sysreport 1.1.3

package/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+## 1.1.3
+
+- Fixed npm global installs by resolving symlinked CLI launchers before locating runtime files.
+- Prepared npm metadata and GitHub release packaging for RPM/Debian artifacts.
+- Ensured RPM/Debian packages own runtime directories so package removal is clean.
+
+## 1.1.2
+
+- Improved WHM/cPanel output formatting for PHP-FPM units.
+- Added CSF, LFD, Imunify360, firewalld, and ufw service status checks.
+- Kept `--no-color` output clean by suppressing fastfetch's colored block.
+
+## 1.1.1
+
+- Fixed installed CLI version detection by installing `VERSION` with the runtime files.
+- Included `VERSION` in nFPM and RPM package layouts.
+
+## 1.1.0
+
+- Rebuilt SysReport as a modular CLI with a small launcher and reusable report modules.
+- Added CI smoke tests and GitHub release archive automation.
+- Added public project docs: README, contributing guide, security policy, license, and packaging metadata.
+- Added safer runtime behavior for public use: report-only execution, section filtering, and graceful skips for missing tools.
+
+## 1.0.2
+
+- Refactored the CLI into a modular runtime under `src/sysreport/`.
+- Added section filtering with `--section` and discovery with `--list-sections`.
+- Removed automatic dependency installation during report execution.
+- Updated package metadata and install paths for public distribution.
+
+## 1.0.0
+
+- Initial release.
+- Hardware audit.
+- Network audit.
+- PHP audit.
+- MySQL audit.
+- Security audit.
+- SEO audit.

package/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing
+
+Thanks for helping improve SysReport.
+
+## Local Checks
+
+```bash
+make check
+bash bin/sysreport --list-sections
+bash bin/sysreport --section system --no-color
+```
+
+## Adding a Report Section
+
+Create a new file under `src/sysreport/modules/` and register it:
+
+```bash
+report_example() {
+  sysreport_section "Example"
+  sysreport_item "Status" "ok"
+}
+
+sysreport_register_section "example" "Example report" "report_example"
+```
+
+Keep modules read-only by default. A report command should never install packages, restart services, edit configuration, or delete files.
+
+## Style
+
+- Prefer portable Bash and common Linux utilities.
+- Check for optional commands with `sysreport_have`.
+- If a command is missing or access is denied, print a skipped or unknown result instead of failing the whole report.
+- Keep output useful for humans first.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Amir Hossein Khateri
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,131 @@
+# SysReport
+
+SysReport is a lightweight Linux server audit CLI for sysadmins, DevOps engineers, and hosting operators. Run one command and get a practical summary of the server's health, identity, network, web stack, databases, security posture, and optimization signals.
+
+```bash
+sysreport
+```
+
+## Highlights
+
+- Modular Bash architecture: each report area lives in `src/sysreport/modules/`.
+- Safe by default: it does not install dependencies or change server configuration while reporting.
+- Works on generic Linux servers and adds extra context when cPanel/WHM, PHP, MySQL, Redis, Memcached, or common firewalls are detected.
+- Supports targeted checks with `--section`.
+- Friendly to package managers: npm, deb/rpm layouts, and manual install scripts are included.
+
+## Installation
+
+### Manual
+
+```bash
+git clone https://github.com/amirkhateri/sysreport.git
+cd sysreport
+bash scripts/install/install.sh
+sysreport
+```
+
+### npm
+
+```bash
+npm install -g sysreport
+sysreport
+```
+
+### Debian / Ubuntu and RPM
+
+Download packages from the GitHub release page, or install the RPM directly with `dnf`:
+
+```bash
+VERSION=1.1.3
+sudo dnf install -y "https://github.com/amirkhateri/sysreport/releases/download/v${VERSION}/sysreport-${VERSION}-1.noarch.rpm"
+```
+
+Debian/Ubuntu users can install the `.deb` package from the same release:
+
+```bash
+VERSION=1.1.3
+curl -LO "https://github.com/amirkhateri/sysreport/releases/download/v${VERSION}/sysreport_${VERSION}_all.deb"
+sudo apt install ./sysreport_${VERSION}_all.deb
+```
+
+Package templates are available under `templates/`, and release automation publishes `.deb` and `.rpm` artifacts.
+
+For GitHub releases, download the `sysreport-<version>.tar.gz` archive, extract it, and run the installer:
+
+```bash
+tar -xzf sysreport-<version>.tar.gz
+cd sysreport-<version>
+bash scripts/install/install.sh
+```
+
+## Usage
+
+```bash
+sysreport                 # run the full report
+sysreport --list-sections # show available sections
+sysreport --section system --section security
+sysreport --no-color
+sysreport --version
+```
+
+Current sections:
+
+- `system`
+- `identity`
+- `network`
+- `services`
+- `webstack`
+- `database`
+- `security`
+- `optimization`
+
+You can customize network ping targets:
+
+```bash
+SYSREPORT_PING_TARGETS="1.1.1.1 github.com example.com" sysreport --section network
+```
+
+## Optional Dependencies
+
+SysReport runs without these tools, but it reports more detail when they exist:
+
+- `curl` for public IP detection
+- `jq` for IP geolocation parsing
+- `fastfetch` for an optional system profile block
+- `systemctl`, `ss`, `ip`, `ping`, `free`, `df`, `awk`, `sed`, `grep`
+- `mysql`, `psql`, `php`, `nginx`, `httpd` or `apache2` for stack-specific checks
+
+## Development
+
+Run locally:
+
+```bash
+make run
+make sections
+```
+
+Syntax check:
+
+```bash
+make check
+```
+
+Add a new report module by creating a file in `src/sysreport/modules/`:
+
+```bash
+report_example() {
+  sysreport_section "Example"
+  sysreport_item "Status" "ok"
+}
+
+sysreport_register_section "example" "Example report" "report_example"
+```
+
+## Philosophy
+
+SysReport should be useful on the first run, readable by humans, conservative on production servers, and easy to extend. It reports what it can see and skips what is unavailable instead of failing the whole run.
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+SysReport is a read-only audit tool. Report modules should not change server state, install packages, restart services, or expose secrets.
+
+## Reporting a Vulnerability
+
+Please open a private security advisory or contact the maintainer from the repository profile if you find a vulnerability.
+
+When reporting, include:
+
+- affected version or commit
+- command used
+- operating system
+- impact
+- suggested fix, if known

package/VERSION

@@ -0,0 +1 @@
+1.1.3

package/bin/sysreport

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+resolve_lib_dir() {
+  local source bin_dir candidate
+  source="${BASH_SOURCE[0]}"
+
+  while [[ -L "$source" ]]; do
+    bin_dir="$(cd -- "$(dirname -- "$source")" >/dev/null 2>&1 && pwd -P)"
+    source="$(readlink "$source")"
+    [[ "$source" != /* ]] && source="$bin_dir/$source"
+  done
+
+  bin_dir="$(cd -- "$(dirname -- "$source")" >/dev/null 2>&1 && pwd -P)"
+
+  if [[ -n "${SYSREPORT_LIB_DIR:-}" && -f "$SYSREPORT_LIB_DIR/core.sh" ]]; then
+    printf '%s\n' "$SYSREPORT_LIB_DIR"
+    return 0
+  fi
+
+  for candidate in \
+    "$bin_dir/../src/sysreport" \
+    "$bin_dir/../lib/sysreport" \
+    "/usr/local/lib/sysreport" \
+    "/usr/lib/sysreport"; do
+    if [[ -f "$candidate/core.sh" ]]; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+SYSREPORT_LIB_DIR="$(resolve_lib_dir)" || {
+  echo "sysreport: unable to find runtime files. Set SYSREPORT_LIB_DIR to the sysreport library path." >&2
+  exit 1
+}
+
+# shellcheck source=/dev/null
+source "$SYSREPORT_LIB_DIR/core.sh"
+
+shopt -s nullglob
+for module in "$SYSREPORT_LIB_DIR"/modules/*.sh; do
+  # shellcheck source=/dev/null
+  source "$module"
+done
+shopt -u nullglob
+
+sysreport_main "$@"

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "sysreport",
+  "version": "1.1.3",
+  "description": "Linux server audit and operations summary CLI",
+  "license": "MIT",
+  "os": [
+    "linux"
+  ],
+  "author": "Amir Hossein Khateri",
+  "homepage": "https://github.com/amirkhateri/sysreport",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/amirkhateri/sysreport.git"
+  },
+  "bin": {
+    "sysreport": "bin/sysreport"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "README.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    "LICENSE",
+    "VERSION"
+  ],
+  "keywords": [
+    "linux",
+    "server",
+    "audit",
+    "sysadmin",
+    "devops",
+    "monitoring"
+  ]
+}

package/src/sysreport/core.sh

@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+
+SYSREPORT_NAME="sysreport"
+SYSREPORT_DESCRIPTION="Linux server audit and operations summary"
+SYSREPORT_VERSION="${SYSREPORT_VERSION:-dev}"
+
+if [[ -z "${SYSREPORT_ROOT:-}" ]]; then
+  SYSREPORT_ROOT="$(cd -- "${SYSREPORT_LIB_DIR:-$(pwd)}/../.." >/dev/null 2>&1 && pwd -P)"
+fi
+
+if [[ -n "${SYSREPORT_LIB_DIR:-}" && -f "$SYSREPORT_LIB_DIR/VERSION" ]]; then
+  SYSREPORT_VERSION="$(tr -d '[:space:]' < "$SYSREPORT_LIB_DIR/VERSION")"
+elif [[ -f "$SYSREPORT_ROOT/VERSION" ]]; then
+  SYSREPORT_VERSION="$(tr -d '[:space:]' < "$SYSREPORT_ROOT/VERSION")"
+fi
+
+SYSREPORT_SECTION_IDS=()
+SYSREPORT_SECTION_TITLES=()
+SYSREPORT_SECTION_FUNCS=()
+SYSREPORT_SELECTED_SECTIONS=()
+SYSREPORT_COLOR=1
+
+if [[ ! -t 1 || -n "${NO_COLOR:-}" || "${TERM:-}" == "dumb" ]]; then
+  SYSREPORT_COLOR=0
+fi
+
+sysreport_use_color() {
+  [[ "$SYSREPORT_COLOR" -eq 1 ]]
+}
+
+sysreport_color() {
+  local code="$1"
+  if sysreport_use_color; then
+    printf '\033[%sm' "$code"
+  fi
+}
+
+sysreport_refresh_colors() {
+  SR_RESET="$(sysreport_color 0)"
+  SR_BOLD="$(sysreport_color 1)"
+  SR_BLUE="$(sysreport_color '0;34')"
+  SR_CYAN="$(sysreport_color '0;36')"
+  SR_GREEN="$(sysreport_color '0;32')"
+  SR_YELLOW="$(sysreport_color '1;33')"
+  SR_RED="$(sysreport_color '0;31')"
+}
+
+sysreport_refresh_colors
+
+sysreport_have() {
+  command -v "$1" >/dev/null 2>&1
+}
+
+sysreport_read_os_release() {
+  if [[ -r /etc/os-release ]]; then
+    (
+      # shellcheck disable=SC1091
+      source /etc/os-release
+      printf '%s\n' "${PRETTY_NAME:-${NAME:-Linux}}"
+    )
+  else
+    uname -s
+  fi
+}
+
+sysreport_register_section() {
+  local id="$1" title="$2" fn="$3"
+  SYSREPORT_SECTION_IDS+=("$id")
+  SYSREPORT_SECTION_TITLES+=("$title")
+  SYSREPORT_SECTION_FUNCS+=("$fn")
+}
+
+sysreport_is_selected() {
+  local id="$1" selected
+  if [[ "${#SYSREPORT_SELECTED_SECTIONS[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  for selected in "${SYSREPORT_SELECTED_SECTIONS[@]}"; do
+    [[ "$selected" == "$id" ]] && return 0
+  done
+
+  return 1
+}
+
+sysreport_header() {
+  printf '%s\n' "${SR_BLUE}${SR_BOLD}============================================================${SR_RESET}"
+  printf '%s\n' "${SR_CYAN}${SR_BOLD}  SysReport ${SYSREPORT_VERSION} - ${SYSREPORT_DESCRIPTION}${SR_RESET}"
+  printf '%s\n' "${SR_BLUE}${SR_BOLD}============================================================${SR_RESET}"
+}
+
+sysreport_section() {
+  printf '\n%s\n' "${SR_BLUE}${SR_BOLD}-- $1 --${SR_RESET}"
+}
+
+sysreport_item() {
+  printf '%b%s:%b %s\n' "${SR_GREEN}" "$1" "${SR_RESET}" "${2:-}"
+}
+
+sysreport_ok() {
+  printf '  [%bOK%b] %s\n' "$SR_GREEN" "$SR_RESET" "$1"
+}
+
+sysreport_warn() {
+  printf '  [%bWARN%b] %s\n' "$SR_YELLOW" "$SR_RESET" "$1"
+}
+
+sysreport_fail() {
+  printf '  [%bFAIL%b] %s\n' "$SR_RED" "$SR_RESET" "$1"
+}
+
+sysreport_unknown() {
+  printf '  [%bSKIP%b] %s\n' "$SR_YELLOW" "$SR_RESET" "$1"
+}
+
+sysreport_usage() {
+  cat <<EOF
+SysReport - Linux server audit and operations summary
+
+Usage:
+  sysreport [options]
+
+Options:
+  -h, --help              Show this help message
+  -v, --version           Show version
+      --no-color          Disable colored output
+      --list-sections     List available report sections
+      --section <id>      Run one section; repeat to run multiple sections
+
+Examples:
+  sysreport
+  sysreport --section system --section security
+  NO_COLOR=1 sysreport
+EOF
+}
+
+sysreport_list_sections() {
+  local i
+  for i in "${!SYSREPORT_SECTION_IDS[@]}"; do
+    printf '%-14s %s\n' "${SYSREPORT_SECTION_IDS[$i]}" "${SYSREPORT_SECTION_TITLES[$i]}"
+  done
+}
+
+sysreport_parse_args() {
+  while [[ "$#" -gt 0 ]]; do
+    case "$1" in
+      -h|--help)
+        sysreport_usage
+        exit 0
+        ;;
+      -v|--version)
+        printf '%s\n' "$SYSREPORT_VERSION"
+        exit 0
+        ;;
+      --no-color)
+        SYSREPORT_COLOR=0
+        ;;
+      --list-sections)
+        sysreport_list_sections
+        exit 0
+        ;;
+      --section)
+        if [[ -z "${2:-}" ]]; then
+          echo "sysreport: --section requires a section id" >&2
+          exit 2
+        fi
+        SYSREPORT_SELECTED_SECTIONS+=("$2")
+        shift
+        ;;
+      *)
+        echo "sysreport: unknown option: $1" >&2
+        echo "Try 'sysreport --help'." >&2
+        exit 2
+        ;;
+    esac
+    shift
+  done
+}
+
+sysreport_main() {
+  local i fn matched=0
+  sysreport_parse_args "$@"
+  sysreport_refresh_colors
+  sysreport_header
+
+  for i in "${!SYSREPORT_SECTION_IDS[@]}"; do
+    if sysreport_is_selected "${SYSREPORT_SECTION_IDS[$i]}"; then
+      matched=1
+      fn="${SYSREPORT_SECTION_FUNCS[$i]}"
+      "$fn"
+    fi
+  done
+
+  if [[ "$matched" -eq 0 ]]; then
+    echo "sysreport: no matching sections selected" >&2
+    exit 2
+  fi
+
+  printf '\n%s\n' "${SR_BLUE}${SR_BOLD}============================================================${SR_RESET}"
+  printf '%s\n' "${SR_GREEN}${SR_BOLD}Report complete.${SR_RESET}"
+}

package/src/sysreport/modules/10-system.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+report_system() {
+  local os kernel uptime_text load_avg cpu_cores memory_line swap_line root_usage
+
+  sysreport_section "System Summary"
+
+  os="$(sysreport_read_os_release)"
+  kernel="$(uname -r 2>/dev/null || echo unknown)"
+  uptime_text="$(uptime -p 2>/dev/null || uptime 2>/dev/null || echo unknown)"
+  load_avg="$(uptime 2>/dev/null | awk -F'load average: ' '{print $2}' || true)"
+  cpu_cores="$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo unknown)"
+  memory_line="$(free -h 2>/dev/null | awk '/^Mem:/ {print $3 " used / " $2 " total"}')"
+  swap_line="$(free -h 2>/dev/null | awk '/^Swap:/ {print $3 " used / " $2 " total"}')"
+  root_usage="$(df -h / 2>/dev/null | awk 'NR==2 {print $5 " used on " $1 " (" $4 " free)"}')"
+
+  sysreport_item "OS" "$os"
+  sysreport_item "Kernel" "$kernel"
+  sysreport_item "Uptime" "$uptime_text"
+  sysreport_item "CPU cores" "$cpu_cores"
+  sysreport_item "Load average" "${load_avg:-unknown}"
+  sysreport_item "Memory" "${memory_line:-unknown}"
+  sysreport_item "Swap" "${swap_line:-unknown}"
+  sysreport_item "Root filesystem" "${root_usage:-unknown}"
+
+  if sysreport_have fastfetch && sysreport_use_color; then
+    printf '\n'
+    fastfetch --pipe false 2>/dev/null || true
+  fi
+}
+
+sysreport_register_section "system" "System summary" "report_system"

package/src/sysreport/modules/20-identity.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+report_identity() {
+  local hostname_value private_ipv4 public_ipv4 public_ipv6 location ip_info country city
+
+  sysreport_section "Identity and Location"
+
+  hostname_value="$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo unknown)"
+  private_ipv4="$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')"
+
+  if sysreport_have curl; then
+    public_ipv4="$(curl -fsS --max-time 3 -4 https://icanhazip.com 2>/dev/null | head -n1 || true)"
+    public_ipv6="$(curl -fsS --max-time 3 -6 https://icanhazip.com 2>/dev/null | head -n1 || true)"
+  fi
+
+  sysreport_item "Hostname" "$hostname_value"
+  sysreport_item "Primary IPv4" "${private_ipv4:-unknown}"
+  sysreport_item "Public IPv4" "${public_ipv4:-unknown}"
+  sysreport_item "Public IPv6" "${public_ipv6:-not detected}"
+
+  if [[ -n "${public_ipv4:-}" ]] && sysreport_have curl && sysreport_have jq; then
+    ip_info="$(curl -fsS --max-time 4 "http://ip-api.com/json/${public_ipv4}" 2>/dev/null || true)"
+    country="$(printf '%s' "$ip_info" | jq -r '.country // empty' 2>/dev/null || true)"
+    city="$(printf '%s' "$ip_info" | jq -r '.city // empty' 2>/dev/null || true)"
+    location="$(printf '%s, %s' "${city:-unknown}" "${country:-unknown}")"
+    sysreport_item "Geolocation" "$location"
+  else
+    sysreport_item "Geolocation" "skipped (requires curl, jq, and public IPv4)"
+  fi
+}
+
+sysreport_register_section "identity" "Host identity and public IP" "report_identity"

package/src/sysreport/modules/30-network.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+report_network_ping() {
+  local target="$1" ms
+  if ! sysreport_have ping; then
+    sysreport_unknown "ping command not available"
+    return 0
+  fi
+
+  ms="$(ping -c 1 -W 2 "$target" 2>/dev/null | awk -F'time=' '/time=/{print $2}' | awk '{print $1; exit}')"
+  if [[ -n "$ms" ]]; then
+    sysreport_ok "$target reachable (${ms} ms)"
+  else
+    sysreport_warn "$target timeout or unreachable"
+  fi
+}
+
+report_network() {
+  local targets target
+
+  sysreport_section "Network"
+
+  targets="${SYSREPORT_PING_TARGETS:-1.1.1.1 google.com github.com}"
+  sysreport_item "Ping targets" "$targets"
+  for target in $targets; do
+    report_network_ping "$target"
+  done
+
+  printf '\n'
+  sysreport_item "DNS resolvers" ""
+  if [[ -r /etc/resolv.conf ]]; then
+    awk '/^nameserver/ {print "  " $2}' /etc/resolv.conf
+  else
+    sysreport_unknown "/etc/resolv.conf is not readable"
+  fi
+
+  printf '\n'
+  sysreport_item "Listening TCP ports" ""
+  if sysreport_have ss; then
+    ss -H -tln 2>/dev/null | awk '{print "  " $4}' | sed 's/.*://' | sort -n | uniq | head -n 30
+  else
+    sysreport_unknown "ss command not available"
+  fi
+}
+
+sysreport_register_section "network" "Network diagnostics" "report_network"

package/src/sysreport/modules/40-services.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+report_service_status() {
+  local label="$1" unit="$2"
+
+  if ! sysreport_have systemctl; then
+    sysreport_unknown "systemctl not available for $label"
+    return 0
+  fi
+
+  if systemctl list-unit-files --no-legend "$unit" 2>/dev/null | grep -q . || \
+    systemctl list-units --no-legend "$unit" 2>/dev/null | grep -q .; then
+    if systemctl is-active --quiet "$unit" 2>/dev/null; then
+      sysreport_ok "$label active ($unit)"
+    else
+      sysreport_warn "$label installed but not active ($unit)"
+    fi
+  else
+    sysreport_unknown "$label not detected ($unit)"
+  fi
+}
+
+report_services() {
+  sysreport_section "Core Services"
+
+  report_service_status "OpenSSH" "sshd.service"
+  report_service_status "Nginx" "nginx.service"
+  report_service_status "Apache httpd" "httpd.service"
+  report_service_status "Apache apache2" "apache2.service"
+  report_service_status "MariaDB" "mariadb.service"
+  report_service_status "MySQL" "mysql.service"
+  report_service_status "PostgreSQL" "postgresql.service"
+  report_service_status "Redis" "redis.service"
+  report_service_status "Memcached" "memcached.service"
+  report_service_status "Docker" "docker.service"
+}
+
+sysreport_register_section "services" "Core service status" "report_services"

package/src/sysreport/modules/50-webstack.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+report_webstack() {
+  local apache_version nginx_version php_version cpanel_version accounts suspended fpm_services disabled_functions
+
+  sysreport_section "Web Stack"
+
+  if sysreport_have httpd; then
+    apache_version="$(httpd -v 2>/dev/null | awk 'NR==1 {print $3}')"
+    sysreport_item "Apache" "${apache_version:-detected}"
+  elif sysreport_have apache2; then
+    apache_version="$(apache2 -v 2>/dev/null | awk 'NR==1 {print $3}')"
+    sysreport_item "Apache" "${apache_version:-detected}"
+  else
+    sysreport_item "Apache" "not detected"
+  fi
+
+  if sysreport_have nginx; then
+    nginx_version="$(nginx -v 2>&1 | sed 's/^nginx version: //')"
+    sysreport_item "Nginx" "${nginx_version:-detected}"
+  else
+    sysreport_item "Nginx" "not detected"
+  fi
+
+  if pgrep -af 'litespeed|lshttpd' >/dev/null 2>&1; then
+    sysreport_item "LiteSpeed" "running"
+  else
+    sysreport_item "LiteSpeed" "not detected"
+  fi
+
+  if sysreport_have php; then
+    php_version="$(php -v 2>/dev/null | awk 'NR==1 {print $1 " " $2}')"
+    disabled_functions="$(php -r 'echo ini_get("disable_functions");' 2>/dev/null || true)"
+    sysreport_item "PHP CLI" "${php_version:-detected}"
+    sysreport_item "PHP OPcache" "$(php -v 2>/dev/null | grep -iq opcache && echo enabled || echo not detected)"
+    sysreport_item "PHP disable_functions" "${disabled_functions:-empty}"
+  else
+    sysreport_item "PHP CLI" "not detected"
+  fi
+
+  if sysreport_have systemctl; then
+    fpm_services="$(systemctl list-units --type=service --no-legend 2>/dev/null | awk '/php.*fpm|ea-php.*fpm/ {print $1 " " $4}' | head -n 20)"
+    sysreport_item "PHP-FPM units" ""
+    if [[ -n "$fpm_services" ]]; then
+      printf '%s\n' "$fpm_services" | awk '{print "  " $1 ": " $2}'
+    else
+      sysreport_unknown "none detected"
+    fi
+  fi
+
+  if [[ -x /usr/local/cpanel/cpanel ]]; then
+    cpanel_version="$(/usr/local/cpanel/cpanel -V 2>/dev/null || true)"
+    accounts="$(find /var/cpanel/users -maxdepth 1 -type f 2>/dev/null | wc -l | tr -d ' ')"
+    suspended="$(find /var/cpanel/suspended -maxdepth 1 -type f 2>/dev/null | wc -l | tr -d ' ')"
+    sysreport_item "cPanel/WHM" "version ${cpanel_version:-unknown}; accounts ${accounts:-0}; suspended ${suspended:-0}"
+  else
+    sysreport_item "cPanel/WHM" "not detected"
+  fi
+}
+
+sysreport_register_section "webstack" "Web, PHP, and cPanel profile" "report_webstack"

package/src/sysreport/modules/60-database.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+report_database() {
+  local mysql_version slow_log buffer_pool pg_version
+
+  sysreport_section "Database"
+
+  if sysreport_have mysql; then
+    mysql_version="$(mysql -V 2>/dev/null)"
+    sysreport_item "MySQL client" "${mysql_version:-detected}"
+
+    slow_log="$(mysql --batch --skip-column-names -e "SHOW VARIABLES LIKE 'slow_query_log';" 2>/dev/null | awk '{print $2}' || true)"
+    sysreport_item "MySQL slow query log" "${slow_log:-unknown or access denied}"
+
+    buffer_pool="$(mysql --batch --skip-column-names -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size';" 2>/dev/null | awk '{printf "%.2f GB", $2/1024/1024/1024}' || true)"
+    sysreport_item "InnoDB buffer pool" "${buffer_pool:-unknown or access denied}"
+  else
+    sysreport_item "MySQL client" "not detected"
+  fi
+
+  if sysreport_have psql; then
+    pg_version="$(psql --version 2>/dev/null)"
+    sysreport_item "PostgreSQL client" "${pg_version:-detected}"
+  else
+    sysreport_item "PostgreSQL client" "not detected"
+  fi
+}
+
+sysreport_register_section "database" "Database summary" "report_database"

package/src/sysreport/modules/70-security.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+report_security_port() {
+  local port="$1" service
+  if sysreport_have ss && ss -H -tln 2>/dev/null | awk '{print $4}' | grep -Eq "[:.]${port}$"; then
+    service="$(ss -H -tlnp 2>/dev/null | awk -v port="$port" '$4 ~ ":" port "$" {print $0; exit}' | sed 's/.*users:(("//; s/".*//')"
+    sysreport_ok "port $port open${service:+ ($service)}"
+  else
+    sysreport_warn "port $port closed or not visible"
+  fi
+}
+
+report_security_unit() {
+  local label="$1" unit="$2" status
+
+  if ! sysreport_have systemctl; then
+    return 1
+  fi
+
+  if ! systemctl list-unit-files --no-legend "$unit" 2>/dev/null | grep -q . && \
+    ! systemctl list-units --no-legend "$unit" 2>/dev/null | grep -q .; then
+    return 1
+  fi
+
+  status="$(systemctl is-active "$unit" 2>/dev/null || true)"
+  case "$status" in
+    active)
+      sysreport_ok "$label active ($unit)"
+      ;;
+    failed)
+      sysreport_fail "$label installed but failed ($unit)"
+      ;;
+    inactive|deactivating|activating)
+      sysreport_warn "$label installed but $status ($unit)"
+      ;;
+    *)
+      sysreport_warn "$label installed but status is ${status:-unknown} ($unit)"
+      ;;
+  esac
+
+  return 0
+}
+
+report_security() {
+  local ssh_config ssh_port root_login password_auth found_security_unit
+
+  sysreport_section "Security"
+
+  ssh_config="/etc/ssh/sshd_config"
+  if [[ -r "$ssh_config" ]]; then
+    ssh_port="$(awk 'tolower($1)=="port" {print $2; exit}' "$ssh_config")"
+    root_login="$(awk 'tolower($1)=="permitrootlogin" {print $2; exit}' "$ssh_config")"
+    password_auth="$(awk 'tolower($1)=="passwordauthentication" {print $2; exit}' "$ssh_config")"
+  fi
+
+  sysreport_item "SSH port" "${ssh_port:-22}"
+  [[ "${ssh_port:-22}" == "22" ]] && sysreport_warn "SSH is using the default port 22" || sysreport_ok "SSH port is customized"
+  sysreport_item "SSH root login" "${root_login:-default}"
+  [[ "${root_login:-}" == "yes" ]] && sysreport_warn "PermitRootLogin is enabled" || sysreport_ok "PermitRootLogin is not explicitly enabled"
+  sysreport_item "SSH password auth" "${password_auth:-default}"
+
+  printf '\n'
+  sysreport_item "Firewall and hardening services" ""
+  found_security_unit=0
+  report_security_unit "CSF firewall" "csf.service" && found_security_unit=1
+  report_security_unit "LFD login failure daemon" "lfd.service" && found_security_unit=1
+  report_security_unit "Imunify360" "imunify360.service" && found_security_unit=1
+  report_security_unit "firewalld" "firewalld.service" && found_security_unit=1
+  report_security_unit "ufw" "ufw.service" && found_security_unit=1
+  [[ "$found_security_unit" -eq 0 ]] && sysreport_unknown "no common firewall or hardening service detected"
+
+  if sysreport_have fail2ban-client; then
+    sysreport_item "Fail2ban" "$(fail2ban-client ping 2>/dev/null | tr '\n' ' ' || echo detected)"
+  else
+    sysreport_item "Fail2ban" "not detected"
+  fi
+
+  printf '\n'
+  sysreport_item "Common exposed ports" ""
+  for port in 22 80 443 3306 5432 6379 8080 2083 2087; do
+    report_security_port "$port"
+  done
+}
+
+sysreport_register_section "security" "Security posture" "report_security"

package/src/sysreport/modules/80-optimization.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+report_optimization() {
+  local disk_usage load_one cpu_cores swap_used disabled_funcs
+
+  sysreport_section "Optimization Checks"
+
+  disk_usage="$(df / 2>/dev/null | awk 'NR==2 {gsub("%","",$5); print $5}')"
+  if [[ -n "$disk_usage" && "$disk_usage" -ge 85 ]]; then
+    sysreport_fail "root disk usage is high (${disk_usage}%)"
+  elif [[ -n "$disk_usage" ]]; then
+    sysreport_ok "root disk usage is healthy (${disk_usage}%)"
+  else
+    sysreport_unknown "root disk usage unavailable"
+  fi
+
+  load_one="$(uptime 2>/dev/null | awk -F'load average: ' '{print $2}' | cut -d, -f1 | tr -d ' ')"
+  cpu_cores="$(nproc 2>/dev/null || echo 1)"
+  if [[ -n "${load_one:-}" ]] && awk "BEGIN {exit !($load_one > $cpu_cores)}" 2>/dev/null; then
+    sysreport_warn "1-minute load (${load_one}) is above CPU cores (${cpu_cores})"
+  else
+    sysreport_ok "1-minute load (${load_one:-unknown}) is within CPU capacity (${cpu_cores})"
+  fi
+
+  swap_used="$(free -m 2>/dev/null | awk '/^Swap:/ {print $3}')"
+  if [[ -n "$swap_used" && "$swap_used" -gt 500 ]]; then
+    sysreport_warn "swap usage is above 500 MB (${swap_used} MB)"
+  elif [[ -n "$swap_used" ]]; then
+    sysreport_ok "swap usage is low (${swap_used} MB)"
+  else
+    sysreport_unknown "swap usage unavailable"
+  fi
+
+  if pgrep -af 'redis-server|memcached' >/dev/null 2>&1; then
+    sysreport_ok "object cache service detected"
+  else
+    sysreport_warn "no Redis or Memcached process detected"
+  fi
+
+  if sysreport_have php; then
+    disabled_funcs="$(php -r 'echo ini_get("disable_functions");' 2>/dev/null || true)"
+    if [[ -z "$disabled_funcs" ]]; then
+      sysreport_warn "PHP disable_functions is empty"
+    else
+      sysreport_ok "PHP disable_functions is configured"
+    fi
+  else
+    sysreport_unknown "PHP CLI not available for PHP hardening check"
+  fi
+}
+
+sysreport_register_section "optimization" "Operational optimization checks" "report_optimization"