#!/bin/bash
# collect_update_info.sh — Aggregate update-related information

echo "=== System Information ==="
uname -a
cat /etc/os-release | grep -E "^(VERSION|ID)="

echo ""
echo "=== Upgradable Packages ==="
if command -v apt &>/dev/null; then
    apt list --upgradable 2>/dev/null
elif command -v yum &>/dev/null; then
    yum check-update --quiet
fi

echo ""
echo "=== Key Service Versions ==="
systemctl list-units --type=service --state=running | head -30

echo ""
echo "=== Current Disk Usage ==="
df -h / /var /tmp 2>/dev/null

echo ""
echo "=== Memory Status ==="
free -h

echo ""
echo "=== Recent System Logs (apt/yum) ==="
journalctl -u apt-daily.service --since "24 hours ago" --no-pager | tail -20

# patch_analyzer.py — LLM-based update analysis

import subprocess
import json
from ollama import chat

def get_upgradable_packages():
    """Get list of upgradable packages"""
    result = subprocess.run(
        ["apt", "list", "--upgradable"],
        capture_output=True, text=True
    )
    packages = []
    for line in result.stdout.strip().split("\n"):
        if "/" in line and "upgradable" in line:
            name, version = line.split("/")[0], line.split("/")[1].split(":")[-1]
            packages.append({"name": name, "version": version.strip()})
    return packages

def analyze_with_llm(packages, system_info):
    """Use LLM to analyze update risks"""
    package_list = "\n".join(
        f"- {p['name']}: {p['version']}" for p in packages[:20]
    )
    
    prompt = f"""You are a senior Linux system engineer. Analyze the following VPS system update information, assess security risks, and provide upgrade recommendations.

System Info:
{system_info}

Upgradable Packages ({len(packages)} total):
{package_list}

Output your analysis as JSON:
{{
  "risk_level": "high|medium|low",
  "urgency": "immediate|scheduled|optional",
  "summary": "Brief update summary",
  "risk_factors": ["Risk factor 1", "Risk factor 2"],
  "recommendations": [
    {{
      "action": "Recommended action",
      "priority": 1,
      "reason": "Reasoning"
    }}
  ],
  "rollback_plan": "Brief rollback strategy"
}}"""

    response = chat(
        model="llama3.2",
        messages=[{"role": "user", "content": prompt}]
    )
    return json.loads(response["message"]["content"])

{
  "risk_level": "medium",
  "urgency": "scheduled",
  "summary": "This update includes 3 security patches (openssl, linux-kernel, sudo) and 17 routine package updates. Core security components have important vulnerability fixes.",
  "risk_factors": [
    "linux-kernel version jump is significant (6.5→6.8), potential driver compatibility issues",
    "openssl update may affect custom applications relying on older OpenSSL versions",
    "curl version change may break scripts with hardcoded SSL paths"
  ],
  "recommendations": [
    {
      "action": "Prioritize installing openssl and sudo security patches",
      "priority": 1,
      "reason": "These packages involve critical CVEs, recommend immediate remediation"
    },
    {
      "action": "Create LVM snapshot before upgrading kernel",
      "priority": 2,
      "reason": "Major kernel updates carry boot risks; retain rollback capability"
    },
    {
      "action": "Verify Nginx/MySQL critical services after upgrade",
      "priority": 3,
      "reason": "Ensure system library updates haven't affected running services"
    }
  ],
  "rollback_plan": "If issues occur, rollback root filesystem via LVM snapshot, or use apt-mark hold to lock current versions"
}

# CVE correlation and risk assessment

def assess_patch_urgency(cves, package_info):
    """Comprehensive patch urgency assessment"""
    score = 0
    for cve in cves:
        # In practice, query CVSS scores here
        score += 7  # Assuming average CVSS 7.0
    
    if score >= 15:
        return "immediate"   # Fix immediately
    elif score >= 5:
        return "scheduled"   # Schedule for fix
    else:
        return "optional"    # Optional fix

#!/bin/bash
# smart_upgrade.sh — Intelligent staged upgrade script

set -euo pipefail

SNAPSHOT_NAME="pre-patch-$(date +%Y%m%d-%H%M%S)"
LOG_FILE="/var/log/smart-patch-$(date +%Y%m%d).log"
ROLLBACK_AVAILABLE=false

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Phase 1: Pre-flight Check
log "=== Phase 1: Pre-flight Check ==="

# Create system snapshot
if command -v lvs &>/dev/null; then
    lvcreate --snapshot --name "$SNAPSHOT_NAME" \
        --size 2G "${LV_NAME:-/dev/mapper/ubuntu--vg-ubuntu--lv}" 2>/dev/null && \
        ROLLBACK_AVAILABLE=true || \
        log "WARNING: Cannot create LVM snapshot, rollback capability limited"
fi

# Record service states
log "Recording current service states..."
systemctl list-units --type=service --state=running \
    > /tmp/services-before-upgrade.txt 2>&1

# Check disk space
AVAILABLE=$(df -BG / | awk 'NR==2 {print $4}' | tr -d 'G')
if [ "$AVAILABLE" -lt 2 ]; then
    log "ERROR: Less than 2GB disk space available, aborting upgrade"
    exit 1
fi

# Phase 2: Selective Upgrade
log "=== Phase 2: Selective Upgrade ==="

# Get LLM analysis results
ANALYSIS=$(python3 /opt/patch-manager/patch_analyzer.py)
RISK_LEVEL=$(echo "$ANALYSIS" | jq -r '.risk_level')
URGENCY=$(echo "$ANALYSIS" | jq -r '.urgency')

log "Risk assessment: $RISK_LEVEL, Urgency: $URGENCY"

# Upgrade security-critical packages first
log "Prioritizing security-critical packages..."
apt list --upgradable 2>/dev/null | grep -E "(openssl|sudo|libpam|linux-image|firmware)" \
    | awk -F/ '{print $1}' | xargs -r apt-get install -y --dry-run 2>&1 | tee -a "$LOG_FILE"

# Health check
log "Running health checks..."
sleep 5
CRASHED_SERVICES=$(diff <(cat /tmp/services-before-upgrade.txt) \
    <(systemctl list-units --type=service --state=running) \
    | grep "^<" | wc -l)

if [ "$CRASHED_SERVICES" -gt 0 ]; then
    log "ERROR: Detected $CRASHED_SERVICES abnormal services, preparing rollback"
    if [ "$ROLLBACK_AVAILABLE" = true ]; then
        log "Executing rollback..."
        exit 1
    fi
fi

log "Upgrade complete. Full report: /var/log/smart-patch-$(date +%Y%m%d).log"

# health_checker.py — Post-upgrade health checks

import subprocess
import psutil

def check_system_health():
    """System-level health checks"""
    results = {}
    
    load_avg = psutil.getloadavg()
    results["load_avg"] = load_avg
    results["cpu_healthy"] = all(l < 2.0 for l in load_avg)
    
    mem = psutil.virtual_memory()
    results["memory_used_percent"] = mem.percent
    results["memory_healthy"] = mem.percent < 90
    
    return results

def check_service_health():
    """Critical service health checks"""
    critical_services = ["ssh", "nginx", "mysql", "postgresql", "docker"]
    
    results = {}
    for service in critical_services:
        result = subprocess.run(
            ["systemctl", "is-active", service],
            capture_output=True, text=True
        )
        results[service] = result.stdout.strip() == "active"
    
    return results

if __name__ == "__main__":
    import json
    report = {
        "system": check_system_health(),
        "services": check_service_health()
    }
    report["overall"] = "healthy" if all(report["system"].values()) and all(report["services"].values()) else "degraded"
    print(json.dumps(report, indent=2))

# rollback_policy.yaml — Rollback strategy configuration

auto_rollback:
  triggers:
    - condition: "critical_service_down"
      description: "Critical services (SSH/Nginx/Docker) fail to start"
      action: "immediate_rollback"
      
    - condition: "cpu_load_critical"
      description: "CPU load stays > 5.0 for 5+ minutes after upgrade"
      action: "immediate_rollback"
      
    - condition: "memory_leak_detected"
      description: "Memory usage continuously rising with no decline"
      action: "immediate_rollback"
      
    - condition: "network_unreachable"
      description: "External network unreachable for 2+ minutes after upgrade"
      action: "immediate_rollback"

rollback_methods:
  lvm_snapshot:
    enabled: true
    priority: 1
  zfs_snapshot:
    enabled: true
    priority: 2
  dpkg_hold:
    enabled: true
    priority: 3
    description: "Hold package versions, manual downgrade"
  backup_restore:
    enabled: true
    priority: 4
    description: "Restore config files from backup"

# rollback_executor.py — Intelligent rollback executor

import subprocess
import asyncio

async def execute_rollback(policy_path="/etc/patch-manager/rollback_policy.yaml"):
    """Execute rollback based on policy"""
    # Load policy and check triggers...
    # Attempt rollback methods in priority order
    # Send notifications on success/failure
    pass

# scheduler_config.yaml

schedule:
  # Security scan: Daily at 2 AM
  security_scan:
    cron: "0 2 * * *"
    description: "Scan for security-related updates"
    filter: "Security packages (openssl, sudo, libpam, linux-image, etc.)"
  
  # Full update check: Weekly on Sunday at 3 AM
  full_upgrade_check:
    cron: "0 3 * * 0"
    description: "Weekly comprehensive update check"
    pre_check: true
    auto_execute: false  # Requires manual confirmation
  
  # Emergency patch: Immediately when high-severity CVE detected
  emergency_patch:
    trigger: "CVE severity >= 9.0"
    description: "Auto-execute when critical vulnerability detected"
    auto_execute: true
    notification: "immediate"
  
  # Weekly report: Every Monday at 9 AM
  weekly_report:
    cron: "0 9 * * 1"
    description: "Generate last week's update report"
    recipients: ["admin@example.com", "telegram-bot"]

# /etc/systemd/system/patch-manager-scan.timer
[Unit]
Description=Daily Patch Security Scan

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
RandomizedDelaySec=300

[Install]
WantedBy=timers.target

# /etc/systemd/system/patch-manager-scan.service
[Unit]
Description=Patch Security Scan Service

[Service]
Type=oneshot
User=root
WorkingDirectory=/opt/patch-manager
ExecStartPre=/usr/bin/python3 pre_flight_check.py
ExecStart=/usr/bin/python3 patch_analyzer.py
ExecStartPost=/usr/bin/python3 generate_report.py

systemctl enable --now patch-manager-scan.timer
systemctl status patch-manager-scan.timer

# telegram_notifier.py

import requests

TELEGRAM_BOT_TOKEN = "YOUR_BOT_TOKEN"
CHAT_ID = "YOUR_CHAT_ID"

def send_patch_report(analysis, health_report):
    """Send patch analysis report via Telegram"""
    
    risk_emoji = {"high": "🔴", "medium": "🟡", "low": "🟢"}
    risk = analysis.get("risk_level", "low")
    
    message = f"""🛡️ <b>VPS Patch Analysis Report</b>

{risk_emoji.get(risk, "⚪")} <b>Risk Level:</b> {risk.upper()}
📋 <b>Urgency:</b> {analysis.get("urgency", "scheduled")}

<b>Update Summary:</b>
{analysis.get("summary", "None")}

<b>Risk Factors:</b>
"""
    for factor in analysis.get("risk_factors", []):
        message += f"• {factor}\n"
    
    message += "\n<b>System Health:</b>\n"
    sys_health = health_report.get("system", {})
    message += f"• CPU Load: {sys_health.get('load_avg', 'N/A')}\n"
    message += f"• Memory: {sys_health.get('memory_used_percent', 'N/A')}%\n"
    message += f"• Overall: {health_report.get('overall', 'unknown')}\n"
    
    url = f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage"
    requests.post(url, json={
        "chat_id": CHAT_ID,
        "text": message,
        "parse_mode": "HTML"
    })

#!/bin/bash
# deploy_patch_manager.sh — One-click deployment

set -euo pipefail

echo "=== Deploying Intelligent Patch Management System ==="

# 1. Install dependencies
echo "[1/5] Installing system dependencies..."
apt-get update
apt-get install -y python3 python3-pip ollama \
    python3-psutil python3-requests python3-yaml \
    lvm2 zfsutils-linux 2>/dev/null || true

# 2. Create directory structure
echo "[2/5] Creating directory structure..."
mkdir -p /opt/patch-manager/{scripts,config,logs}
mkdir -p /etc/patch-manager

# 3. Deploy scripts
echo "[3/5] Deploying scripts..."
cp patch_analyzer.py /opt/patch-manager/
cp health_checker.py /opt/patch-manager/
cp rollback_executor.py /opt/patch-manager/
cp telegram_notifier.py /opt/patch-manager/

# 4. Deploy configuration
echo "[4/5] Deploying configuration..."
cat > /etc/patch-manager/config.yaml << 'EOF'
ollama:
  host: "http://localhost:11434"
  model: "llama3.2"

telegram:
  bot_token: "${TELEGRAM_BOT_TOKEN}"
  chat_id: "${TELEGRAM_CHAT_ID}"

rollback:
  max_wait_seconds: 300
  check_interval: 30
EOF

# 5. Enable services
echo "[5/5] Enabling scheduled tasks..."
systemctl enable patch-manager-scan.timer
systemctl start patch-manager-scan.timer

echo ""
echo "✅ Deployment complete!"
echo "📊 Status: systemctl status patch-manager-scan.timer"
echo "📝 Logs: journalctl -u patch-manager-scan.service -f"
echo "📱 Telegram notifications configured"

# Verify deployment
systemctl status patch-manager-scan.timer
journalctl -u patch-manager-scan.service --since "1 hour ago" --no-pager

# Manual test
cd /opt/patch-manager
python3 patch_analyzer.py
python3 health_checker.py