#!/usr/bin/env bash
# =====================================================================
# Skrip Otomatisasi Keamanan Apache (5 Langkah Keamanan infokoding)
# Author: Rusmawan Abdullah Sani (infokoding.com)
# LinkedIn: https://www.linkedin.com/in/rusmawan-abdullah-sani-3b015945/
# Repositori Resmi: https://github.com/admininfokoding/apache-security-scripts
# Kompatibel untuk: Ubuntu / Debian & RHEL / CentOS / AlmaLinux
# =====================================================================

set -e

echo "====================================================================="
echo "   INFOKODING - APACHE SECURITY AUTOMATION SCRIPT (5 STEPS)"
echo "====================================================================="
echo "[+] Mengecek sistem operasi..."

if [ -f /etc/debian_version ]; then
    OS_FAMILY="debian"
    echo "[✓] Sistem terdeteksi: Ubuntu / Debian"
elif [ -f /etc/redhat-release ]; then
    OS_FAMILY="rhel"
    echo "[✓] Sistem terdeteksi: RHEL / CentOS / AlmaLinux"
else
    echo "[!] Sistem operasi tidak didukung oleh skrip otomatisasi ini."
    exit 1
fi

echo ""
echo "[1/5] Menyembunyikan versi Apache dan identitas OS..."
if [ "$OS_FAMILY" = "debian" ]; then
    sudo sed -i 's/^ServerTokens .*/ServerTokens Prod/' /etc/apache2/conf-available/security.conf 2>/dev/null || echo "ServerTokens Prod" | sudo tee -a /etc/apache2/conf-available/security.conf
    sudo sed -i 's/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf 2>/dev/null || echo "ServerSignature Off" | sudo tee -a /etc/apache2/conf-available/security.conf
    sudo a2enconf security 2>/dev/null || true
else
    sudo sed -i 's/^ServerTokens .*/ServerTokens Prod/' /etc/httpd/conf/httpd.conf 2>/dev/null || echo "ServerTokens Prod" | sudo tee -a /etc/httpd/conf/httpd.conf
    sudo sed -i 's/^ServerSignature .*/ServerSignature Off/' /etc/httpd/conf/httpd.conf 2>/dev/null || echo "ServerSignature Off" | sudo tee -a /etc/httpd/conf/httpd.conf
fi
echo "[✓] Langkah 1 selesai."

echo ""
echo "[2/5] Mengonfigurasi Firewall dan mengaktifkan proteksi Fail2Ban..."
if [ "$OS_FAMILY" = "debian" ]; then
    sudo ufw default deny incoming 2>/dev/null || true
    sudo ufw default allow outgoing 2>/dev/null || true
    sudo ufw allow ssh 2>/dev/null || true
    sudo ufw allow "Apache Full" 2>/dev/null || true
    sudo ufw --force enable 2>/dev/null || true

    sudo apt update -y && sudo apt install fail2ban -y
    sudo cp -n /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 2>/dev/null || true
    sudo systemctl enable --now fail2ban
else
    sudo firewall-cmd --permanent --add-service=http 2>/dev/null || true
    sudo firewall-cmd --permanent --add-service=https 2>/dev/null || true
    sudo firewall-cmd --reload 2>/dev/null || true

    sudo dnf install epel-release -y 2>/dev/null || true
    sudo dnf install fail2ban -y
    sudo cp -n /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 2>/dev/null || true
    sudo systemctl enable --now fail2ban
fi
echo "[✓] Langkah 2 selesai."

echo ""
echo "[3/5] Menginstal ModSecurity Web Application Firewall (WAF)..."
if [ "$OS_FAMILY" = "debian" ]; then
    sudo apt install libapache2-mod-security2 -y
    sudo a2enmod security2
    sudo cp -n /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf 2>/dev/null || true
    sudo sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/modsecurity/modsecurity.conf
else
    sudo dnf install mod_security -y
    sudo sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/httpd/conf.d/mod_security.conf 2>/dev/null || true
fi
echo "[✓] Langkah 3 selesai."

echo ""
echo "[4/5 & 5/5] Mengaktifkan modul HTTP Security Headers & enkripsi..."
if [ "$OS_FAMILY" = "debian" ]; then
    sudo a2enmod headers
    sudo systemctl restart apache2
else
    sudo systemctl restart httpd
fi
echo "[✓] Langkah 4 & 5 selesai."

echo ""
echo "====================================================================="
echo " [✓] SELAMAT! Server Apache Anda telah dikonfigurasi dengan aman."
echo "     Verifikasi konfigurasi melalui: https://securityheaders.com"
echo "====================================================================="