status.sh

#!/usr/bin/env bash
# ============================================================================
# WireGuard Status & Diagnostics
# Enterprise WireGuard Deployment
# ============================================================================
# Usage: sudo ./status.sh
# ============================================================================

set -euo pipefail

WG_INTERFACE="wg0"
SSH_PORT="${SSH_PORT:-5522}"
WG_PORT="${WG_PORT:-51820}"

GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
NC='\033[0m'

ok()   { echo -e "  ${GREEN}✓${NC} $*"; }
fail() { echo -e "  ${RED}✗${NC} $*"; }
warn() { echo -e "  ${YELLOW}!${NC} $*"; }

echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║          WireGuard VPN — System Status Report              ║"
echo "╠══════════════════════════════════════════════════════════════╣"
echo "║  $(date -u +'%Y-%m-%d %H:%M:%S UTC')                                   ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""

# ── System Info ─────────────────────────────────────────────────────────────
echo -e "${BOLD}System${NC}"
echo -e "  Hostname:    $(hostname)"
echo -e "  OS:          $(lsb_release -ds 2>/dev/null || cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d '"')"
echo -e "  Kernel:      $(uname -r)"
echo -e "  Uptime:      $(uptime -p)"
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 https://ifconfig.me 2>/dev/null || echo "N/A")
echo -e "  Public IP:   ${PUBLIC_IP}"
echo ""

# ── WireGuard Status ────────────────────────────────────────────────────────
echo -e "${BOLD}WireGuard${NC}"
if systemctl is-active --quiet wg-quick@${WG_INTERFACE} 2>/dev/null; then
    ok "Service: running"
else
    fail "Service: stopped"
fi

if ip link show ${WG_INTERFACE} > /dev/null 2>&1; then
    ok "Interface: up"
else
    fail "Interface: down"
fi

# Peer count
PEER_COUNT=$(wg show ${WG_INTERFACE} peers 2>/dev/null | wc -l)
echo -e "  Peers:       ${PEER_COUNT} configured"

# Connected peers (handshake within last 3 minutes = 180 seconds)
if [[ ${PEER_COUNT} -gt 0 ]]; then
    CONNECTED=0
    while IFS= read -r peer; do
        LAST_HS=$(wg show ${WG_INTERFACE} latest-handshakes 2>/dev/null | grep "${peer}" | awk '{print $2}')
        if [[ -n "${LAST_HS}" && "${LAST_HS}" != "0" ]]; then
            NOW=$(date +%s)
            AGE=$((NOW - LAST_HS))
            if [[ ${AGE} -lt 180 ]]; then
                CONNECTED=$((CONNECTED + 1))
            fi
        fi
    done < <(wg show ${WG_INTERFACE} peers 2>/dev/null)
    echo -e "  Connected:   ${CONNECTED} active (handshake < 3min)"
fi
echo ""

# ── Kernel Parameters ──────────────────────────────────────────────────────
echo -e "${BOLD}Kernel Tuning${NC}"
CC=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)
[[ "${CC}" == "bbr" ]] && ok "TCP BBR: enabled" || fail "TCP BBR: disabled (current: ${CC})"

QDISC=$(sysctl -n net.core.default_qdisc 2>/dev/null)
[[ "${QDISC}" == "fq" ]] && ok "Queue: fq" || warn "Queue: ${QDISC} (expected: fq)"

FWD4=$(sysctl -n net.ipv4.ip_forward 2>/dev/null)
[[ "${FWD4}" == "1" ]] && ok "IPv4 Forward: enabled" || fail "IPv4 Forward: disabled"

FWD6=$(sysctl -n net.ipv6.conf.all.forwarding 2>/dev/null)
[[ "${FWD6}" == "1" ]] && ok "IPv6 Forward: enabled" || warn "IPv6 Forward: disabled"
echo ""

# ── Firewall ────────────────────────────────────────────────────────────────
echo -e "${BOLD}Firewall (UFW)${NC}"
if ufw status 2>/dev/null | grep -q "Status: active"; then
    ok "UFW: active"
    ufw status | grep -E "^${SSH_PORT}|^${WG_PORT}" | while read -r line; do
        echo -e "  ${GREEN}→${NC} ${line}"
    done
else
    fail "UFW: inactive"
fi
echo ""

# ── fail2ban ────────────────────────────────────────────────────────────────
echo -e "${BOLD}fail2ban${NC}"
if systemctl is-active --quiet fail2ban 2>/dev/null; then
    ok "Service: running"
    BANNED=$(fail2ban-client status sshd 2>/dev/null | grep "Currently banned" | awk '{print $NF}')
    TOTAL=$(fail2ban-client status sshd 2>/dev/null | grep "Total banned" | awk '{print $NF}')
    echo -e "  Currently banned: ${BANNED:-0}"
    echo -e "  Total banned:     ${TOTAL:-0}"
else
    fail "Service: stopped"
fi
echo ""

# ── SSH ─────────────────────────────────────────────────────────────────────
echo -e "${BOLD}SSH${NC}"
if ss -tlnp | grep -q ":${SSH_PORT}"; then
    ok "Listening on port ${SSH_PORT}"
else
    fail "Not listening on port ${SSH_PORT}"
fi

PASS_AUTH=$(sshd -T 2>/dev/null | grep -i "passwordauthentication" | awk '{print $2}')
if [[ "${PASS_AUTH}" == "no" ]]; then
    ok "Password auth: disabled (key-only)"
else
    warn "Password auth: enabled (should be disabled)"
fi
echo ""

# ── NAT Rules ──────────────────────────────────────────────────────────────
echo -e "${BOLD}NAT (iptables)${NC}"
NAT_RULES=$(iptables -t nat -L POSTROUTING -n 2>/dev/null | grep -c MASQUERADE || echo "0")
if [[ ${NAT_RULES} -gt 0 ]]; then
    ok "MASQUERADE rules: ${NAT_RULES} active"
else
    fail "No MASQUERADE rules found"
fi
echo ""

# ── Peer Details ────────────────────────────────────────────────────────────
if [[ ${PEER_COUNT} -gt 0 ]]; then
    echo -e "${BOLD}Peer Details${NC}"
    echo ""
    wg show ${WG_INTERFACE} 2>/dev/null | tail -n +3
    echo ""
fi

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""