#!/bin/bash
# Comprehensive server audit script
# Usage: ./audit-server.sh <host> [user]
# Collects system info, Docker, services, ports, web servers, databases, packages, users, cron

HOST="$1"
USER="${2:-root}"
SSH_KEY="/root/.ssh/itpp-infra"
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 $USER@$HOST"

echo "=============================================="
echo "AUDIT: $HOST (user: $USER)"
echo "=============================================="

# 1. System info
echo "--- SYSTEM INFO ---"
$SSH_CMD "hostname; cat /etc/os-release 2>/dev/null | head -5; uname -a; uptime; echo 'CPU:'; nproc; lscpu 2>/dev/null | grep 'Model name' | head -1; echo 'RAM:'; free -h | head -2; echo 'DISK:'; df -h / | tail -1"

# 2. Docker containers
echo "--- DOCKER CONTAINERS ---"
$SSH_CMD "docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' 2>/dev/null || echo 'Docker not available'"

echo "--- DOCKER IMAGES ---"
$SSH_CMD "docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.Size}}' 2>/dev/null || echo 'Docker not available'"

echo "--- DOCKER COMPOSE ---"
$SSH_CMD "ls /root/docker-compose*.yml /root/*/docker-compose*.yml /root/docker/*.yml /opt/*/docker-compose*.yml 2>/dev/null || echo 'No docker-compose files found in common locations'"

# 3. Systemd services
echo "--- RUNNING SYSTEMD SERVICES ---"
$SSH_CMD "systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | head -40"

echo "--- CUSTOM SYSTEMD SERVICES ---"
$SSH_CMD "ls /etc/systemd/system/*.service 2>/dev/null | grep -v -E '(systemd-|getty|serial-getty|dbus|sshd|cron|networking|ufw|ssh)' | head -30"

# 4. Listening ports
echo "--- TCP LISTENING PORTS ---"
$SSH_CMD "ss -tlnp 2>/dev/null | head -30"

echo "--- UDP LISTENING PORTS ---"
$SSH_CMD "ss -ulnp 2>/dev/null | head -20"

# 5. Web servers
echo "--- WEB SERVERS ---"
$SSH_CMD "which nginx apache2 caddy 2>/dev/null; echo '---'; ls /etc/nginx/sites-enabled/ 2>/dev/null; ls /etc/apache2/sites-enabled/ 2>/dev/null; cat /etc/caddy/Caddyfile 2>/dev/null | head -30"

# 6. Databases
echo "--- DATABASES ---"
$SSH_CMD "which mysql mysqld psql postgres sqlite3 mongod redis-server 2>/dev/null; echo '---'; systemctl is-active mysql mariadb postgresql mongod redis 2>/dev/null"

# 7. Notable packages
echo "--- NOTABLE PACKAGES ---"
$SSH_CMD "dpkg -l 2>/dev/null | grep -iE 'docker|nginx|apache|mysql|postgres|redis|mongodb|node|python|php|java|go|rust|ruby|caddy|traccar|unifi' | head -30"

# 8. Users with home directories
echo "--- HOME DIRECTORIES ---"
$SSH_CMD "ls /home/ 2>/dev/null; echo '---'; cat /etc/passwd 2>/dev/null | grep -E '/home/|/root' | cut -d: -f1"

# 9. Custom scripts and cron
echo "--- CRONTAB (root) ---"
$SSH_CMD "crontab -l 2>/dev/null || echo 'No crontab for root'"

echo "--- CUSTOM SCRIPTS ---"
$SSH_CMD "ls /root/*.sh /root/*.py 2>/dev/null || echo 'No scripts found in /root'"
$SSH_CMD "ls /usr/local/bin/*.sh /usr/local/bin/*.py 2>/dev/null || echo 'No scripts found in /usr/local/bin'"

echo "=============================================="
echo "END AUDIT: $HOST"
echo "=============================================="
echo ""