critical_configs:
  - path: /etc/ssh/sshd_config
    fields:
      - Port
      - PermitRootLogin
      - PasswordAuthentication
      - PubkeyAuthentication
    max_drift_minutes: 0    # 零容忍
    auto_remediation: false # 需人工确认
  
  - path: /etc/nginx/nginx.conf
    fields:
      - worker_processes
      - worker_connections
      - ssl_protocols
    max_drift_minutes: 60
    auto_remediation: true
  
  - path: /etc/mysql/mysql.conf.d/mysqld.cnf
    fields:
      - max_connections
      - innodb_buffer_pool_size
      - bind-address
    max_drift_minutes: 30
    auto_remediation: true
  
  - path: /etc/sysctl.conf
    fields:
      - net.ipv4.ip_forward
      - net.core.somaxconn
      - vm.swappiness
    max_drift_minutes: 120
    auto_remediation: true

#!/usr/bin/env python3
"""VPS 配置采集器 - 定时采集服务器关键配置并生成差异报告"""

import subprocess
import yaml
import json
import hashlib
from datetime import datetime
from pathlib import Path
from typing import Dict, List, Optional

class ConfigCollector:
    def __init__(self, inventory_file: str, baseline_dir: str):
        self.inventory = self._load_inventory(inventory_file)
        self.baseline_dir = Path(baseline_dir)
        self.critical_policies = self._load_policies()
    
    def _load_inventory(self, path: str) -> Dict:
        with open(path) as f:
            return yaml.safe_load(f)
    
    def _load_policies(self) -> Dict:
        with open(self.baseline_dir / 'policies' / 'critical.yml') as f:
            return yaml.safe_load(f)
    
    def collect_server_config(self, host: str, config_paths: List[str]) -> Dict:
        """采集单个服务器的配置"""
        results = {}
        for config_path in config_paths:
            try:
                # 读取配置内容
                result = subprocess.run(
                    ['cat', config_path],
                    capture_output=True, text=True, timeout=10
                )
                if result.returncode == 0:
                    # 提取关键字段
                    fields = self._extract_fields(
                        result.stdout, config_path
                    )
                    results[config_path] = fields
            except Exception as e:
                results[config_path] = {'error': str(e)}
        return results
    
    def _extract_fields(self, content: str, config_path: str) -> Dict:
        """从配置文件中提取关键字段"""
        fields = {}
        for policy in self.critical_policies.get('critical_configs', []):
            if policy['path'] == config_path:
                for field in policy['fields']:
                    for line in content.split('\n'):
                        if line.strip().startswith(f'{field}'):
                            value = line.split(None, 1)[1] if len(line.split(None, 1)) > 1 else ''
                            fields[field] = value.strip()
                            break
        return fields
    
    def generate_hash(self, config_data: Dict) -> str:
        """生成配置内容的哈希值"""
        content = json.dumps(config_data, sort_keys=True)
        return hashlib.sha256(content.encode()).hexdigest()
    
    def collect_all(self, output_dir: str):
        """采集所有服务器的配置"""
        output_path = Path(output_dir)
        output_path.mkdir(parents=True, exist_ok=True)
        
        for host, groups in self.inventory.items():
            host_dir = output_path / host
            host_dir.mkdir(exist_ok=True)
            
            # 采集配置
            all_configs = {}
            for group in groups.get('groups', []):
                configs = self.collect_server_config(
                    host, 
                    [str(p) for p in (self.baseline_dir / 'configs' / 'production').rglob('*') if p.is_file()]
                )
                all_configs.update(configs)
            
            # 生成快照
            snapshot = {
                'host': host,
                'timestamp': datetime.utcnow().isoformat(),
                'configs': all_configs,
                'hash': self.generate_hash(all_configs)
            }
            
            snapshot_file = host_dir / f"snapshot_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}.json"
            with open(snapshot_file, 'w') as f:
                json.dump(snapshot, f, indent=2)
            
            print(f"[{host}] 配置采集完成，快照: {snapshot_file}")

if __name__ == '__main__':
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument('--inventory', default='inventory/production/webservers.yml')
    parser.add_argument('--baseline-dir', default='/etc/ansible/config-baseline')
    parser.add_argument('--output', default='/var/lib/config-drift/snapshots')
    args = parser.parse_args()
    
    collector = ConfigCollector(args.inventory, args.baseline_dir)
    collector.collect_all(args.output)

DRIFT_ANALYSIS_PROMPT = """
你是一个专业的 DevOps 工程师，负责分析 VPS 配置漂移报告。

## 配置基线（预期状态）
{baseline_config}

## 实际配置（当前状态）
{actual_config}

## 差异内容
{diff_output}

## 关键配置项策略
{policy_rules}

## 分析要求
1. 判断每个差异的变更意图（性能优化/安全加固/故障修复/无意修改/可疑变更）
2. 评估风险等级（critical/high/medium/low/info）
3. 给出修复建议（如需要）
4. 检查是否违反安全策略

请以 JSON 格式输出分析结果：
{{
  "analysis": [
    {{
      "field": "配置字段名",
      "intent": "变更意图分类",
      "risk_level": "风险等级",
      "description": "简要描述",
      "remediation": "修复建议（如有）",
      "auto_fix": true/false
    }}
  ],
  "overall_risk": "整体风险等级",
  "requires_attention": true/false
}}
"""

{
  "analysis": [
    {
      "field": "worker_processes",
      "intent": "性能优化",
      "risk_level": "low",
      "description": "从固定值4改为auto，是常见的性能优化操作",
      "remediation": "无需修复，符合最佳实践",
      "auto_fix": false
    },
    {
      "field": "PermitRootLogin",
      "intent": "可疑变更",
      "risk_level": "critical",
      "description": "root登录方式从no改为yes，存在安全风险",
      "remediation": "立即执行: sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config && systemctl restart sshd",
      "auto_fix": true
    },
    {
      "field": "max_connections",
      "intent": "故障修复",
      "risk_level": "medium",
      "description": "数据库最大连接数从100调整为200，可能是为了解决连接池耗尽问题",
      "remediation": "确认业务需求后保持当前配置，或根据基线回滚",
      "auto_fix": false
    }
  ],
  "overall_risk": "high",
  "requires_attention": true
}

---
- name: 自动修复 VPS 配置漂移
  hosts: target_servers
  become: yes
  vars:
    drift_report: "{{ lookup('file', '/var/lib/config-drift/latest-report.json') }}"
  
  tasks:
    - name: 检查是否需要修复
      set_fact:
        needs_fix: "{{ item.auto_fix | default(false) and item.risk_level in ['critical', 'medium'] }}"
      loop: "{{ drift_report.analysis }}"
      when: item.requires_attention | default(true)
    
    - name: 自动修复关键配置
      when: needs_fix
      block:
        - name: 备份当前配置
          copy:
            src: "{{ item.config_path }}"
            dest: "/tmp/backup/{{ item.config_path | regex_replace('/', '_') }}_{{ ansible_date_time.iso8601_basic_short }}"
            remote_src: yes
        
        - name: 应用修复
          lineinfile:
            path: "{{ item.config_path }}"
            regexp: "^{{ item.field }}.*"
            line: "{{ item.field }} {{ item.baseline_value }}"
          loop_control:
            label: "{{ item.field }}"
        
        - name: 验证修复结果
          command: "diff -q {{ item.config_path }} /etc/ansible/config-baseline/configs/production/{{ item.config_path | basename }}"
          register: diff_result
          changed_when: false
          failed_when: diff_result.rc != 0
      
      rescue:
        - name: 修复失败，回滚配置
          copy:
            src: "/tmp/backup/{{ item.config_path | regex_replace('/', '_') }}_{{ ansible_date_time.iso8601_basic_short }}"
            dest: "{{ item.config_path }}"
            remote_src: yes
          when: backup_exists
      
    - name: 记录修复结果
      copy:
        content: |
          修复时间: {{ ansible_date_time.iso8601_basic }}
          服务器: {{ inventory_hostname }}
          修复项: {{ items | length }}
        dest: "/var/log/config-drift/remediation-{{ ansible_date_time.date }}.log"
      when: needs_fix

# 1. 安装必要工具
sudo apt update && sudo apt install -y ansible python3-pip git

# 2. 安装 Python 依赖
pip3 install pyyaml openai requests

# 3. 创建配置基线目录
sudo mkdir -p /etc/ansible/config-baseline/{configs,policies,runbooks}
sudo mkdir -p /var/lib/config-drift/{snapshots,reports,backups}
sudo mkdir -p /etc/ansible/roles/config-drift/{tasks,templates,vars}

# 每5分钟采集一次配置
*/5 * * * * /usr/bin/python3 /opt/config-drift/collector.py \
  --inventory /etc/ansible/config-baseline/inventory/production/webservers.yml \
  --baseline-dir /etc/ansible/config-baseline \
  --output /var/lib/config-drift/snapshots \
  >> /var/log/config-drift/collector.log 2>&1

# 每10分钟执行一次差异分析和修复
*/10 * * * * /usr/bin/python3 /opt/config-drift/analyzer.py \
  --snapshot-dir /var/lib/config-drift/snapshots \
  --baseline-dir /etc/ansible/config-baseline \
  --report-dir /var/lib/config-drift/reports \
  >> /var/log/config-drift/analyzer.log 2>&1

import requests
import json

def send_slack_alert(webhook_url: str, alert_data: dict):
    """发送 Slack 告警"""
    color = {
        'critical': '#ff0000',
        'high': '#ff6600',
        'medium': '#ffcc00',
        'low': '#00cc00',
        'info': '#0066cc'
    }.get(alert_data.get('risk_level', 'info'), '#808080')
    
    blocks = [
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"🚨 *配置漂移告警*\n{alert_data.get('message', '')}"
            }
        },
        {
            "type": "section",
            "fields": [
                {"type": "mrkdwn", "text": f"*服务器:*\n{alert_data.get('host', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*风险等级:*\n{alert_data.get('risk_level', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*发现时间:*\n{alert_data.get('timestamp', 'N/A')}"},
                {"type": "mrkdwn", "text": f"*漂移项数:*\n{alert_data.get('drift_count', 0)}"}
            ]
        }
    ]
    
    payload = {
        "text": "配置漂移告警",
        "attachments": [{
            "color": color,
            "blocks": blocks
        }]
    }
    
    requests.post(webhook_url, json=payload, timeout=10)