grep -E "base64|/tmp/[a-z0-9]{6,}\s|perl.*socket|python.*-c.*socket|xmrig|cryptonight|stratum\+" \
       | grep -v grep | grep -v "health-check")
if [ -n "$SUSP" ]; then
    fail "SUSPICIOUS PROCESSES:"
    echo "$SUSP" | while read -r ln; do echo "  ↳ $ln"; done
else
    pass "No suspicious process signatures found"
fi
DEL=$(lsof +L1 2>/dev/null | grep -vc "^COMMAND")
if [ "${DEL:-0}" -gt 0 ] 2>/dev/null; then
    warn "${DEL} deleted-but-still-running file(s) (possible rootkit)"
else
    pass "No deleted-but-running files"
fi

# ─────────────────────────────────────────────────────────
# 9. RECENTLY MODIFIED FILES
# ─────────────────────────────────────────────────────────
section "9. RECENTLY MODIFIED PHP FILES (24h)"
if [ -d "$WP_PATH" ]; then
    COUNT=$(find "$WP_PATH" -name "*.php" -mtime -1 2>/dev/null | wc -l)
    if   [ "$COUNT" -gt 20 ]; then
        fail "${COUNT} PHP files modified in 24h — possible webshell drop"
        find "$WP_PATH" -name "*.php" -mtime -1 2>/dev/null | head -5 \
            | while read -r f; do echo "  ↳ $f"; done
    elif [ "$COUNT" -gt 5 ]; then
        warn "${COUNT} PHP files modified in 24h:"
        find "$WP_PATH" -name "*.php" -mtime -1 2>/dev/null \
            | while read -r f; do echo "  ↳ $f"; done
    else
        pass "${COUNT} PHP file(s) modified in 24h (normal)"
        [ "$COUNT" -gt 0 ] && find "$WP_PATH" -name "*.php" -mtime -1 2>/dev/null \
            | while read -r f; do echo "  ↳ $f"; done
    fi
fi

# ─────────────────────────────────────────────────────────
# 10. OPEN PORTS
# ─────────────────────────────────────────────────────────
section "10. OPEN PORTS"
PORTS=$(ss -tnlp 2>/dev/null | grep LISTEN \
        | awk '{print $4}' | rev | cut -d: -f1 | rev | sort -n | uniq | tr '\n' ' ')
info "Listening: $PORTS"
UNEXPECTED=$(ss -tnlp 2>/dev/null | grep LISTEN \
             | awk '{print $4}' | grep -vE ":(22|80|443|3306|6379|8080|8443|9000)$")
[ -n "$UNEXPECTED" ] && warn "Non-standard ports: $UNEXPECTED"

# ─────────────────────────────────────────────────────────
# SUMMARY
# ─────────────────────────────────────────────────────────
section "SUMMARY"
info "Check complete in $SECONDS seconds"
info "Next run: $(date -d 'next sunday 09:00' '+%Y-%m-%d %H:%M' 2>/dev/null || echo 'next Sunday 09:00')"
echo ""