critical_configs:
  - path: /etc/ssh/sshd_config
    fields:
      - Port
      - PermitRootLogin
      - PasswordAuthentication
      - PubkeyAuthentication
    max_drift_minutes: 0    # Zero tolerance
    auto_remediation: false # Requires manual confirmation
  
  - path: /etc/nginx/nginx.conf
    fields:
      - worker_processes
      - worker_connections
      - ssl_protocols
    max_drift_minutes: 60
    auto_remediation: true
  
  - path: /etc/mysql/mysql.conf.d/mysqld.cnf
    fields:
      - max_connections
      - innodb_buffer_pool_size
      - bind-address
    max_drift_minutes: 30
    auto_remediation: true
  
  - path: /etc/sysctl.conf
    fields:
      - net.ipv4.ip_forward
      - net.core.somaxconn
      - vm.swappiness
    max_drift_minutes: 120
    auto_remediation: true

#!/usr/bin/env python3
"""VPS Configuration Collector - Periodically collect server configs and generate drift reports"""

import subprocess
import yaml
import json
import hashlib
from datetime import datetime
from pathlib import Path
from typing import Dict, List, Optional

class ConfigCollector:
    def __init__(self, inventory_file: str, baseline_dir: str):
        self.inventory = self._load_inventory(inventory_file)
        self.baseline_dir = Path(baseline_dir)
        self.critical_policies = self._load_policies()
    
    def _load_inventory(self, path: str) -> Dict:
        with open(path) as f:
            return yaml.safe_load(f)
    
    def _load_policies(self) -> Dict:
        with open(self.baseline_dir / 'policies' / 'critical.yml') as f:
            return yaml.safe_load(f)
    
    def collect_server_config(self, host: str, config_paths: List[str]) -> Dict:
        """Collect configuration for a single server"""
        results = {}
        for config_path in config_paths:
            try:
                result = subprocess.run(
                    ['cat', config_path],
                    capture_output=True, text=True, timeout=10
                )
                if result.returncode == 0:
                    fields = self._extract_fields(result.stdout, config_path)
                    results[config_path] = fields
            except Exception as e:
                results[config_path] = {'error': str(e)}
        return results
    
    def _extract_fields(self, content: str, config_path: str) -> Dict:
        """Extract key fields from config file"""
        fields = {}
        for policy in self.critical_policies.get('critical_configs', []):
            if policy['path'] == config_path:
                for field in policy['fields']:
                    for line in content.split('\n'):
                        if line.strip().startswith(f'{field}'):
                            value = line.split(None, 1)[1] if len(line.split(None, 1)) > 1 else ''
                            fields[field] = value.strip()
                            break
        return fields
    
    def generate_hash(self, config_data: Dict) -> str:
        """Generate hash of configuration content"""
        content = json.dumps(config_data, sort_keys=True)
        return hashlib.sha256(content.encode()).hexdigest()
    
    def collect_all(self, output_dir: str):
        """Collect configurations for all servers"""
        output_path = Path(output_dir)
        output_path.mkdir(parents=True, exist_ok=True)
        
        for host, groups in self.inventory.items():
            host_dir = output_path / host
            host_dir.mkdir(exist_ok=True)
            
            all_configs = {}
            for group in groups.get('groups', []):
                configs = self.collect_server_config(
                    host,
                    [str(p) for p in (self.baseline_dir / 'configs' / 'production').rglob('*') if p.is_file()]
                )
                all_configs.update(configs)
            
            snapshot = {
                'host': host,
                'timestamp': datetime.utcnow().isoformat(),
                'configs': all_configs,
                'hash': self.generate_hash(all_configs)
            }
            
            snapshot_file = host_dir / f"snapshot_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}.json"
            with open(snapshot_file, 'w') as f:
                json.dump(snapshot, f, indent=2)
            
            print(f"[{host}] Config collection complete, snapshot: {snapshot_file}")

if __name__ == '__main__':
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument('--inventory', default='inventory/production/webservers.yml')
    parser.add_argument('--baseline-dir', default='/etc/ansible/config-baseline')
    parser.add_argument('--output', default='/var/lib/config-drift/snapshots')
    args = parser.parse_args()
    
    collector = ConfigCollector(args.inventory, args.baseline_dir)
    collector.collect_all(args.output)

DRIFT_ANALYSIS_PROMPT = """
You are a professional DevOps engineer responsible for analyzing VPS configuration drift reports.

## Configuration Baseline (Expected State)
{baseline_config}

## Actual Configuration (Current State)
{actual_config}

## Diff Content
{diff_output}

## Key Configuration Policies
{policy_rules}

## Analysis Requirements
1. Determine the change intent for each difference (performance optimization/security hardening/故障修复/unintentional/suspicious)
2. Assess risk level (critical/high/medium/low/info)
3. Provide fix suggestions (if needed)
4. Check for security policy violations

Output the analysis result in JSON format:
{{
  "analysis": [
    {{
      "field": "config_field_name",
      "intent": "change_intent_category",
      "risk_level": "risk_level",
      "description": "brief_description",
      "remediation": "fix_suggestion(if_any)",
      "auto_fix": true/false
    }}
  ],
  "overall_risk": "overall_risk_level",
  "requires_attention": true/false
}}
"""

{
  "analysis": [
    {
      "field": "worker_processes",
      "intent": "Performance Optimization",
      "risk_level": "low",
      "description": "Changed from fixed value 4 to auto, a common performance optimization",
      "remediation": "No fix needed, follows best practices",
      "auto_fix": false
    },
    {
      "field": "PermitRootLogin",
      "intent": "Suspicious Change",
      "risk_level": "critical",
      "description": "Root login method changed from no to yes, security risk",
      "remediation": "Execute immediately: sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config && systemctl restart sshd",
      "auto_fix": true
    },
    {
      "field": "max_connections",
      "intent": "Fault Fix",
      "risk_level": "medium",
      "description": "Database max connections adjusted from 100 to 200, likely to resolve connection pool exhaustion",
      "remediation": "Confirm business needs and keep current config, or rollback to baseline",
      "auto_fix": false
    }
  ],
  "overall_risk": "high",
  "requires_attention": true
}

---
- name: Auto-remediate VPS configuration drift
  hosts: target_servers
  become: yes
  vars:
    drift_report: "{{ lookup('file', '/var/lib/config-drift/latest-report.json') }}"
  
  tasks:
    - name: Check if remediation is needed
      set_fact:
        needs_fix: "{{ item.auto_fix | default(false) and item.risk_level in ['critical', 'medium'] }}"
      loop: "{{ drift_report.analysis }}"
      when: item.requires_attention | default(true)
    
    - name: Auto-fix critical configurations
      when: needs_fix
      block:
        - name: Backup current configuration
          copy:
            src: "{{ item.config_path }}"
            dest: "/tmp/backup/{{ item.config_path | regex_replace('/', '_') }}_{{ ansible_date_time.iso8601_basic_short }}"
            remote_src: yes
        
        - name: Apply fix
          lineinfile:
            path: "{{ item.config_path }}"
            regexp: "^{{ item.field }}.*"
            line: "{{ item.field }} {{ item.baseline_value }}"
          loop_control:
            label: "{{ item.field }}"
        
        - name: Verify fix result
          command: "diff -q {{ item.config_path }} /etc/ansible/config-baseline/configs/production/{{ item.config_path | basename }}"
          register: diff_result
          changed_when: false
          failed_when: diff_result.rc != 0
      
      rescue:
        - name: Rollback on fix failure
          copy:
            src: "/tmp/backup/{{ item.config_path | regex_replace('/', '_') }}_{{ ansible_date_time.iso8601_basic_short }}"
            dest: "{{ item.config_path }}"
            remote_src: yes
          when: backup_exists
      
    - name: Record fix result
      copy:
        content: |
          Fix time: {{ ansible_date_time.iso8601_basic }}
          Server: {{ inventory_hostname }}
          Items fixed: {{ items | length }}
        dest: "/var/log/config-drift/remediation-{{ ansible_date_time.date }}.log"
      when: needs_fix

# 1. Install required tools
sudo apt update && sudo apt install -y ansible python3-pip git

# 2. Install Python dependencies
pip3 install pyyaml openai requests

# 3. Create baseline directories
sudo mkdir -p /etc/ansible/config-baseline/{configs,policies,runbooks}
sudo mkdir -p /var/lib/config-drift/{snapshots,reports,backups}
sudo mkdir -p /etc/ansible/roles/config-drift/{tasks,templates,vars}

# Collect configs every 5 minutes
*/5 * * * * /usr/bin/python3 /opt/config-drift/collector.py \
  --inventory /etc/ansible/config-baseline/inventory/production/webservers.yml \
  --baseline-dir /etc/ansible/config-baseline \
  --output /var/lib/config-drift/snapshots \
  >> /var/log/config-drift/collector.log 2>&1

# Run diff analysis and remediation every 10 minutes
*/10 * * * * /usr/bin/python3 /opt/config-drift/analyzer.py \
  --snapshot-dir /var/lib/config-drift/snapshots \
  --baseline-dir /etc/ansible/config-baseline \
  --report-dir /var/lib/config-drift/reports \
  >> /var/log/config-drift/analyzer.log 2>&1

import requests
import json

def send_slack_alert(webhook_url: str, alert_data: dict):
    """Send Slack alert for configuration drift"""
    color = {
        'critical': '#ff0000',
        'high': '#ff6600',
        'medium': '#ffcc00',
        'low': '#00cc00',
        'info': '#0066cc'
    }.get(alert_data.get('risk_level', 'info'), '#808080')
    
    blocks = [
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"🚨 *Configuration Drift Alert*\n{alert_data.get('message', '')}"
            }
        },
        {
            "type": "section",
            "fields": [
                {"type": "mrkdwn", "text": f"*Server:*\n{alert_data.get('host', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*Risk Level:*\n{alert_data.get('risk_level', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*Detected:*\n{alert_data.get('timestamp', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*Drift Items:*\n{alert_data.get('drift_count', 0)}"}
            ]
        }
    ]
    
    payload = {
        "text": "Configuration Drift Alert",
        "attachments": [{
            "color": color,
            "blocks": blocks
        }]
    }
    
    requests.post(webhook_url, json=payload, timeout=10)