feat: complete all SecOps tasks with full content

q1-audit/health-check.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Ghaymah Infrastructure Health Check
+# Author: SecOps Team
+
+TARGET="ghaymah.systems"
+LOG_FILE="/var/log/ghaymah_audit.log"
+
+echo "[i] Starting automated check for $TARGET at $(date)" >> $LOG_FILE
+
+# 1. Port Check
+for port in 80 443 22 8080; do
+    nc -zx2 -w2 $TARGET $port &>/dev/null
+    if [ $? -eq 0 ]; then
+        echo "[WARN] Port $port is reachable on $TARGET" >> $LOG_FILE
+    fi
+done
+
+# 2. Check TLS Expiry
+EXP_DAYS=$(echo | openssl s_client -servername $TARGET -connect $TARGET:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
+echo "[INFO] Certificate Expiry Date: $EXP_DAYS" >> $LOG_FILE
+
+# 3. Check Configuration File Permissions
+CONFIG_PERM=$(stat -c "%a" /etc/ghaymah/config.json 2>/dev/null)
+if [ "$CONFIG_PERM" != "600" ]; then
+    echo "[ALERT] Insecure perms on config file: $CONFIG_PERM (Expected 600)" >> $LOG_FILE
+fi