#!/bin/sh
# Audit: attack surface minimization (docs/Минимизация_поверхности_атаки_nginx)
set -eu

REPORT="${REPORT:-/reports/audit.log}"

{
  echo ""
  echo "=== Attack surface audit $(date -Iseconds) ==="
  echo "--- nginx -V ---"
  nginx -V 2>&1
  echo "--- load_module ---"
  nginx -T 2>/dev/null | grep load_module || echo "(none)"
  echo "--- optional modules in config ---"
  nginx -T 2>/dev/null | grep -E 'dav_methods|perl|js_import|js_content|xslt_stylesheet|auth_request' || echo "(none found)"
  echo "--- autoindex ---"
  nginx -T 2>/dev/null | grep autoindex || echo "(default off)"
  echo "--- limit_except / request_method ---"
  nginx -T 2>/dev/null | grep -E 'limit_except|request_method' || true
  echo "--- proxy_pass / upstream ---"
  nginx -T 2>/dev/null | grep -E 'proxy_pass|upstream' || true
  echo "--- ssi ---"
  nginx -T 2>/dev/null | grep -i 'ssi on' || echo "(ssi off)"
} >> "$REPORT"

echo "Attack surface audit appended -> $REPORT"