#!/bin/bash

# =============================================================================
# 🌍 УНИВЕРСАЛЬНЫЙ СЕРВЕРНЫЙ КОМБАЙН v1.2.1
# Ubuntu/Debian/AlmaLinux/Rocky/CentOS/Fedora
# =============================================================================


   _____ _           _     
  / ____| |         | |    
 | |  __| |__   __ _| |_ __
 | | |_ | '_ \ / _ | | '_ \
 | |__| | | | |  __| | |_) |
  \_____|_| |_|\___|_| .__/ 
                     | |    
                     |_|    
       SERVER ULTIMATE v1.2.1


GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
NC='\033[0m'

OS_ID="" OS_VERSION="" PKG_MGR="" SSH_SERVICE=""

if [ "$EUID" -ne 0 ]; then 
  echo "🚫 Запустите от root!"
  exit 1
fi

detect_os() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS_ID=$ID
        OS_VERSION=$VERSION_ID
    else
        OS_ID=$(uname -s | tr '[:upper:]' '[:lower:]')
    fi
    
    case $OS_ID in
        ubuntu|debian) 
            PKG_MGR="apt"
            SSH_SERVICE="ssh"
            DOCKER_CMD="curl -fsSL https://get.docker.com | sh"
            ;;
        "almalinux"|"rocky"|"centos"|"fedora")
            PKG_MGR="dnf"
            SSH_SERVICE="sshd"
            DOCKER_CMD="dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo && dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin"
            ;;
        *) echo "❌ Неподдерживаемая ОС: $OS_ID"; exit 1 ;;
    esac
    
    echo "🖥️  ОС: $OS_ID | Пакеты: $PKG_MGR | SSH: $SSH_SERVICE"
}

pause(){ read -p "  Нажмите [Enter]..." fackEnterKey; }
pkg_install() { echo "📦 Установка: $@"; $PKG_MGR update -y && $PKG_MGR install -y "$@"; }
service_restart() {
    if command -v systemctl >/dev/null; then
        systemctl restart "$1"
    else
        service "$1" restart
    fi
}
service_enable() {
    if command -v systemctl >/dev/null; then
        systemctl enable --now "$1"
    else
        service "$1" start && chkconfig "$1" on 2>/dev/null || true
    fi
}

check_other_users() {
    awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd | wc -l
}

setup_timezone_interactive() {
    clear
    echo "${GREEN}🌍 ЧАСОВОЙ ПОЯС${NC}"
    echo "1) Europe/Moscow      2) Europe/Kiev      3) Asia/Almaty"
    echo "4) Asia/Yekaterinburg 5) Asia/Novosibirsk 6) Europe/Berlin"
    echo "7) America/New_York   8) Asia/Tokyo      0) Ручной ввод"
    echo ""
    read -p "► " TZ_CHOICE
    
    case $TZ_CHOICE in
        1) TZ="Europe/Moscow";;           2) TZ="Europe/Kiev";;
        3) TZ="Asia/Almaty";;             4) TZ="Asia/Yekaterinburg";;
        5) TZ="Asia/Novosibirsk";;        6) TZ="Europe/Berlin";;
        7) TZ="America/New_York";;        8) TZ="Asia/Tokyo";;
        0) read -p "Зона (ex: Europe/Moscow): " TZ;;
        *) echo "Неверный выбор"; pause; return;;
    esac
    
    timedatectl set-timezone "$TZ" 2>/dev/null && timedatectl set-ntp true 2>/dev/null
    echo "${GREEN}✅ $TZ | $(date)${NC}"
    pause
}

install_base_pkgs() {
    echo "${GREEN}📦 БАЗОВЫЕ ПАКЕТЫ${NC}"
    case $PKG_MGR in
        apt) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
        dnf) pkg_install mc htop zip wget curl git net-tools gnupg2 unzip ;;
    esac
    
    curl -L "https://github.com/dundee/gdu/releases/latest/download/gdu_linux_amd64.tgz" | tar xz
    chmod +x gdu_linux_amd64 && mv gdu_linux_amd64 /usr/local/bin/
    echo "${GREEN}✅ gdu установлен${NC}"
}

create_user_full() {
    echo "${GREEN}👤 СОЗДАНИЕ ПОЛЬЗОВАТЕЛЯ${NC}"
    read -p "Имя: " UNAME
    echo "1) Только SSH ключ 🔑  2) Пароль + SSH 🔐"
    read -p "► " AUTH_METHOD
    
    useradd -m -s /bin/bash "$UNAME"
    usermod -aG wheel,sudo "$UNAME" 2>/dev/null || usermod -aG sudo "$UNAME"
    
    if [ "$AUTH_METHOD" == "1" ]; then
        echo "${GREEN}🔑 SSH ПУБЛИЧНЫЙ КЛЮЧ:${NC}"
        read -p "> " UKEY
        mkdir -p /home/$UNAME/.ssh
        echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
        passwd -l "$UNAME"
        echo "${GREEN}✅ Только SSH ключ${NC}"
    else
        read -s -p "🔐 Пароль: " PASS1; echo
        read -s -p "Повторить: " PASS2; echo
        [ "$PASS1" = "$PASS2" ] && echo "$UNAME:$PASS1" | chpasswd
        echo "${GREEN}✅ Пароль установлен${NC}"
        read -p "🔑 SSH ключ (опционально): " UKEY
        [ -n "$UKEY" ] && echo "$UKEY" > /home/$UNAME/.ssh/authorized_keys
    fi
    
    chown -R "$UNAME:$UNAME" /home/$UNAME/.ssh 2>/dev/null || true
    chmod 700 /home/$UNAME/.ssh 2>/dev/null || true
    chmod 600 /home/$UNAME/.ssh/authorized_keys 2>/dev/null || true
    
    echo "$UNAME ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${UNAME}"
    chmod 440 "/etc/sudoers.d/${UNAME}"
    echo "${GREEN}✅ $UNAME готов (sudo без пароля)${NC}"
    pause
}

setup_ssh_security() {
    clear
    echo "${RED}🔒 НАСТРОЙКА SSH БЕЗОПАСНОСТИ${NC}"
    
    USER_COUNT=$(check_other_users)
    if [ "$USER_COUNT" -eq 0 ]; then
        echo "${RED}🚫 ОШИБКА: Только root!${NC}"
        echo "${YELLOW}✅ Сначала пункт 3 → Создать пользователя${NC}"
        pause; return
    fi
    
    echo "${YELLOW}⚠️  Будет изменено:${NC}"
    echo "  ✖ Вход root"
    echo "  ✖ Пароли" 
    echo "  ✔ Только SSH ключи"
    echo ""
    read -p "ПРОДОЛЖИТЬ? (y/N): " CONFIRM
    
    [ "$CONFIRM" != "y" ] && { echo "Отменено."; pause; return; }
    
    SSHD_CONFIG="/etc/ssh/${SSH_SERVICE}_config"
    cp "$SSHD_CONFIG" "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)"
    
    sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD_CONFIG"
    sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' "$SSHD_CONFIG"
    sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' "$SSHD_CONFIG"
    
    if command -v "${SSH_SERVICE}" >/dev/null && "${SSH_SERVICE}" -t 2>/dev/null; then
        service_restart "$SSH_SERVICE"
        echo "${GREEN}✅ SSH защищён!${NC}"
    else
        echo "${RED}❌ Ошибка конфига! Восстановление...${NC}"
        cp "${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M)" "$SSHD_CONFIG"
        service_restart "$SSH_SERVICE"
    fi
    pause
}

install_unattended_upgrades() {
    echo "${GREEN}🔄 АВТООБНОВЛЕНИЯ БЕЗОПАСНОСТИ${NC}"
    
    if [[ "$OS_ID" != "ubuntu" && "$OS_ID" != "debian" ]]; then
        echo "${YELLOW}⚠️  Только Ubuntu/Debian${NC}"
        pause; return
    fi
    
    pkg_install unattended-upgrades needrestart
    
    cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
    
    cat > /etc/apt/apt.conf.d/50unattended-upgrades << 'EOF'
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};
Unattended-Upgrade::Mail "root";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
EOF
    
    dpkg-reconfigure -plow unattended-upgrades
    service_enable unattended-upgrades
    
    echo "${GREEN}✅ НАСТРОЕНО:${NC}"
    echo "   📅 Обновления: ежедневно"
    echo "   🔒 Только: security + updates" 
    echo "   📋 Логи: /var/log/unattended-upgrades/"
    echo "   ⚠️  Авто-ребут: отключен"
    pause
}

install_audit_with_rotation() {
    echo "${GREEN}🔒 АУДИТ + РОТАЦИЯ ЛОГОВ${NC}"
    case $PKG_MGR in
        apt) pkg_install auditd audispd-plugins logrotate ;;
        dnf) pkg_install audit policycoreutils-python-utils logrotate ;;
    esac
    
    cat > /etc/audit/rules.d/server-setup.rules << 'EOF'
-w /etc/sudoers -p wa -k sudoers
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k ssh_config
-a always,exit -F arch=b64 -S execve -k process_exec
EOF
    
    if grep -q "^max_log_file" /etc/audit/auditd.conf 2>/dev/null; then
        sed -i 's/^max_log_file.*/max_log_file = 50/' /etc/audit/auditd.conf
    else
        echo 'max_log_file = 50' >> /etc/audit/auditd.conf
    fi
    echo 'num_logs = 8' >> /etc/audit/auditd.conf
    
    service_restart auditd 2>/dev/null || true
    service_enable auditd 2>/dev/null || true
    echo "${GREEN}✅ Аудит: /var/log/audit/audit.log${NC}"
    pause
}

status_all() {
    clear
    echo "${GREEN}📊 СТАТУС СИСТЕМЫ${NC}"
    echo "=============================================="
    echo "🔄 Unattended: $(systemctl is-active unattended-upgrades 2>/dev/null || echo 'Неактивен')"
    echo "🔒 SSH: $(systemctl is-active $SSH_SERVICE 2>/dev/null || echo 'Неактивен')"
    echo "🛡️ Fail2Ban: $(systemctl is-active fail2ban 2>/dev/null || echo 'Неактивен')"
    echo "📊 Auditd: $(systemctl is-active auditd 2>/dev/null || echo 'Неактивен')"
    echo "🐳 Docker: $(systemctl is-active docker 2>/dev/null || echo 'Неактивен')"
    echo "=============================================="
    echo "👥 Пользователей: $(check_other_users)"
    echo "📅 Время: $(date)"
    pause
}

# --- ГЛАВНОЕ МЕНЮ ---
detect_os

while true; do
    clear
    echo "=============================================="
    echo "   🚀 SERVER ULTIMATE v5.1 ($OS_ID $OS_VERSION) 🚀"
    echo "=============================================="
    echo "1)  📛 Hostname              2)  🌍 Часовой пояс + база"
    echo "3)  👤 Пользователь          4)  🔒 SSH безопасность"
    echo "5)  📊 Аудит + ротация       6)  🐳 Docker + Compose"
    echo "7)  🌐 WireGuard             8)  🔐 OpenVPN (Angristan)"
    echo "9)  📈 Мониторинг            10) 🛡️ Fail2Ban"
    echo "11) 🧹 Очистка пакетов       12) 🔄 Автообновления"
    echo "S)  📊 Статус всех сервисов  0)  ❌ Выход"
    echo "=============================================="
    read -p "► " opt
    
    case $opt in
        1) read -p "Имя хоста: " HN; hostnamectl set-hostname "$HN" 2>/dev/null || hostname "$HN"; systemctl restart systemd-hostnamed 2>/dev/null || true; pause ;;
        2) setup_timezone_interactive; install_base_pkgs ;;
        3) create_user_full ;;
        4) setup_ssh_security ;;
        5) install_audit_with_rotation ;;
        6) $DOCKER_CMD; service_enable docker; pause ;;
        7) curl -fsSL https://git.io/wireguard -o wg.sh && bash wg.sh; pause ;;
        8) curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && chmod +x openvpn-install.sh && ./openvpn-install.sh; pause ;;
        9) pkg_install glances htop; pause ;;
        10) pkg_install fail2ban; service_enable fail2ban; pause ;;
        11) $PKG_MGR autoremove -y && $PKG_MGR autoclean -y; pause ;;
        12) install_unattended_upgrades ;;
        [Ss]) status_all ;;
        0) break ;;
        *) echo "❌ Неверный пункт!"; sleep 1 ;;
    esac
done

echo "🎉 Настройка завершена! Сервер готов к работе!"