#!/bin/bash
# irc_daily_check.sh - IRC 每日健康检查

DATE=$(date '+%Y-%m-%d %H:%M:%S')
LOG="/var/log/irc-health.log"
ALERT_EMAIL="[email protected]"

echo "===== IRC 健康检查 [$DATE] =====" >> "$LOG"

# 1. 进程检查
if pgrep -x "ergo" > /dev/null; then
    echo "[PASS] IRC 服务进程正常" >> "$LOG"
else
    echo "[FAIL] IRC 服务进程不存在！" >> "$LOG"
    echo "IRC 服务进程异常 at $DATE" | mail -s "IRC Alert" "$ALERT_EMAIL"
fi

# 2. 端口检查
if ss -tlnp | grep -q ":6697"; then
    echo "[PASS] TLS 端口 6697 正常" >> "$LOG"
else
    echo "[FAIL] TLS 端口 6697 未监听" >> "$LOG"
fi

# 3. 连接数统计
CONNS=$(ss -tnp | grep ":6697" | wc -l)
echo "[INFO] 当前连接数: $CONNS" >> "$LOG"

# 4. 磁盘空间
DISK=$(df -h /opt/irc | tail -1 | awk '{print $5}' | tr -d '%')
if [ "$DISK" -gt 80 ]; then
    echo "[WARN] 磁盘使用率: ${DISK}%" >> "$LOG"
fi

# 5. 证书有效期
CERT_EXPIRY=$(openssl x509 -in /opt/irc/certs/server.crt -enddate -noout | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$CERT_EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
echo "[INFO] TLS 证书剩余天数: $DAYS_LEFT" >> "$LOG"
if [ "$DAYS_LEFT" -lt 30 ]; then
    echo "[WARN] TLS 证书将在 $DAYS_LEFT 天后过期" >> "$LOG"
fi

# 6. 日志错误统计
ERRORS=$(tail -1000 /opt/irc/logs/ergo.log | grep -ci 'error\|fatal')
echo "[INFO] 近期错误数: $ERRORS" >> "$LOG"

echo "===== 检查完成 =====" >> "$LOG"

#!/bin/bash
# irc_backup.sh - IRC 完整备份脚本

set -euo pipefail

# 配置
IRC_DIR="/opt/irc"
BACKUP_BASE="/opt/backups/irc"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="${BACKUP_BASE}/${DATE}"
REMOTE_USER="backup"
REMOTE_HOST="backup.example.com"
REMOTE_DIR="/var/backups/irc"
KEEP_DAYS=30

# 创建备份目录
mkdir -p "$BACKUP_DIR"

echo "[$(date)] 开始 IRC 备份..."

# 1. 停止服务（可选，对于 SQLite 数据库一致性重要）
# systemctl stop ergo

# 2. 备份数据库
cp "${IRC_DIR}/data/ergo.db" "${BACKUP_DIR}/ergo.db"

# 3. 备份配置文件
tar czf "${BACKUP_DIR}/config.tar.gz" -C "${IRC_DIR}" config/

# 4. 备份 TLS 证书
tar czf "${BACKUP_DIR}/certs.tar.gz" -C "${IRC_DIR}" certs/

# 5. 备份日志（最近 7 天）
find "${IRC_DIR}/logs" -name "*.log" -mtime -7 -exec \
    tar czf "${BACKUP_DIR}/logs.tar.gz" {} +

# 6. 备份 Docker Compose 文件
cp "${IRC_DIR}/docker-compose.yml" "${BACKUP_DIR}/" 2>/dev/null || true

# 7. 创建校验和
cd "$BACKUP_DIR"
sha256sum * > checksums.sha256
cd -

# 8. 压缩整个备份
tar czf "${BACKUP_BASE}/${DATE}.tar.gz" -C "${BACKUP_BASE}" "${DATE}"
rm -rf "${BACKUP_DIR}"

# 9. 上传到远程
rsync -avz "${BACKUP_BASE}/${DATE}.tar.gz" \
    "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/"

# 10. 清理旧备份
find "${BACKUP_BASE}" -name "*.tar.gz" -mtime +${KEEP_DAYS} -delete

echo "[$(date)] IRC 备份完成: ${DATE}.tar.gz"

#!/bin/bash
# irc_restore.sh - IRC 备份恢复脚本

BACKUP_FILE="$1"

if [ -z "$BACKUP_FILE" ]; then
    echo "用法: $0 <backup_file.tar.gz>"
    exit 1
fi

echo "警告: 此操作将覆盖当前数据！"
read -p "确认恢复？(y/N): " CONFIRM
if [ "$CONFIRM" != "y" ]; then
    exit 1
fi

# 停止服务
systemctl stop ergo

# 解压备份
RESTORE_DIR="/tmp/irc_restore_$$"
mkdir -p "$RESTORE_DIR"
tar xzf "$BACKUP_FILE" -C "$RESTORE_DIR"
BACKUP_DIR=$(find "$RESTORE_DIR" -maxdepth 1 -type d | tail -1)

# 校验完整性
cd "$BACKUP_DIR"
sha256sum -c checksums.sha256
if [ $? -ne 0 ]; then
    echo "备份校验失败！"
    exit 1
fi

# 恢复数据库
cp "${BACKUP_DIR}/ergo.db" /opt/irc/data/ergo.db

# 恢复配置
tar xzf "${BACKUP_DIR}/config.tar.gz" -C /opt/irc/

# 恢复证书
tar xzf "${BACKUP_DIR}/certs.tar.gz" -C /opt/irc/

# 启动服务
systemctl start ergo

# 清理
rm -rf "$RESTORE_DIR"

echo "恢复完成"

# Ergo 多语言配置
server:
  # 语言设置
  # 频道级语言（通过 ChannelServ 设置）

# 各语言频道示例:
# #general        - 通用讨论（英语为主）
# #general-zh     - 中文讨论
# #general-ja     - 日语讨论
# #help           - 技术支持（英语）
# #help-zh        - 技术支持（中文）

# /etc/sysctl.conf - 内核优化

# 网络缓冲区
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# 连接队列
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535

# TIME_WAIT 优化
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# 文件描述符
fs.file-max = 2097152
fs.nr_open = 2097152

# Ergo 性能优化
limits:
  # 限制连接数防止单用户占用过多资源
  max-connections-per-ip: 3
  # 减少频道数
  channels-per-client: 50
  # 减少历史记录
  away-count: 3
  whowas-entries: 5
  # 减少监控列表
  monitor-entries: 50

# docker-compose.yml 性能配置
services:
  ergo:
    # 资源限制
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M

    # 日志限制
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

    # 内核参数
    sysctls:
      net.core.somaxconn: 65535

#!/usr/bin/env python3
"""
IRC Prometheus Exporter
"""

from prometheus_client import start_http_server, Gauge, Counter
import socket
import time

# 指标定义
IRC_CONNECTED_USERS = Gauge('irc_connected_users', '当前连接用户数')
IRC_CHANNELS = Gauge('irc_channels', '频道数')
IRC_MESSAGES_TOTAL = Counter('irc_messages_total', '总消息数')
IRC_UPTIME = Gauge('irc_uptime_seconds', '服务器运行时间')
IRC_MEMORY_USAGE = Gauge('irc_memory_bytes', '内存使用量')

def collect_metrics():
    """收集 IRC 指标"""
    try:
        # 通过管理接口获取指标
        # 这里示例使用文件或 socket 查询
        import subprocess

        # 用户数
        users = int(subprocess.check_output(
            "ss -tnp | grep :6697 | wc -l", shell=True
        ).strip())
        IRC_CONNECTED_USERS.set(users)

        # 内存使用
        import psutil
        for proc in psutil.process_iter(['name', 'memory_info']):
            if 'ergo' in proc.info['name'].lower():
                IRC_MEMORY_USAGE.set(proc.info['memory_info'].rss)
                break

    except Exception as e:
        print(f"指标收集失败: {e}")

if __name__ == '__main__':
    start_http_server(9100)
    print("Prometheus Exporter 已启动: http://localhost:9100")
    while True:
        collect_metrics()
        time.sleep(15)

{
  "dashboard": {
    "title": "IRC Server Dashboard",
    "panels": [
      {
        "title": "Connected Users",
        "type": "stat",
        "targets": [
          {
            "expr": "irc_connected_users",
            "legendFormat": "用户数"
          }
        ]
      },
      {
        "title": "Messages per Second",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(irc_messages_total[5m])",
            "legendFormat": "消息/秒"
          }
        ]
      }
    ]
  }
}

# prometheus/alert_rules.yml
groups:
  - name: irc_alerts
    rules:
      - alert: IRCServerDown
        expr: up{job="irc"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "IRC 服务器宕机"
          description: "IRC 服务器已无响应超过 1 分钟"

      - alert: IRCHighConnections
        expr: irc_connected_users > 5000
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "IRC 连接数过高"
          description: "当前连接数: {{ $value }}"

      - alert: IRCMemoryHigh
        expr: irc_memory_bytes > 1073741824
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "IRC 内存使用过高"
          description: "当前内存使用: {{ $value | humanize }}"

# 使用 Git 管理配置
cd /opt/irc
git init
echo "*.db" >> .gitignore
echo "*.log" >> .gitignore
echo "data/" >> .gitignore
git add .
git commit -m "Initial IRC server configuration"

# 配置变更时
git add config/
git commit -m "feat: add WebSocket listener"
git push

#!/bin/bash
# irc_security_audit.sh - IRC 安全审计脚本

echo "=== IRC 安全审计报告 $(date) ==="

# 1. TLS 配置检查
echo "[TLS 检查]"
echo | openssl s_client -connect localhost:6697 2>/dev/null | grep -E 'Protocol|Cipher|Server certificate'
echo ""

# 2. 开放端口检查
echo "[端口扫描]"
ss -tlnp | grep -E '6667|6697|6900|8080|8443'
echo ""

# 3. 文件权限检查
echo "[文件权限]"
ls -la /opt/irc/config/*.yaml /opt/irc/certs/*
echo ""

# 4. 检查匿名连接
echo "[匿名连接]"
ss -tnp | grep ":6697" | grep -v "ESTABLISHED" | head -20
echo ""

# 5. 检查可疑封禁
echo "[封禁统计]"
ss -tnp | grep ":6697" | wc -l
echo "当前连接数"
echo ""

# 6. 最近登录尝试
echo "[认证日志]"
tail -100 /opt/irc/logs/ergo.log | grep -i "sasl\|identify\|login" | tail -10
echo ""

echo "=== 审计完成 ==="