#!/usr/bin/env bash
# Read-only server survey + safety checks. Run at the start of every agent run and paste the
# output into the journal. Changes nothing.
set -uo pipefail
warn=0; w(){ echo "  ⚠ $*"; warn=$((warn+1)); }; ok(){ echo "  ✓ $*"; }
echo "== Resources"
echo "  $(nproc) vCPU | RAM $(free -h | awk '/Mem:/{print $2" total, "$7" available"}') | disk / $(df -h / | awk 'NR==2{print $4" free ("$5" used)"}')"
use=$(df / | awk 'NR==2{gsub("%","",$5);print $5}'); [ "$use" -ge 85 ] && w "disk ${use}% full" || ok "disk usage ${use}%"
swap=$(free -m | awk '/Swap:/{print $2}'); [ "$swap" -eq 0 ] && echo "  · no swap configured (fine, but builds may OOM on small droplets)"
echo "== SSH"
cfg=$(sudo sshd -T 2>/dev/null)
if [ -n "$cfg" ]; then
  grep -qi '^passwordauthentication no' <<<"$cfg" && ok "password auth disabled" || w "password auth ENABLED"
  grep -qiE '^permitrootlogin (no|prohibit-password)' <<<"$cfg" && ok "root login: $(grep -i '^permitrootlogin' <<<"$cfg" | cut -d' ' -f2)" || w "root login allowed"
else w "could not read sshd config"; fi
echo "== Firewall"
st=$(sudo ufw status 2>/dev/null)
grep -q "Status: active" <<<"$st" && ok "ufw active" || w "ufw NOT active"
grep -qE "^(22|OpenSSH)[/ ]" <<<"$st" && ok "SSH rule present" || w "no SSH allow rule — do not enable ufw without one!"
echo "== Listening ports (public)"
sudo ss -tlnpH | awk '$4 !~ /^(127\.|\[::1\]|\[?::ffff:127)/' | awk '{print "  · "$4"  "$6}' | sed 's/users:((//; s/,pid=.*//'
echo "== Docker"
if command -v docker >/dev/null; then
  echo "  $(docker ps -q | wc -l) running containers"
  "$(dirname "$0")/docker-port-audit.sh" | sed 's/^/  /' || warn=$((warn+1))
else echo "  · docker not installed"; fi
echo "== Services"
systemctl --failed --no-legend --plain | awk '{print $1}' | while read -r u; do [ -n "$u" ] && echo "  ⚠ failed: $u"; done
systemctl is-active --quiet caddy && ok "caddy running" || echo "  · caddy not running"
echo "== Apps in /srv"; ls -1 /srv 2>/dev/null | sed 's/^/  · /'
echo "== Secrets"
d="$HOME/.agent-secrets"
if [ -d "$d" ]; then
  [ "$(stat -c %a "$d")" = 700 ] && ok "$d is 700" || w "$d is $(stat -c %a "$d") (should be 700)"
  loose=$(find "$d" -mindepth 1 -type d -perm /077 -printf "  ⚠ dir %p is %m (should be 700)\n"; find "$d" -type f ! -perm 600 -printf "  ⚠ %p is %m (should be 600)\n")
  if [ -n "$loose" ]; then echo "$loose"; warn=$((warn+1)); else ok "all secret files are 600"; fi
else echo "  · $d missing"; fi
echo "== Summary: $warn warning(s)"
exit $([ $warn -eq 0 ] && echo 0 || echo 1)