#!/usr/bin/env bash
# Read-only security audit for a Coolify + Tailscale server.
# Usage: sudo bash server-audit.sh
# Optional: ALLOWED_PUBLIC_PORTS="80 443" sudo -E bash server-audit.sh
# Changes nothing. Exit code 1 if any FAIL.
set -u
((BASH_VERSINFO[0] >= 4)) || { echo "Needs bash 4+"; exit 2; }

ALLOWED_PUBLIC_PORTS="${ALLOWED_PUBLIC_PORTS:-80 443}"

if [ -t 1 ]; then R=$'\e[31m' Y=$'\e[33m' G=$'\e[32m' B=$'\e[1m' N=$'\e[0m'; else R='' Y='' G='' B='' N=''; fi
fails=0 warns=0
pass()    { printf '%s[PASS]%s %s\n' "$G" "$N" "$*"; }
warn()    { printf '%s[WARN]%s %s\n' "$Y" "$N" "$*"; warns=$((warns + 1)); }
fail()    { printf '%s[FAIL]%s %s\n' "$R" "$N" "$*"; fails=$((fails + 1)); }
info()    { printf '       %s\n' "$*"; }
section() { printf '\n%s== %s ==%s\n' "$B" "$*" "$N"; }
have()    { command -v "$1" >/dev/null 2>&1; }
allowed() { case " $ALLOWED_PUBLIC_PORTS " in *" $1 "*) return 0 ;; esac; return 1; }
is_public_addr() {
  case "$1" in
    127.* | ::1 | "[::1]" | 100.* | "[fd7a:115c:a1e0:"* | fd7a:115c:a1e0:* | 10.* | 192.168.* | 172.1[6-9].* | 172.2[0-9].* | 172.3[01].*) return 1 ;;
  esac
  return 0
}

[ "$(id -u)" -eq 0 ] || { echo "Run as root: sudo bash $0"; exit 2; }

ufw_active=0
docker_ok=0
have docker && docker info >/dev/null 2>&1 && docker_ok=1

section "Host"
info "hostname: $(hostname)   os: $(. /etc/os-release 2>/dev/null; echo "${PRETTY_NAME:-unknown}")"
info "public addresses (use these with external-check.sh):"
ip -o addr show scope global 2>/dev/null |
  awk '$2 !~ /^(tailscale|docker|br-|veth|lo)/ {split($4, a, "/"); print "         " $2 "  " a[1]}'

section "Tailscale"
if ! have tailscale; then
  fail "tailscale is not installed"
else
  ts_state='' ts_ip='' ts_name='' ts_expiry='' ts_tags=''
  if have python3; then
    { read -r ts_state; read -r ts_ip; read -r ts_name; read -r ts_expiry; read -r ts_tags; } < <(
      tailscale status --json 2>/dev/null | python3 -c '
import json, sys
d = json.load(sys.stdin); s = d.get("Self") or {}
print(d.get("BackendState", ""))
print((s.get("TailscaleIPs") or [""])[0])
print(s.get("DNSName", "").rstrip("."))
print(s.get("KeyExpiry") or "")
print(",".join(s.get("Tags") or []))' 2>/dev/null
    )
  else
    ts_ip=$(tailscale ip -4 2>/dev/null | head -1)
    tailscale status >/dev/null 2>&1 && ts_state=Running
  fi
  if [ "$ts_state" = Running ]; then pass "tailscale is running: ${ts_name:-?} ($ts_ip)"; else fail "tailscale is not running (state: ${ts_state:-unknown}). Run: sudo tailscale up"; fi
  [ -n "$ts_tags" ] && info "tags: $ts_tags"
  if [ -n "$ts_expiry" ]; then
    warn "tailscale node key expires $ts_expiry. Disable key expiry in the admin console (Machines > ... > Disable key expiry) or this box drops off the tailnet."
  else
    pass "tailscale key expiry is disabled"
  fi
  if tailscale debug prefs 2>/dev/null | grep -q '"RunSSH": *true'; then
    info "Tailscale SSH is enabled: port 22 on the tailnet IP is answered by Tailscale, not OpenSSH, and authorized_keys is ignored."
    info "Coolify then needs a tailnet SSH rule with action \"accept\". Only disable it (sudo tailscale set --ssh=false) if OpenSSH accepts Coolify's key."
  fi
fi

section "Firewall (UFW)"
if ! have ufw; then
  fail "ufw is not installed (apt install ufw)"
else
  ufw_v=$(ufw status verbose 2>/dev/null)
  if grep -q '^Status: active' <<<"$ufw_v"; then pass "ufw is active"; ufw_active=1; else fail "ufw is inactive"; fi
  if [ "$ufw_active" = 1 ]; then
    if grep -Eq 'Default: (deny|reject) \(incoming\)' <<<"$ufw_v"; then pass "default incoming policy is deny"; else fail "default incoming policy is not deny (sudo ufw default deny incoming)"; fi
    if grep -Eq '^IPV6=yes' /etc/default/ufw 2>/dev/null; then pass "ufw also filters IPv6"; else warn "ufw IPv6 filtering is off (/etc/default/ufw IPV6=no) and this server may have a public IPv6"; fi

    ts_rule=0
    declare -A seen_rule=()
    while IFS= read -r line; do
      line="${line%%#*}"
      [[ $line =~ ^(.*[^[:space:]])[[:space:]]+(ALLOW|LIMIT)(\ (IN|FWD))?[[:space:]]+(.*[^[:space:]])[[:space:]]*$ ]] || continue
      to="${BASH_REMATCH[1]}" from="${BASH_REMATCH[5]}"
      to="${to// (v6)/}" from="${from// (v6)/}"
      iface=''
      if [[ $to == *" on "* ]]; then iface="${to##* on }"; to="${to%% on *}"; fi
      if [ "$iface" = tailscale0 ]; then ts_rule=1; continue; fi
      [ -n "${seen_rule[$to|$from|$iface]:-}" ] && continue
      seen_rule[$to|$from|$iface]=1
      if [ "$from" != Anywhere ]; then info "rule: allow $to from $from${iface:+ on $iface}"; continue; fi
      case "$to" in
        Anywhere) fail "ufw allows ALL ports from anywhere${iface:+ on $iface}" ; continue ;;
        OpenSSH)  fail "ufw allows SSH (OpenSSH profile) from anywhere. Remove it: sudo ufw delete allow OpenSSH" ; continue ;;
        "Nginx Full" | "Apache Full" | "WWW Full") continue ;;
      esac
      ports="${to%%/*}"
      ports="${ports##* }"
      if ! [[ $ports =~ ^[0-9,:]+$ ]]; then warn "ufw allows '$to' from anywhere (app profile, check what it opens)"; continue; fi
      IFS=',' read -ra toks <<<"$ports"
      for t in "${toks[@]}"; do
        lo="${t%%:*}" hi="${t##*:}"
        if [ "$lo" -le 22 ] && [ "$hi" -ge 22 ]; then
          fail "ufw allows SSH (port $t) from anywhere. Remove it: sudo ufw delete allow $to"
        elif [ "$lo" = "$hi" ] && allowed "$lo"; then
          :
        else
          warn "ufw allows port $t from anywhere. Make sure that is intended."
        fi
      done
    done < <(ufw status 2>/dev/null)
    if [ "$ts_rule" = 1 ]; then pass "ufw allows tailnet traffic on tailscale0"; else warn "no 'allow in on tailscale0' rule, so tailnet SSH may be blocked (sudo ufw allow in on tailscale0)"; fi
  fi
fi

section "Host services listening on all interfaces"
if have ss; then
  found=0
  while read -r proto addr proc; do
    port="${addr##*:}" host="${addr%:*}"
    case "$proc" in *docker-proxy* | *tailscaled*) continue ;; esac
    case "$host" in 0.0.0.0 | "[::]" | "*" | "[::]%"* | "0.0.0.0%"*) ;; *) is_public_addr "${host%%%*}" || continue ;; esac
    allowed "$port" && continue
    found=1
    pname=$(sed -E 's/.*\(\("([^"]+)".*/\1/' <<<"$proc")
    if [ "$ufw_active" = 1 ]; then info "$proto $addr ($pname). Blocked by UFW unless a rule above allows it."; else warn "$proto $addr ($pname) is exposed because ufw is inactive"; fi
  done < <(ss -H -tulpn 2>/dev/null | awk '{print $1, $5, $7}')
  [ "$found" = 0 ] && pass "no unexpected host services on public interfaces"
fi

section "Docker published ports (these bypass UFW)"
if [ "$docker_ok" != 1 ]; then
  info "docker is not running or not installed, skipping"
else
  docker_user_rules=$(iptables -S DOCKER-USER 2>/dev/null | grep -v -e '^-N DOCKER-USER' -e '^-A DOCKER-USER -j RETURN$')
  [ -n "$docker_user_rules" ] && info "DOCKER-USER chain has custom rules, so some ports may be filtered. Confirm with external-check.sh."
  exposed=0
  declare -A seen_port=()
  while IFS=$'\t' read -r name ports; do
    IFS=',' read -ra items <<<"$ports"
    for it in "${items[@]}"; do
      it="${it# }"
      [[ $it == *"->"* ]] || continue
      hostpart="${it%%->*}" proto="${it##*/}"
      hport="${hostpart##*:}" hip="${hostpart%:*}"
      case "$hip" in 0.0.0.0 | "[::]" | :: | "") ;; *) is_public_addr "$hip" || continue ;; esac
      allowed "$hport" && continue
      key="$name|$hport|$proto"
      [ -n "${seen_port[$key]:-}" ] && continue
      seen_port[$key]=1
      exposed=1
      case "$name:$hport" in
        coolify:8000) msg="Coolify dashboard" ;;
        coolify:6001 | coolify:6002) msg="Coolify realtime" ;;
        coolify-proxy:8080) msg="Traefik dashboard/API port" ;;
        *) msg="" ;;
      esac
      if [ "$name:$hport" = coolify-proxy:8080 ]; then
        warn "container '$name' publishes $hport/$proto on $hip ($msg). Traefik usually does not listen there; confirm it shows closed with external-check.sh."
      elif [ -n "$docker_user_rules" ]; then
        warn "container '$name' publishes $hport/$proto on $hip${msg:+ ($msg)}. Possibly filtered by DOCKER-USER; verify externally."
      else
        fail "container '$name' publishes $hport/$proto on $hip${msg:+ ($msg)}. It is reachable from the internet even though UFW denies it."
      fi
    done
  done < <(docker ps --format '{{.Names}}\t{{.Ports}}')
  if [ "$exposed" = 0 ]; then
    pass "no containers publish ports other than: $ALLOWED_PUBLIC_PORTS"
  else
    info "Fix: remove the port mapping (route the app through the Coolify proxy with a domain),"
    info "or block the port in your provider's firewall or the DOCKER-USER iptables chain."
  fi
fi

if [ "$docker_ok" = 1 ] && docker ps --format '{{.Names}}' | grep -qx coolify; then
  section "Coolify control plane: SSH reachability to managed servers"
  envf=/data/coolify/source/.env
  dbu=$(sed -n 's/^DB_USERNAME=//p' "$envf" 2>/dev/null | head -1)
  dbn=$(sed -n 's/^DB_DATABASE=//p' "$envf" 2>/dev/null | head -1)
  rows=$(docker exec coolify-db psql -U "${dbu:-coolify}" -d "${dbn:-coolify}" -tA -F'|' \
    -c 'select name, ip, port, "user" from servers order by id' 2>/dev/null)
  if [ -z "$rows" ]; then
    info "could not read the server list from coolify-db, skipping"
  else
    while IFS='|' read -r sname sip sport suser; do
      [ -n "$sip" ] || continue
      out=$(docker exec coolify ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
        -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -p "$sport" "$suser@$sip" true 2>&1)
      case "$out" in
        "" | *"Permission denied"*) pass "Coolify reaches '$sname' at $suser@$sip:$sport" ;;
        *) fail "Coolify cannot reach '$sname' at $suser@$sip:$sport: $(tail -1 <<<"$out")" ;;
      esac
      case "$sip" in
        100.* | host.docker.internal | localhost | 127.* | *.ts.net) ;;
        *) warn "'$sname' uses $sip, which is not a Tailscale address, so SSH to it must be publicly reachable. Switch it to its 100.x IP." ;;
      esac
    done <<<"$rows"
  fi
fi

section "SSH daemon"
if have sshd; then
  cfg=$(sshd -T 2>/dev/null)
  sget() { awk -v k="$1" '$1 == k {print $2; exit}' <<<"$cfg"; }
  case "$(sget passwordauthentication)" in
    no) pass "password authentication is disabled" ;;
    *) fail "password authentication is enabled. Set 'PasswordAuthentication no' in /etc/ssh/sshd_config(.d), then: sudo systemctl reload ssh" ;;
  esac
  [ "$(sget kbdinteractiveauthentication)" = yes ] && warn "keyboard-interactive auth is enabled (set KbdInteractiveAuthentication no)"
  case "$(sget permitrootlogin)" in
    yes) warn "root can log in with a password. Use 'PermitRootLogin prohibit-password' (Coolify still works with keys)" ;;
    prohibit-password | without-password) pass "root login is key-only" ;;
    no) info "root login is disabled. Coolify then needs a non-root user configured for this server" ;;
  esac
  [ "$(sget pubkeyauthentication)" = no ] && fail "public key authentication is disabled"
else
  info "sshd not found, skipping"
fi

section "Authorized SSH keys (check you recognise every one)"
for f in /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys; do
  [ -f "$f" ] || continue
  info "$f:"
  ssh-keygen -lf "$f" 2>/dev/null | sed 's/^/         /'
done

section "Accounts"
extra_root=$(awk -F: '$3 == 0 && $1 != "root" {print $1}' /etc/passwd)
if [ -n "$extra_root" ]; then fail "non-root accounts with UID 0: $extra_root"; else pass "only root has UID 0"; fi
for g in sudo admin wheel docker; do
  members=$(getent group "$g" 2>/dev/null | cut -d: -f4)
  [ -n "$members" ] && info "group '$g': $members$([ "$g" = docker ] && echo '  (docker group = root-equivalent)')"
done

section "Updates"
if have apt-get; then
  if apt-config dump 2>/dev/null | grep -q 'APT::Periodic::Unattended-Upgrade "1"' && systemctl is-enabled unattended-upgrades >/dev/null 2>&1; then
    pass "unattended security upgrades are enabled"
  else
    warn "unattended upgrades are off (sudo apt install unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades)"
  fi
  sec=$(apt-get -s upgrade 2>/dev/null | grep -c '^Inst .*-security')
  if [ "$sec" -gt 0 ]; then warn "$sec security updates pending (sudo apt update && sudo apt upgrade)"; else pass "no pending security updates (as of the last apt update)"; fi
fi
[ -f /var/run/reboot-required ] && warn "a reboot is required to finish applying updates"

section "Summary for $(hostname)"
printf '%s%d FAIL%s, %s%d WARN%s\n' "$R" "$fails" "$N" "$Y" "$warns" "$N"
[ "$fails" -eq 0 ]

#!/usr/bin/env bash
# Probe servers' PUBLIC addresses from outside to see which ports the internet can reach.
# Usage: bash external-check.sh <public-ip> [<public-ip> ...]
# Optional: PORTS="22 80 443 8000" ALLOWED_PUBLIC_PORTS="80 443" bash external-check.sh ...
# Run from a machine that is NOT one of the servers (e.g. your laptop). Do not use a Tailscale exit node while running it.
set -u

PORTS="${PORTS:-22 80 443 3000 3306 5432 6001 6002 6379 8000 8080 8443 9000 27017}"
ALLOWED_PUBLIC_PORTS="${ALLOWED_PUBLIC_PORTS:-80 443}"
[ $# -gt 0 ] || { echo "Usage: bash $0 <public-ip> [<public-ip> ...]"; exit 2; }

if [ -t 1 ]; then R=$'\e[31m' G=$'\e[32m' B=$'\e[1m' N=$'\e[0m'; else R='' G='' B='' N=''; fi
probe() {
  if [ "$(uname)" = Darwin ]; then nc -z -G 3 -w 3 "$1" "$2" >/dev/null 2>&1; else nc -z -w 3 "$1" "$2" >/dev/null 2>&1; fi
}

bad=0
for host in "$@"; do
  case "$host" in 100.*) echo "$host is a Tailscale IP; pass the server's PUBLIC IP instead."; continue ;; esac
  printf '\n%s== %s ==%s\n' "$B" "$host" "$N"
  for p in $PORTS; do
    if probe "$host" "$p"; then
      case " $ALLOWED_PUBLIC_PORTS " in
        *" $p "*) printf '  %-6s open    (expected)\n' "$p" ;;
        *) printf '  %-6s %sOPEN    <- reachable from the internet%s\n' "$p" "$R" "$N"; bad=1 ;;
      esac
    else
      printf '  %-6s %sclosed%s\n' "$p" "$G" "$N"
    fi
  done
done
[ "$bad" -eq 0 ]