name: Diagnose SSH

on:
  workflow_dispatch:

jobs:
  diagnose:
    name: Diagnostico SSH no servidor
    runs-on: self-hosted

    steps:
      - name: Status do sshd
        shell: bash
        run: |
          echo "=== systemctl status sshd ==="
          sudo systemctl status sshd --no-pager || true

      - name: Logs recentes do sshd
        shell: bash
        run: |
          echo "=== journalctl sshd (ultimas 50 linhas) ==="
          sudo journalctl -u sshd -n 50 --no-pager || true

      - name: Fail2ban status
        shell: bash
        run: |
          echo "=== fail2ban-client status ==="
          sudo fail2ban-client status 2>/dev/null || echo "fail2ban nao instalado ou sem permissao"
          echo ""
          echo "=== fail2ban jail sshd ==="
          sudo fail2ban-client status sshd 2>/dev/null || echo "jail sshd nao encontrado"

      - name: IPs banidos no fail2ban
        shell: bash
        run: |
          echo "=== IPs banidos (iptables) ==="
          sudo iptables -L f2b-sshd -n 2>/dev/null || sudo iptables -L -n 2>/dev/null | grep -A5 "f2b" || echo "Sem regras f2b encontradas"

      - name: Conexoes SSH ativas e MaxStartups
        shell: bash
        run: |
          echo "=== Conexoes na porta 60000 ==="
          ss -tnp | grep ':60000' || echo "Nenhuma conexao ativa"
          echo ""
          echo "=== MaxStartups configurado ==="
          sudo sshd -T 2>/dev/null | grep -i maxstartups || grep -i maxstartups /etc/ssh/sshd_config || echo "Configuracao padrao (10:30:100)"

      - name: Quem esta logado
        shell: bash
        run: |
          echo "=== Sessoes ativas ==="
          who || true
          echo ""
          echo "=== Ultimos logins ==="
          last -n 10 || true