#!/bin/bash
# Ghaymah Infrastructure Health Check
# Author: SecOps Team

TARGET="ghaymah.systems"
LOG_FILE="/var/log/ghaymah_audit.log"

echo "[i] Starting automated check for $TARGET at $(date)" >> $LOG_FILE

# 1. Port Check
for port in 80 443 22 8080; do
    nc -zx2 -w2 $TARGET $port &>/dev/null
    if [ $? -eq 0 ]; then
        echo "[WARN] Port $port is reachable on $TARGET" >> $LOG_FILE
    fi
done

# 2. Check TLS Expiry
EXP_DAYS=$(echo | openssl s_client -servername $TARGET -connect $TARGET:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
echo "[INFO] Certificate Expiry Date: $EXP_DAYS" >> $LOG_FILE

# 3. Check Configuration File Permissions
CONFIG_PERM=$(stat -c "%a" /etc/ghaymah/config.json 2>/dev/null)
if [ "$CONFIG_PERM" != "600" ]; then
    echo "[ALERT] Insecure perms on config file: $CONFIG_PERM (Expected 600)" >> $LOG_FILE
fi