#!/bin/sh
# i1.is Server Hardening Script
# Cheet says: Let's lock down your server!
set -e

echo ""
echo "╔═══════════════════════════════════════════════════════════════╗"
echo "║  i1.is Server Hardening                                        ║"
echo "║  Cheet says: Making your server Fort Knox!                     ║"
echo "╚═══════════════════════════════════════════════════════════════╝"
echo ""

# Detect package manager
if command -v apt >/dev/null 2>&1; then
    PKG_MGR="apt"
    INSTALL="apt install -y"
    UPDATE="apt update"
elif command -v pacman >/dev/null 2>&1; then
    PKG_MGR="pacman"
    INSTALL="pacman -S --noconfirm"
    UPDATE="pacman -Sy"
elif command -v yum >/dev/null 2>&1; then
    PKG_MGR="yum"
    INSTALL="yum install -y"
    UPDATE="yum update"
else
    echo "Unsupported package manager"
    exit 1
fi

echo "Detected package manager: $PKG_MGR"
echo ""

# Menu
echo "What would you like to harden?"
echo ""
echo "  1) Install UFW + Fail2ban (firewall & intrusion prevention)"
echo "  2) Harden SSH configuration"
echo "  3) Install and configure automatic updates"
echo "  4) Full hardening (all of the above)"
echo ""
echo "  0) Exit"
echo ""

printf "Select option [0-4]: "
read -r choice </dev/tty

case $choice in
    1)
        echo "Installing UFW and Fail2ban..."
        sudo $UPDATE
        sudo $INSTALL ufw fail2ban

        # Configure UFW
        sudo ufw default deny incoming
        sudo ufw default allow outgoing
        sudo ufw allow ssh
        sudo ufw --force enable

        # Configure Fail2ban
        sudo systemctl enable fail2ban
        sudo systemctl start fail2ban

        echo "✓ Firewall and Fail2ban installed!"
        ;;
    2)
        echo "Hardening SSH..."
        # Backup original config
        sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

        echo ""
        echo "Recommended SSH settings:"
        echo "  - Disable root login"
        echo "  - Use key-based auth only"
        echo "  - Change default port (optional)"
        echo ""
        echo "Run: sudo nano /etc/ssh/sshd_config"
        ;;
    3)
        echo "Setting up automatic updates..."
        case "$PKG_MGR" in
            apt)
                sudo $INSTALL unattended-upgrades
                sudo dpkg-reconfigure -plow unattended-upgrades
                ;;
            pacman)
                echo "For Arch, consider using 'pacman-contrib' timer"
                ;;
        esac
        ;;
    4)
        echo "Full hardening coming soon!"
        ;;
    0)
        echo "Goodbye!"
        exit 0
        ;;
esac

echo ""
echo "✓ Done! Your server is more secure now."
echo "Learn more: curl i1.is/cheet/security"