#!/bin/bash
# Read-only inventory for old Linux hosts. Never starts/enables/restarts services.
# Run on the actual host; output is evidence, not automatic reboot approval.
set -u
export LC_ALL=C

if [ "$(uname -s)" != Linux ]; then
    echo 'NOT_RUN: this audit must run on the target Linux host.' >&2
    exit 2
fi

relevant='nginx|php.*fpm|redis|mysqld|mysql|mariadb|httpd|apache|supervis|docker|aliyun|crond'
section() { printf '\n[%s]\n' "$1"; }

section host
date -u '+checked_at=%Y-%m-%dT%H:%M:%SZ'
hostname
uname -sr
if [ -r /etc/redhat-release ]; then cat /etc/redhat-release; fi
printf 'pid1='
cat /proc/1/comm 2>/dev/null || true
if command -v runlevel >/dev/null 2>&1; then runlevel || true; fi
if [ -r /etc/inittab ]; then
    awk -F: '$1 !~ /^#/ && $3 == "initdefault" {print "default_runlevel=" $2}' /etc/inittab
fi

section running_processes_without_arguments
# Do not dump argv: database and Redis arguments may contain credentials.
ps -eo pid,ppid,comm | awk -v pat="$relevant" 'NR == 1 || tolower($3) ~ pat'
for p in /proc/[0-9]*; do
    [ -r "$p/comm" ] || continue
    comm=$(cat "$p/comm" 2>/dev/null) || continue
    if printf '%s\n' "$comm" | grep -Eiq "$relevant"; then
        exe=$(readlink "$p/exe" 2>/dev/null || true)
        printf 'pid=%s comm=%s exe=%s\n' "${p##*/}" "$comm" "$exe"
    fi
done

section relevant_listeners
if command -v ss >/dev/null 2>&1; then
    ss -lntp 2>/dev/null | awk 'NR == 1 || $4 ~ /:(80|443|3306|6379|9000)$/ || /nginx|php-fpm|redis|mysqld/'
elif command -v netstat >/dev/null 2>&1; then
    netstat -lntp 2>/dev/null | awk 'NR <= 2 || $4 ~ /:(80|443|3306|6379|9000)$/ || /nginx|php-fpm|redis|mysqld/'
else
    echo 'UNAVAILABLE: neither ss nor netstat found.'
fi

section sysv_startup_registration
if command -v chkconfig >/dev/null 2>&1; then
    for f in /etc/init.d/*; do
        [ -f "$f" ] || continue
        name=${f##*/}
        if printf '%s\n' "$name" | grep -Eiq "$relevant"; then
            printf 'script=%s executable=' "$f"
            if [ -x "$f" ]; then echo yes; else echo no; fi
            chkconfig --list "$name" 2>&1 || true
        fi
    done
else
    echo 'UNAVAILABLE: chkconfig not installed.'
fi

section sysv_runlevel_links
for d in /etc/rc[2345].d /etc/rc.d/rc[2345].d; do
    [ -d "$d" ] || continue
    for f in "$d"/[SK]*; do
        [ -L "$f" ] || continue
        if printf '%s\n' "${f##*/}" | grep -Eiq "$relevant"; then
            printf '%s -> %s\n' "$f" "$(readlink "$f")"
        fi
    done
done

section upstart_jobs
if command -v initctl >/dev/null 2>&1; then
    initctl list 2>/dev/null | grep -Ei "$relevant" || true
fi
for f in /etc/init/*.conf /etc/init/*.override; do
    [ -r "$f" ] || continue
    if printf '%s\n' "${f##*/}" | grep -Eiq "$relevant"; then
        printf 'file=%s\n' "$f"
        # Show only activation/lifecycle directives; omit exec/env/password lines.
        grep -nE '^[[:space:]]*(start on|stop on|manual|respawn([[:space:]]|$))' "$f" || true
    fi
done

section systemd_registration_if_in_use
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
    systemctl list-unit-files --type=service --no-pager 2>/dev/null |
        grep -Ei "$relevant" || true
else
    echo 'NOT_APPLICABLE: systemd is not the active service manager.'
fi

section legacy_startup_references
# Print filenames/line numbers only. The commands themselves may contain secrets.
for f in /etc/rc.local /etc/rc.d/rc.local /etc/crontab /etc/cron.d/* /var/spool/cron/root; do
    [ -f "$f" ] && [ -r "$f" ] || continue
    awk -v path="$f" -v pat="$relevant" '
        /^[[:space:]]*#/ {next}
        tolower($0) ~ pat {
            printf "%s:%d service-reference-present (inspect privately)\n", path, NR
        }
        /@reboot/ {
            printf "%s:%d reboot-job-present (inspect privately)\n", path, NR
        }
    ' "$f"
done

section review_gate
echo 'REVIEW_REQUIRED: process running != boot activation configured != reboot recovery proven.'
echo 'Missing named units do not prove autostart is absent; custom wrappers/rc.local may own it.'
echo 'Verify actual executable/config/PID/user, dependency endpoints, startup order and permissions.'
echo 'If Redis/MySQL are remote, audit their actual hosts separately; do not install local duplicates.'
echo 'This script made no startup configuration or runtime changes and grants no reboot approval.'
# Distinguish an inventory report from a successful autostart acceptance.
exit 3