#!/usr/bin/env bash
set -Eeuo pipefail

red() { printf '\033[31m%s\033[0m\n' "$*"; }
green() { printf '\033[32m%s\033[0m\n' "$*"; }
yellow() { printf '\033[33m%s\033[0m\n' "$*"; }
blue() { printf '\033[36m%s\033[0m\n' "$*"; }

section() {
  echo
  blue "===== $* ====="
}

run() {
  echo "# $*"
  "$@" 2>&1 || true
}

section "Host"
echo "HOST=$(hostname -f 2>/dev/null || hostname)"
echo "DATE=$(date -Is)"
echo "UPTIME=$(uptime -p 2>/dev/null || true)"
echo "KERNEL=$(uname -r)"
if [[ -r /etc/os-release ]]; then
  . /etc/os-release
  echo "OS=${PRETTY_NAME:-unknown}"
fi
echo "IP4=$(hostname -I 2>/dev/null | xargs || true)"

section "CPU / Memory / Load"
run nproc
run uptime
run free -h

section "Disk"
run df -hT / /root /var /opt 2>/dev/null
run lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINT 2>/dev/null

section "Failed systemd units"
if command -v systemctl >/dev/null 2>&1; then
  systemctl --failed --no-legend 2>/dev/null || true
else
  yellow "systemctl not found"
fi

section "Important service status"
if command -v systemctl >/dev/null 2>&1; then
  for s in ssh sshd nginx docker containerd frps frpc xray sing-box AdGuardHome adguardhome hermes-gateway codex-proxy realm ddns-go rustdesk-hbbs rustdesk-hbbr; do
    if systemctl list-unit-files "$s.service" >/dev/null 2>&1 || systemctl status "$s" >/dev/null 2>&1; then
      state=$(systemctl is-active "$s" 2>/dev/null || true)
      enabled=$(systemctl is-enabled "$s" 2>/dev/null || true)
      printf '%-24s active=%-10s enabled=%s\n' "$s" "${state:-unknown}" "${enabled:-unknown}"
    fi
  done
fi

section "Listening ports"
if command -v ss >/dev/null 2>&1; then
  ss -lntup 2>/dev/null | sed -n '1,160p'
else
  yellow "ss not found"
fi

section "Firewall"
if command -v ufw >/dev/null 2>&1; then
  run ufw status verbose
fi
if command -v nft >/dev/null 2>&1; then
  run nft list ruleset | sed -n '1,120p'
elif command -v iptables >/dev/null 2>&1; then
  run iptables -S | sed -n '1,120p'
fi

section "Network checks"
for target in dl.unvmax.com github.com 1.1.1.1; do
  if command -v curl >/dev/null 2>&1; then
    printf '%-18s ' "$target"
    curl --noproxy '*' -I -L --connect-timeout 5 --max-time 10 "https://${target}" 2>/dev/null | head -1 || true
  fi
done

section "Top processes"
run ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head -15

section "Package updates"
if command -v apt >/dev/null 2>&1; then
  apt list --upgradable 2>/dev/null | sed -n '1,30p' || true
elif command -v dnf >/dev/null 2>&1; then
  dnf check-update 2>/dev/null | sed -n '1,30p' || true
fi

section "Recent errors"
if command -v journalctl >/dev/null 2>&1; then
  journalctl -p err -n 40 --no-pager 2>/dev/null || true
fi

section "Timers"
if command -v systemctl >/dev/null 2>&1; then
  systemctl list-timers --all --no-pager 2>/dev/null | grep -E 'apt|fstrim|logrotate|unattended|certbot|backup' || true
fi

section "Summary"
green "Server health collection completed. Review failed units, disk usage, exposed ports, and recent errors above."