#!/bin/bash

# ============================================================
#   UNIVERSAL ACTIVE DEFENSE MONITORING SCRIPT v3.0
#   Cover : WHM/cPanel, CyberPanel, Minecraft, VPS Kosong
#   OS    : AlmaLinux 9 / Ubuntu 22 / Ubuntu 24
#   Fitur : Auto Ban, DDoS Protection, Cloudflare API,
#           AbuseIPDB Report, Telegram Bot Control
#   Author: IKYY x CLAUDE
#   Version: 3.0 (Performance Fix — Anti VPS Down)
# ============================================================

# --- WARNA ---
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
PURPLE='\033[0;35m'
BOLD='\033[1m'
NC='\033[0m'

# --- BANNER ---
clear
echo -e "${CYAN}${BOLD}"
echo "  ██╗██╗  ██╗██╗   ██╗██╗   ██╗    ██╗  ██╗    ███╗   ███╗ ██████╗ ███╗   ██╗"
echo "  ██║██║ ██╔╝╚██╗ ██╔╝╚██╗ ██╔╝    ╚██╗██╔╝    ████╗ ████║██╔═══██╗████╗  ██║"
echo "  ██║█████╔╝  ╚████╔╝  ╚████╔╝      ╚███╔╝     ██╔████╔██║██║   ██║██╔██╗ ██║"
echo "  ██║██╔═██╗   ╚██╔╝    ╚██╔╝       ██╔██╗     ██║╚██╔╝██║██║   ██║██║╚██╗██║"
echo "  ██║██║  ██╗   ██║      ██║       ██╔╝ ██╗    ██║ ╚═╝ ██║╚██████╔╝██║ ╚████║"
echo "  ╚═╝╚═╝  ╚═╝   ╚═╝      ╚═╝       ╚═╝  ╚═╝    ╚═╝     ╚═╝ ╚═════╝ ╚═╝  ╚═══╝"
echo -e "${NC}"
echo -e "${YELLOW}  Active Defense Monitoring v3.0 | by IKYY x CLAUDE${NC}"
echo -e "${CYAN}  ================================================================${NC}"
echo ""

# --- CEK ROOT ---
if [[ $EUID -ne 0 ]]; then
  echo -e "${RED}[ERROR] Script ini harus dijalankan sebagai root!${NC}"
  exit 1
fi

# --- DETEKSI OS ---
if grep -qi "almalinux" /etc/os-release; then
  OS="almalinux"
  OS_NAME="AlmaLinux"
  PKG="dnf"
elif grep -qi "ubuntu" /etc/os-release; then
  OS="ubuntu"
  OS_NAME="Ubuntu"
  PKG="apt"
else
  echo -e "${RED}[ERROR] OS tidak didukung!${NC}"
  exit 1
fi

echo -e "${GREEN}[OK] OS Terdeteksi: ${OS_NAME}${NC}"
echo ""

# ============================================================
# INPUT KONFIGURASI API
# ============================================================
echo -e "${CYAN}${BOLD}[ KONFIGURASI API & BOT ]${NC}"
echo ""

read -p "  Cloudflare API Token      : " CF_TOKEN
read -p "  Cloudflare Zone ID        : " CF_ZONE_ID
read -p "  AbuseIPDB API Key         : " ABUSE_KEY

while [[ -z "$TG_TOKEN" ]]; do
  read -p "  Telegram Bot Token (wajib): " TG_TOKEN
done
while [[ -z "$TG_CHAT_ID" ]]; do
  read -p "  Telegram Chat ID   (wajib): " TG_CHAT_ID
done

echo ""
echo -e "  ${YELLOW}IP kamu sendiri akan otomatis di-whitelist supaya tidak ke-ban.${NC}"
read -p "  IP HP/PC kamu (boleh kosong): " ADMIN_IP

echo ""
echo -e "  Panel yang terinstall:"
echo -e "  ${YELLOW}1${NC} = WHM/cPanel"
echo -e "  ${YELLOW}2${NC} = CyberPanel"
echo -e "  ${YELLOW}3${NC} = Minecraft"
echo -e "  ${YELLOW}4${NC} = Tanpa Panel"
# MO4: Validasi PANEL_TYPE input
while true; do
  read -p "  Pilih (1-4): " PANEL_TYPE
  PANEL_TYPE=${PANEL_TYPE:-4}
  if [[ "$PANEL_TYPE" =~ ^[1-4]$ ]]; then break; fi
  echo -e "  ${RED}Pilihan tidak valid! Masukkan 1, 2, 3, atau 4${NC}"
done

# FIX K5: Tanya interval monitoring — default 60 detik
echo ""
echo -e "  ${YELLOW}Interval monitoring (detik):${NC}"
echo -e "  ${YELLOW}Rekomendasi: 60 untuk VPS panel, 30 untuk VPS kosong${NC}"
read -p "  Interval (default: 60): " MONITOR_INTERVAL_INPUT
MONITOR_INTERVAL_INPUT=${MONITOR_INTERVAL_INPUT:-60}

echo ""
read -p "  Lanjutkan? (y/n): " CONFIRM
if [[ "$CONFIRM" != "y" && "$CONFIRM" != "Y" ]]; then
  echo -e "${RED}  Dibatalkan.${NC}"
  exit 0
fi

# ============================================================
# STEP 1: INSTALL DEPENDENSI
# FIX K1: Tambah ipset untuk blacklist massal
# ============================================================
echo ""
echo -e "${CYAN}${BOLD}[STEP 1/6] Install dependensi...${NC}"

if [[ "$OS" == "almalinux" ]]; then
  dnf install -y -q curl wget jq iptables-services ipset net-tools
else
  # MO1: DEBIAN_FRONTEND agar tidak stuck interaktif (iptables-persistent tanya konfirmasi)
  DEBIAN_FRONTEND=noninteractive apt update -qq
  DEBIAN_FRONTEND=noninteractive apt install -y -qq curl wget jq iptables-persistent ipset net-tools
fi

echo -e "${GREEN}  [OK] Dependensi terinstall${NC}"

# ============================================================
# STEP 2: SETUP DIREKTORI & KONFIGURASI
# ============================================================
echo -e "${CYAN}${BOLD}[STEP 2/6] Setup direktori & konfigurasi...${NC}"

MON_DIR="/opt/ikyy_monitor"
LOG_DIR="/var/log/ikyy_monitor"
CONFIG_FILE="${MON_DIR}/config.conf"
WHITELIST_FILE="${MON_DIR}/whitelist.txt"
BANNED_FILE="${MON_DIR}/banned.txt"
LAST_UPDATE_FILE="${MON_DIR}/last_update_id"
BANNED_LOCK="${MON_DIR}/banned.lock"

mkdir -p $MON_DIR $LOG_DIR

# Deteksi IP publik VPS
SERVER_PUBLIC_IP=$(curl -s -4 --max-time 5 ifconfig.me 2>/dev/null || curl -s -4 --max-time 5 icanhazip.com 2>/dev/null)

# Deteksi firewall
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qi "Status: active"; then
  FIREWALL_TYPE="ufw"
elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state 2>/dev/null | grep -qi "running"; then
  FIREWALL_TYPE="firewalld"
else
  FIREWALL_TYPE="iptables"
fi
echo -e "${CYAN}  Firewall terdeteksi: ${FIREWALL_TYPE}${NC}"

# Simpan konfigurasi
cat > $CONFIG_FILE <<EOF
# === IKYY x CLAUDE Monitor Config v3.0 ===
CF_TOKEN="${CF_TOKEN}"
CF_ZONE_ID="${CF_ZONE_ID}"
ABUSE_KEY="${ABUSE_KEY}"
TG_TOKEN="${TG_TOKEN}"
TG_CHAT_ID="${TG_CHAT_ID}"
PANEL_TYPE="${PANEL_TYPE}"
OS="${OS}"
SERVER_PUBLIC_IP="${SERVER_PUBLIC_IP}"
FIREWALL_TYPE="${FIREWALL_TYPE}"
LOG_DIR="${LOG_DIR}"

# Threshold
SSH_MAX_ATTEMPTS=8
HTTP_MAX_REQUESTS=500
DDOS_THRESHOLD=1000
# FIX K4: Port scan threshold lebih tinggi untuk VPS panel
PORTSCAN_THRESHOLD=30
BAN_DURATION=86400
# FIX K5: Interval lebih lambat
MONITOR_INTERVAL=${MONITOR_INTERVAL_INPUT}
EOF

chmod 600 $CONFIG_FILE
chown root:root $CONFIG_FILE

touch $WHITELIST_FILE $BANNED_FILE

# FIX K1: Setup ipset untuk blacklist massal
ipset create ikyy_blacklist hash:ip maxelem 1000000 2>/dev/null || ipset flush ikyy_blacklist 2>/dev/null

# Pasang ipset ke iptables
if ! iptables -C INPUT -m set --match-set ikyy_blacklist src -j DROP 2>/dev/null; then
  iptables -I INPUT -m set --match-set ikyy_blacklist src -j DROP
  iptables -I FORWARD -m set --match-set ikyy_blacklist src -j DROP
fi

# Auto-whitelist IP penting
{
  echo "127.0.0.1"
  echo "::1"
  [[ -n "$SERVER_PUBLIC_IP" ]] && echo "$SERVER_PUBLIC_IP"
  [[ -n "$ADMIN_IP" ]] && echo "$ADMIN_IP"
} | sort -u >> "$WHITELIST_FILE"

echo -e "${GREEN}  [OK] Direktori & konfigurasi siap${NC}"
echo -e "${GREEN}  [OK] ipset blacklist siap (support 1 juta IP)${NC}"
[[ -n "$SERVER_PUBLIC_IP" ]] && echo -e "${GREEN}  [OK] IP VPS (${SERVER_PUBLIC_IP}) otomatis di-whitelist${NC}"
[[ -n "$ADMIN_IP" ]] && echo -e "${GREEN}  [OK] IP admin (${ADMIN_IP}) otomatis di-whitelist${NC}"

# ============================================================
# STEP 3: BUAT SCRIPT MONITORING UTAMA
# ============================================================
echo -e "${CYAN}${BOLD}[STEP 3/6] Buat script monitoring...${NC}"

cat > ${MON_DIR}/monitor.sh << 'MONEOF'
#!/bin/bash

source /opt/ikyy_monitor/config.conf

LOG="${LOG_DIR}/monitor.log"
WHITELIST="/opt/ikyy_monitor/whitelist.txt"
BANNED="/opt/ikyy_monitor/banned.txt"
BANNED_LOCK="/opt/ikyy_monitor/banned.lock"
PAUSE_FLAG="/opt/ikyy_monitor/reassert_paused"
SSH_LOG_POS_FILE="/opt/ikyy_monitor/ssh_log_pos"

# FIX K6: Telegram notif queue untuk batch
TG_QUEUE_FILE="/opt/ikyy_monitor/tg_queue.txt"
TG_LAST_FLUSH=0

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; }

# ============================================================
# FUNGSI TELEGRAM — dengan rate limit & batching
# FIX K6: Notif di-batch agar tidak flood API
# ============================================================
send_telegram() {
  local MSG="$1"
  curl -s -X POST "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
    --data-urlencode "chat_id=${TG_CHAT_ID}" \
    --data-urlencode "text=${MSG}" \
    --data-urlencode "parse_mode=HTML" > /dev/null 2>&1
}

# Queue notif ban, flush tiap 60 detik
queue_ban_notif() {
  local IP="$1"
  local REASON="$2"
  echo "${IP}|${REASON}" >> "$TG_QUEUE_FILE"
}

flush_ban_notif() {
  [[ ! -f "$TG_QUEUE_FILE" ]] && return
  local COUNT
  COUNT=$(wc -l < "$TG_QUEUE_FILE" 2>/dev/null || echo 0)
  [[ $COUNT -eq 0 ]] && return

  if [[ $COUNT -eq 1 ]]; then
    local LINE IP REASON GEO COUNTRY
    LINE=$(cat "$TG_QUEUE_FILE")
    IP=$(echo "$LINE" | cut -d'|' -f1)
    REASON=$(echo "$LINE" | cut -d'|' -f2)
    GEO=$(curl -s --max-time 5 "https://ipapi.co/${IP}/json/" 2>/dev/null)
    COUNTRY=$(echo "$GEO" | jq -r '.country_name // "Unknown"' 2>/dev/null || echo "Unknown")
    send_telegram "🚨 <b>SERANGAN DIBLOK!</b>

🌐 IP: <code>${IP}</code>
🏳 Negara: ${COUNTRY}
⚔️ Jenis: ${REASON}
⏰ $(date '+%Y-%m-%d %H:%M:%S')
🖥 Server: $(hostname)"
  else
    # FIX K6: Batch notif — tidak kirim satu per satu
    local REASONS
    REASONS=$(awk -F'|' '{print "• " $1 " — " $2}' "$TG_QUEUE_FILE" | head -10)
    local EXTRA=""
    [[ $COUNT -gt 10 ]] && EXTRA="\n... dan $((COUNT-10)) lainnya"
    send_telegram "🚨 <b>${COUNT} SERANGAN DIBLOK!</b>

${REASONS}${EXTRA}

⏰ $(date '+%Y-%m-%d %H:%M:%S')
🖥 Server: $(hostname)"
  fi

  > "$TG_QUEUE_FILE"
}

# ============================================================
# FUNGSI CEK WHITELIST
# ============================================================
is_whitelisted() {
  local IP="$1"
  grep -q "^${IP}$" "$WHITELIST" 2>/dev/null
  return $?
}

# ============================================================
# FUNGSI CEK IP PRIVAT / LOOPBACK
# ============================================================
is_private_or_self() {
  local IP="$1"
  case "$IP" in
    127.*|10.*|192.168.*) return 0 ;;
    172.1[6-9].*|172.2[0-9].*|172.3[0-1].*) return 0 ;;
    169.254.*) return 0 ;;
    ::1|fe80:*|fc00:*|fd00:*) return 0 ;;
  esac
  if [[ -n "$SERVER_PUBLIC_IP" && "$IP" == "$SERVER_PUBLIC_IP" ]]; then
    return 0
  fi
  return 1
}

# ============================================================
# WRAPPER FIREWALL
# FIX K1: Gunakan ipset untuk ban — jauh lebih ringan dari UFW
# FIX K3: firewall-cmd --permanent TIDAK dipanggil tiap ban
# ============================================================
fw_ban_ip() {
  local IP="$1"
  # ipset adalah cara paling ringan — O(1) lookup, tidak perlu reload
  ipset add ikyy_blacklist "$IP" 2>/dev/null || true
}

fw_unban_ip() {
  local IP="$1"
  ipset del ikyy_blacklist "$IP" 2>/dev/null || true
  # Fallback untuk IP yang diban dengan cara lama
  case "$FIREWALL_TYPE" in
    ufw) ufw delete deny from "$IP" to any 2>/dev/null || true ;;
    firewalld) firewall-cmd --remove-rich-rule="rule family='ipv4' source address='${IP}' reject" 2>/dev/null || true ;;
    *) iptables -D INPUT -s "$IP" -j DROP 2>/dev/null || true ;;
  esac
}

# FIX K5: is_fw_rule_active pakai ipset — jauh lebih cepat dari ufw status
is_fw_rule_active() {
  local IP="$1"
  ipset test ikyy_blacklist "$IP" 2>/dev/null
  return $?
}

# ============================================================
# BANNED.TXT DENGAN LOCK FILE
# FIX F2: Lock file untuk hindari race condition
# ============================================================
banned_add() {
  local IP="$1"
  local TS="$2"
  (
    flock -w 5 200 || return
    echo "${IP}|${TS}" >> "$BANNED"
  ) 200>"$BANNED_LOCK"
}

banned_remove() {
  local IP="$1"
  (
    flock -w 5 200 || return
    # FIX F3: Gunakan grep + mv instead of sed -i untuk file besar
    grep -v "^${IP}|" "$BANNED" > "${BANNED}.tmp" && mv "${BANNED}.tmp" "$BANNED"
  ) 200>"$BANNED_LOCK"
}

# ============================================================
# FUNGSI BAN IP
# FIX K1: Pakai ipset, bukan UFW per IP
# FIX K6: Queue notif, jangan langsung kirim
# FIX F1: URL-encode AbuseIPDB
# ============================================================
ban_ip() {
  local IP="$1"
  local REASON="$2"

  if is_whitelisted "$IP"; then
    log "IP $IP di whitelist — skip ban"
    return
  fi

  if is_private_or_self "$IP"; then
    log "IP $IP adalah IP privat/server sendiri — skip ban"
    return
  fi

  if grep -q "^${IP}|" "$BANNED" 2>/dev/null; then
    return
  fi

  log "BANNING IP: $IP | Alasan: $REASON"

  # FIX K1: ipset ban — sangat ringan
  fw_ban_ip "$IP"
  ip route add blackhole "$IP" 2>/dev/null || true
  banned_add "$IP" "$(date +%s)"

  # FIX F1: AbuseIPDB dengan --data-urlencode
  if [[ -n "$ABUSE_KEY" ]]; then
    curl -s -X POST "https://api.abuseipdb.com/api/v2/report" \
      -H "Key: ${ABUSE_KEY}" \
      -H "Accept: application/json" \
      --data-urlencode "ip=${IP}" \
      --data-urlencode "categories=18,22" \
      --data-urlencode "comment=Auto-reported by IKYY Monitor: ${REASON}" > /dev/null 2>&1 &
  fi

  # Cloudflare WAF
  if [[ -n "$CF_TOKEN" && -n "$CF_ZONE_ID" ]]; then
    curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules" \
      -H "Authorization: Bearer ${CF_TOKEN}" \
      -H "Content-Type: application/json" \
      -d "{\"action\":\"block\",\"expression\":\"ip.src eq ${IP}\",\"description\":\"IKYY Monitor: ${REASON}\",\"enabled\":true}" \
      > /dev/null 2>&1 &
  fi

  # FIX K6: Queue notif, jangan kirim langsung
  queue_ban_notif "$IP" "$REASON"
  log "IP $IP berhasil dibanned | Alasan: $REASON"
}

# ============================================================
# FUNGSI UNBAN IP
# ============================================================
unban_ip() {
  local IP="$1"
  fw_unban_ip "$IP"
  ip route del blackhole "$IP" 2>/dev/null || true
  banned_remove "$IP"

  if [[ -n "$CF_TOKEN" && -n "$CF_ZONE_ID" ]]; then
    RULE_ID=$(curl -s "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules" \
      -H "Authorization: Bearer ${CF_TOKEN}" | \
      jq -r ".result[] | select(.description | contains(\"${IP}\")) | .id" 2>/dev/null | head -1)
    if [[ -n "$RULE_ID" && "$RULE_ID" != "null" ]]; then
      curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules/${RULE_ID}" \
        -H "Authorization: Bearer ${CF_TOKEN}" > /dev/null 2>&1
    fi
  fi
  log "IP $IP di-unban"
}

# ============================================================
# FUNGSI CEK BAN EXPIRED
# ============================================================
check_expired_bans() {
  [[ ! -f "$BANNED" ]] && return
  local NOW=$(date +%s)
  local DURATION="${BAN_DURATION:-86400}"
  local EXPIRED_IPS=()

  while IFS='|' read -r IP TS; do
    [[ -z "$IP" || -z "$TS" ]] && continue
    if [[ $((NOW - TS)) -ge $DURATION ]]; then
      EXPIRED_IPS+=("$IP")
    fi
  done < "$BANNED"

  for IP in "${EXPIRED_IPS[@]}"; do
    log "Ban IP $IP expired — auto-unban"
    unban_ip "$IP"
  done

  if [[ ${#EXPIRED_IPS[@]} -gt 0 ]]; then
    send_telegram "⏰ <b>AUTO-UNBAN</b>
${#EXPIRED_IPS[@]} IP sudah melewati masa ban dan otomatis di-unban."
  fi
}

# ============================================================
# FUNGSI REASSERT BAN
# FIX K5: Pakai ipset check bukan ufw status
# ============================================================
reassert_bans() {
  if [[ -f "$PAUSE_FLAG" ]]; then
    local PAUSED_AT NOW_TS
    PAUSED_AT=$(cat "$PAUSE_FLAG" 2>/dev/null)
    NOW_TS=$(date +%s)
    if [[ -n "$PAUSED_AT" && $((NOW_TS - PAUSED_AT)) -lt 7200 ]]; then
      return
    else
      rm -f "$PAUSE_FLAG"
      send_telegram "▶️ <b>AUTO-RESUME</b>
Pause auto-reassert sudah lewat 2 jam, aktif kembali."
    fi
  fi

  [[ ! -f "$BANNED" ]] && return
  local REAPPLIED=0
  local NOW=$(date +%s)
  local DURATION="${BAN_DURATION:-86400}"

  while IFS='|' read -r IP TS; do
    [[ -z "$IP" ]] && continue
    if [[ -n "$TS" && $((NOW - TS)) -ge $DURATION ]]; then
      continue
    fi
    # FIX K5: ipset test — sangat cepat vs ufw status
    if ! ipset test ikyy_blacklist "$IP" 2>/dev/null; then
      fw_ban_ip "$IP"
      REAPPLIED=$((REAPPLIED+1))
      log "Rule untuk $IP hilang — dipasang ulang via ipset"
    fi
  done < "$BANNED"

  if [[ $REAPPLIED -gt 0 ]]; then
    send_telegram "🔁 <b>REASSERT BAN</b>
${REAPPLIED} IP dipasang ulang ke ipset blacklist."
  fi
}

# ============================================================
# MONITOR SSH BRUTE FORCE
# ============================================================
monitor_ssh() {
  if [[ "$OS" == "almalinux" ]]; then
    LOG_FILE="/var/log/secure"
  else
    LOG_FILE="/var/log/auth.log"
    # MO3: Ubuntu 22/24 dengan systemd-journald mungkin tidak punya auth.log
    # Fallback ke journalctl kalau file tidak ada
    if [[ ! -f "$LOG_FILE" ]]; then
      journalctl -u ssh -u sshd --since "5 minutes ago" --no-pager 2>/dev/null | \
        grep "Failed password" | \
        grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
        sort | uniq -c | sort -rn | \
        while read COUNT IP; do
          if [[ $COUNT -ge ${SSH_MAX_ATTEMPTS:-8} ]]; then
            ban_ip "$IP" "SSH Brute Force via journal (${COUNT}x)"
          fi
        done
      return
    fi
  fi

  [[ ! -f "$LOG_FILE" ]] && return

  local CURRENT_SIZE
  CURRENT_SIZE=$(wc -c < "$LOG_FILE" 2>/dev/null || echo 0)
  local LAST_POS
  LAST_POS=$(cat "$SSH_LOG_POS_FILE" 2>/dev/null || echo 0)

  if [[ $CURRENT_SIZE -lt $LAST_POS ]]; then
    LAST_POS=0
  fi

  tail -c +$((LAST_POS + 1)) "$LOG_FILE" 2>/dev/null | \
    grep "Failed password" | \
    grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
    sort | uniq -c | sort -rn | \
    while read COUNT IP; do
      if [[ $COUNT -ge ${SSH_MAX_ATTEMPTS:-8} ]]; then
        ban_ip "$IP" "SSH Brute Force (${COUNT}x)"
      fi
    done

  echo "$CURRENT_SIZE" > "$SSH_LOG_POS_FILE"
}

# ============================================================
# MONITOR HTTP FLOOD
# ============================================================
monitor_http() {
  ss -ntu 2>/dev/null | \
    grep -E ':80|:443|:8090|:2087|:2083' | \
    grep ESTAB | \
    awk '{print $6}' | \
    grep -oE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
    sort | uniq -c | sort -rn | \
    while read COUNT IP; do
      if [[ $COUNT -ge ${HTTP_MAX_REQUESTS:-500} ]]; then
        ban_ip "$IP" "HTTP Flood (${COUNT} koneksi)"
      fi
    done

  local SYN_COUNT
  SYN_COUNT=$(ss -ntu 2>/dev/null | grep -c SYN-RECV || echo 0)
  if [[ $SYN_COUNT -ge ${DDOS_THRESHOLD:-1000} ]]; then
    log "SYN FLOOD DETECTED! Count: $SYN_COUNT"
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    if ! iptables -C INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT 2>/dev/null; then
      iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
      iptables -A INPUT -p tcp --syn -j DROP
    fi
    send_telegram "⚠️ <b>SYN FLOOD TERDETEKSI!</b>
Count: ${SYN_COUNT} SYN packets
✅ SYN Cookies + Rate limiting aktif"
  fi
}

# ============================================================
# MONITOR PORT SCANNING
# FIX K4: Threshold lebih tinggi + skip IP panel/lokal
# ============================================================
monitor_portscan() {
  ss -ntu 2>/dev/null | \
    grep -v LISTEN | \
    awk '{print $5, $6}' | \
    while read LOCAL REMOTE; do
      REMOTE_IP=$(echo "$REMOTE" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
      LOCAL_PORT=$(echo "$LOCAL" | awk -F: '{print $NF}')
      [[ -n "$REMOTE_IP" ]] && echo "$REMOTE_IP $LOCAL_PORT"
    done | sort -u | \
    awk '{print $1}' | sort | uniq -c | sort -rn | \
    while read PORT_COUNT IP; do
      # FIX K4: Skip IP lokal/privat dulu sebelum ban
      case "$IP" in
        127.*|10.*|192.168.*|172.1[6-9].*|172.2[0-9].*|172.3[0-1].*) continue ;;
      esac
      # FIX K4: Threshold lebih tinggi (30, bukan 15) untuk hindari false positive panel
      if [[ $PORT_COUNT -ge ${PORTSCAN_THRESHOLD:-30} ]]; then
        ban_ip "$IP" "Port Scanning (${PORT_COUNT} port)"
      fi
    done
}

# ============================================================
# MONITOR LOGIN PANEL
# ============================================================
monitor_panel() {
  case $PANEL_TYPE in
    1)
      if [[ -f "/usr/local/cpanel/logs/login_log" ]]; then
        tail -500 /usr/local/cpanel/logs/login_log 2>/dev/null | \
          grep "FAILED" | \
          grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
          sort | uniq -c | sort -rn | \
          while read COUNT IP; do
            [[ $COUNT -ge 3 ]] && ban_ip "$IP" "cPanel Login Attack (${COUNT}x)"
          done
      fi
      ;;
    2)
      local CP_LOG=""
      [[ -f "/usr/local/CyberCP/logs/error.log" ]] && CP_LOG="/usr/local/CyberCP/logs/error.log"
      [[ -f "/var/log/cyberpanel.log" ]] && CP_LOG="/var/log/cyberpanel.log"
      if [[ -n "$CP_LOG" ]]; then
        tail -500 "$CP_LOG" 2>/dev/null | \
          grep -i "fail\|invalid\|unauthorized" | \
          grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
          sort | uniq -c | sort -rn | \
          while read COUNT IP; do
            [[ $COUNT -ge 3 ]] && ban_ip "$IP" "CyberPanel Login Attack (${COUNT}x)"
          done
      fi
      ;;
    3)
      if [[ -f "/home/minecraft/server/logs/latest.log" ]]; then
        tail -200 /home/minecraft/server/logs/latest.log 2>/dev/null | \
          grep "lost connection\|Disconnecting" | \
          grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
          sort | uniq -c | sort -rn | \
          while read COUNT IP; do
            [[ $COUNT -ge 10 ]] && ban_ip "$IP" "Minecraft Flood (${COUNT}x)"
          done
      fi
      ;;
  esac
}

# ============================================================
# UPDATE BLACKLIST
# FIX K2: Tidak jalan di main loop — hanya via cron atau argument
# FIX K1: Pakai ipset batch add — jauh lebih cepat dari loop UFW
# FIX K3: Tidak ada firewall-cmd --permanent per IP
# ============================================================
update_blacklist() {
  log "Update IP blacklist dimulai..."
  send_telegram "🔄 <b>UPDATE BLACKLIST MULAI</b>
Mendownload daftar IP berbahaya..."

  SOURCES=(
    "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"
    "https://lists.blocklist.de/lists/ssh.txt"
    "https://lists.blocklist.de/lists/bruteforcelogin.txt"
  )

  > /tmp/new_blacklist.txt

  for URL in "${SOURCES[@]}"; do
    curl -s --max-time 60 "$URL" 2>/dev/null | \
      grep -oE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' >> /tmp/new_blacklist.txt
  done

  # FIX K1: Buat ipset batch file — jauh lebih cepat
  > /tmp/ipset_batch.txt
  echo "create ikyy_blacklist_new hash:ip maxelem 1000000" >> /tmp/ipset_batch.txt

  NEW_IPS=0
  while read IP; do
    if is_private_or_self "$IP"; then continue; fi
    if is_whitelisted "$IP"; then continue; fi
    echo "add ikyy_blacklist_new $IP" >> /tmp/ipset_batch.txt
    if ! grep -q "^${IP}|" "$BANNED" 2>/dev/null; then
      banned_add "$IP" "$(date +%s)"
      NEW_IPS=$((NEW_IPS+1))
    fi
  done < /tmp/new_blacklist.txt

  # Apply ipset batch sekaligus — 1 operasi, bukan 50.000
  echo "swap ikyy_blacklist_new ikyy_blacklist" >> /tmp/ipset_batch.txt
  echo "destroy ikyy_blacklist_new" >> /tmp/ipset_batch.txt
  ipset restore < /tmp/ipset_batch.txt 2>/dev/null || true

  rm -f /tmp/new_blacklist.txt /tmp/ipset_batch.txt
  log "Blacklist updated: ${NEW_IPS} IP baru diblok"

  send_telegram "🔄 <b>UPDATE BLACKLIST SELESAI</b>
✅ ${NEW_IPS} IP berbahaya baru diblok
📋 Total banned: $(wc -l < $BANNED) IP
⏰ $(date '+%Y-%m-%d %H:%M:%S')"
}

# Handle argument dari cron
if [[ "$1" == "update_blacklist" ]]; then
  update_blacklist
  exit 0
fi

# ============================================================
# LAPORAN HARIAN
# ============================================================
send_daily_report() {
  local TOTAL_BANNED RAM_USED RAM_TOTAL DISK_FREE CPU_LOAD
  TOTAL_BANNED=$(wc -l < "$BANNED" 2>/dev/null || echo 0)
  RAM_USED=$(free -m | awk '/^Mem:/{print $3}')
  RAM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')
  DISK_FREE=$(df -h / | awk 'NR==2{print $4}')
  CPU_LOAD=$(uptime | awk -F'load average:' '{print $2}' | awk -F',' '{print $1}' | tr -d ' ')

  send_telegram "📊 <b>LAPORAN HARIAN SERVER</b>

🖥 Server: $(hostname)
🌐 IP: $(hostname -I | awk '{print $1}')
⏰ $(date '+%Y-%m-%d %H:%M:%S')

💻 Status:
  CPU Load: ${CPU_LOAD}
  RAM: ${RAM_USED}MB / ${RAM_TOTAL}MB
  Disk: ${DISK_FREE} tersisa

🛡 Keamanan:
  Total IP Banned: ${TOTAL_BANNED}
  Monitoring: ✅ Aktif

Selamat pagi! Server lo aman. 🙏"
}

# ============================================================
# LOOP MONITORING UTAMA
# FIX K2: update_blacklist TIDAK dipanggil di sini
# FIX K6: flush_ban_notif tiap 60 detik
# ============================================================
log "=== Monitoring v3.0 dimulai: $(date) ==="
send_telegram "🟢 <b>MONITORING v3.0 AKTIF</b>

🖥 Server: $(hostname)
🌐 IP: $(hostname -I | awk '{print $1}')
🔒 Panel: Type ${PANEL_TYPE}
⚡ Engine: ipset (anti-overload)
⏰ $(date '+%Y-%m-%d %H:%M:%S')

Server dalam pengawasan aktif. 🛡"

LAST_DAILY_REPORT=0
LAST_TG_FLUSH=0

while true; do
  monitor_ssh
  monitor_http
  monitor_portscan
  monitor_panel
  check_expired_bans
  reassert_bans

  NOW=$(date +%s)

  # FIX K6: Flush notif tiap 60 detik
  if [[ $((NOW - LAST_TG_FLUSH)) -ge 60 ]]; then
    flush_ban_notif
    LAST_TG_FLUSH=$NOW
  fi

  HOUR=$(date +%H)
  if [[ "$HOUR" == "07" && $((NOW - LAST_DAILY_REPORT)) -ge 86400 ]]; then
    send_daily_report
    LAST_DAILY_REPORT=$NOW
  fi

  sleep ${MONITOR_INTERVAL:-60}
done
MONEOF

chmod +x ${MON_DIR}/monitor.sh
echo -e "${GREEN}  [OK] Script monitoring v3.0 dibuat${NC}"

# ============================================================
# STEP 4: BUAT TELEGRAM BOT HANDLER
# ============================================================
echo -e "${CYAN}${BOLD}[STEP 4/6] Buat Telegram Bot Handler...${NC}"

cat > ${MON_DIR}/bot.sh << 'BOTEOF'
#!/bin/bash

source /opt/ikyy_monitor/config.conf

LOG="/var/log/ikyy_monitor/bot.log"
WHITELIST="/opt/ikyy_monitor/whitelist.txt"
BANNED="/opt/ikyy_monitor/banned.txt"
BANNED_LOCK="/opt/ikyy_monitor/banned.lock"
PAUSE_FLAG="/opt/ikyy_monitor/reassert_paused"
LAST_UPDATE_FILE="/opt/ikyy_monitor/last_update_id"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; }

fw_unban_ip() {
  local IP="$1"
  ipset del ikyy_blacklist "$IP" 2>/dev/null || true
  case "$FIREWALL_TYPE" in
    ufw) ufw delete deny from "$IP" to any 2>/dev/null || true ;;
    firewalld) firewall-cmd --remove-rich-rule="rule family='ipv4' source address='${IP}' reject" 2>/dev/null || true ;;
    *) iptables -D INPUT -s "$IP" -j DROP 2>/dev/null || true ;;
  esac
}

banned_remove() {
  local IP="$1"
  (
    flock -w 5 200 || return
    grep -v "^${IP}|" "$BANNED" > "${BANNED}.tmp" && mv "${BANNED}.tmp" "$BANNED"
  ) 200>"$BANNED_LOCK"
}

unban_ip() {
  local IP="$1"
  fw_unban_ip "$IP"
  ip route del blackhole "$IP" 2>/dev/null || true
  banned_remove "$IP"

  if [[ -n "$CF_TOKEN" && -n "$CF_ZONE_ID" ]]; then
    RULE_ID=$(curl -s "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules" \
      -H "Authorization: Bearer ${CF_TOKEN}" | \
      jq -r ".result[] | select(.description | contains(\"${IP}\")) | .id" 2>/dev/null | head -1)
    if [[ -n "$RULE_ID" && "$RULE_ID" != "null" ]]; then
      curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/rulesets/phases/http_request_firewall_custom/entrypoint/rules/${RULE_ID}" \
        -H "Authorization: Bearer ${CF_TOKEN}" > /dev/null 2>&1
    fi
  fi
  log "IP $IP di-unban (via Telegram)"
}

send_msg() {
  local CHAT="$1"
  local MSG="$2"
  curl -s -X POST "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
    --data-urlencode "chat_id=${CHAT}" \
    --data-urlencode "text=${MSG}" \
    --data-urlencode "parse_mode=HTML" > /dev/null 2>&1
}

validate_ip() {
  [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]
}

LAST_UPDATE=$(cat "$LAST_UPDATE_FILE" 2>/dev/null || echo 0)

while true; do
  UPDATES=$(curl -s --max-time 35 "https://api.telegram.org/bot${TG_TOKEN}/getUpdates?offset=$((LAST_UPDATE+1))&timeout=30")

  while read -r UPDATE; do
    UPDATE_ID=$(echo "$UPDATE" | jq -r '.update_id')
    CHAT_ID=$(echo "$UPDATE" | jq -r '.message.chat.id')
    TEXT=$(echo "$UPDATE" | jq -r '.message.text // ""')

    LAST_UPDATE=$UPDATE_ID
    echo "$LAST_UPDATE" > "$LAST_UPDATE_FILE"

    if [[ "$CHAT_ID" != "$TG_CHAT_ID" ]]; then
      log "Chat ID tidak dikenal: $CHAT_ID — diabaikan"
      continue
    fi

    log "Perintah: $TEXT"

    case "$TEXT" in
      /start|/help)
        send_msg "$CHAT_ID" "🤖 <b>IKYY Monitor Bot v3.0</b>

🟢 /start_monitor — Mulai monitoring
🔴 /stop_monitor — Stop monitoring
📊 /status — Status server
🚫 /banned_list — Daftar IP banned
✅ /unban [IP] — Unban IP
🛡 /whitelist_add [IP] — Whitelist IP
📋 /log — Log serangan terakhir
🔄 /restart_server — Restart service
⏸ /pause_reassert — Jeda auto-reassert
▶️ /resume_reassert — Aktifkan auto-reassert
🔄 /update_blacklist — Update blacklist sekarang
❓ /help — Menu ini"
        ;;

      /start_monitor)
        systemctl start ikyy_monitor 2>/dev/null
        sleep 2
        if systemctl is-active --quiet ikyy_monitor; then
          send_msg "$CHAT_ID" "🟢 <b>Monitoring AKTIF!</b> 🛡"
        else
          send_msg "$CHAT_ID" "❌ Gagal start. Cek: systemctl status ikyy_monitor"
        fi
        ;;

      /stop_monitor)
        systemctl stop ikyy_monitor 2>/dev/null
        send_msg "$CHAT_ID" "🔴 <b>Monitoring DIHENTIKAN</b>
Ketik /start_monitor untuk aktifkan kembali."
        ;;

      /status)
        RAM_USED=$(free -m | awk '/^Mem:/{print $3}')
        RAM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')
        RAM_PCT=$((RAM_USED * 100 / RAM_TOTAL))
        DISK_FREE=$(df -h / | awk 'NR==2{print $4}')
        DISK_PCT=$(df / | awk 'NR==2{print $5}')
        CPU_LOAD=$(uptime | awk -F'load average:' '{print $2}' | awk -F',' '{print $1}' | tr -d ' ')
        UPTIME=$(uptime -p)
        BANNED_COUNT=$(wc -l < "$BANNED" 2>/dev/null || echo 0)
        IPSET_COUNT=$(ipset list ikyy_blacklist 2>/dev/null | grep "Number of entries" | awk '{print $NF}' || echo 0)
        MON_STATUS=$(systemctl is-active ikyy_monitor 2>/dev/null || echo "inactive")

        send_msg "$CHAT_ID" "📊 <b>STATUS SERVER</b>

🖥 Host: $(hostname)
🌐 IP: $(hostname -I | awk '{print $1}')
⏱ Uptime: ${UPTIME}

💻 Resource:
  CPU Load: ${CPU_LOAD}
  RAM: ${RAM_USED}/${RAM_TOTAL}MB (${RAM_PCT}%)
  Disk: ${DISK_FREE} tersisa (${DISK_PCT} used)

🛡 Keamanan:
  Monitoring: ${MON_STATUS}
  IP Banned (file): ${BANNED_COUNT}
  IP Banned (ipset): ${IPSET_COUNT}

⏰ $(date '+%Y-%m-%d %H:%M:%S')"
        ;;

      /banned_list)
        BANNED_COUNT=$(wc -l < "$BANNED" 2>/dev/null || echo 0)
        if [[ $BANNED_COUNT -eq 0 ]]; then
          send_msg "$CHAT_ID" "✅ Tidak ada IP yang dibanned saat ini."
        else
          LAST_10=$(tail -10 "$BANNED" 2>/dev/null | awk -F'|' '{
            cmd = "date -d @" $2 " \"+%Y-%m-%d %H:%M\" 2>/dev/null || date -r " $2 " \"+%Y-%m-%d %H:%M\" 2>/dev/null"
            cmd | getline waktu
            close(cmd)
            print $1 " (banned: " (waktu != "" ? waktu : "tidak diketahui") ")"
          }')
          send_msg "$CHAT_ID" "🚫 <b>IP BANNED (${BANNED_COUNT} total)</b>

10 terbaru:
<code>${LAST_10}</code>

Gunakan /unban [IP] untuk unban manual."
        fi
        ;;

      /unban\ *)
        UNBAN_IP=$(echo "$TEXT" | awk '{print $2}')
        if [[ -z "$UNBAN_IP" ]]; then
          send_msg "$CHAT_ID" "❌ Format: /unban 1.2.3.4"
        elif ! validate_ip "$UNBAN_IP"; then
          send_msg "$CHAT_ID" "❌ Format IP tidak valid: ${UNBAN_IP}"
        else
          unban_ip "$UNBAN_IP"
          CF_NOTE="⚠️ Cloudflare tidak aktif"
          [[ -n "$CF_TOKEN" ]] && CF_NOTE="✅ Dihapus dari Cloudflare"
          send_msg "$CHAT_ID" "✅ <b>IP ${UNBAN_IP} di-unban!</b>
  ✅ Dihapus dari ipset
  ✅ Null route dihapus
  ${CF_NOTE}
  ✅ Dihapus dari banned list"
        fi
        ;;

      /whitelist_add\ *)
        WL_IP=$(echo "$TEXT" | awk '{print $2}')
        if [[ -z "$WL_IP" ]]; then
          send_msg "$CHAT_ID" "❌ Format: /whitelist_add 1.2.3.4"
        elif ! validate_ip "$WL_IP"; then
          send_msg "$CHAT_ID" "❌ Format IP tidak valid: ${WL_IP}"
        else
          grep -q "^${WL_IP}$" "$WHITELIST" 2>/dev/null || echo "$WL_IP" >> "$WHITELIST"
          banned_remove "$WL_IP"
          fw_unban_ip "$WL_IP"
          ip route del blackhole "$WL_IP" 2>/dev/null || true
          send_msg "$CHAT_ID" "✅ <b>IP ${WL_IP} diwhitelist!</b>
IP ini tidak akan pernah dibanned. 🛡"
        fi
        ;;

      /log)
        local LOG_FILE="/var/log/ikyy_monitor/monitor.log"
        if [[ -f "$LOG_FILE" ]]; then
          LAST_LOG=$(tail -15 "$LOG_FILE" 2>/dev/null)
          send_msg "$CHAT_ID" "📋 <b>LOG TERAKHIR</b>

<code>${LAST_LOG}</code>"
        else
          send_msg "$CHAT_ID" "📋 Log belum ada."
        fi
        ;;

      /restart_server)
        send_msg "$CHAT_ID" "🔄 Merestart service..."
        case $PANEL_TYPE in
          1) systemctl restart httpd mysql 2>/dev/null
             send_msg "$CHAT_ID" "✅ Apache & MySQL direstart!" ;;
          2) systemctl restart lscpd lsws 2>/dev/null
             send_msg "$CHAT_ID" "✅ CyberPanel & LiteSpeed direstart!" ;;
          3) systemctl restart minecraft 2>/dev/null
             send_msg "$CHAT_ID" "✅ Minecraft direstart!" ;;
          *) send_msg "$CHAT_ID" "ℹ Tidak ada panel untuk direstart." ;;
        esac
        ;;

      /update_blacklist)
        send_msg "$CHAT_ID" "🔄 Update blacklist dimulai..."
        /bin/bash /opt/ikyy_monitor/monitor.sh update_blacklist &
        send_msg "$CHAT_ID" "✅ Update blacklist berjalan di background."
        ;;

      /pause_reassert)
        date +%s > "$PAUSE_FLAG"
        send_msg "$CHAT_ID" "⏸ <b>Auto-reassert DIJEDA 2 jam.</b>
Aman untuk re-run hardening.sh sekarang."
        ;;

      /resume_reassert)
        rm -f "$PAUSE_FLAG"
        send_msg "$CHAT_ID" "▶️ <b>Auto-reassert AKTIF kembali.</b>"
        ;;

      *)
        if [[ -n "$TEXT" && "$TEXT" == /* ]]; then
          send_msg "$CHAT_ID" "❓ Perintah tidak dikenal. Ketik /help"
        fi
        ;;
    esac
  done < <(echo "$UPDATES" | jq -c '.result[]' 2>/dev/null)

  sleep 2
done
BOTEOF

chmod +x ${MON_DIR}/bot.sh
echo -e "${GREEN}  [OK] Telegram Bot Handler dibuat${NC}"

# ============================================================
# STEP 5: SETUP SYSTEMD SERVICE
# ============================================================
echo -e "${CYAN}${BOLD}[STEP 5/6] Setup systemd service...${NC}"

cat > /etc/systemd/system/ikyy_monitor.service <<EOF
[Unit]
Description=IKYY x CLAUDE Active Defense Monitor v3.0
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash /opt/ikyy_monitor/monitor.sh
Restart=always
RestartSec=10
# Batasi CPU agar tidak overload VPS
CPUQuota=30%
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

cat > /etc/systemd/system/ikyy_bot.service <<EOF
[Unit]
Description=IKYY x CLAUDE Telegram Bot
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash /opt/ikyy_monitor/bot.sh
Restart=always
RestartSec=10
CPUQuota=10%
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

# FIX K1: Pastikan ipset rules survive reboot
if [[ "$OS" == "ubuntu" ]]; then
  # Ubuntu: pakai if-pre-up.d
  cat > /etc/network/if-pre-up.d/ikyy-ipset <<'EOF'
#!/bin/bash
ipset create ikyy_blacklist hash:ip maxelem 1000000 2>/dev/null || true
iptables -C INPUT -m set --match-set ikyy_blacklist src -j DROP 2>/dev/null || \
  iptables -I INPUT -m set --match-set ikyy_blacklist src -j DROP
iptables -C FORWARD -m set --match-set ikyy_blacklist src -j DROP 2>/dev/null || \
  iptables -I FORWARD -m set --match-set ikyy_blacklist src -j DROP
EOF
  chmod +x /etc/network/if-pre-up.d/ikyy-ipset
else
  # MO2: AlmaLinux — pakai systemd service yang reliable, bukan NetworkManager dispatcher
  cat > /etc/systemd/system/ikyy-ipset.service <<'EOF'
[Unit]
Description=IKYY ipset blacklist restore
DefaultDependencies=no
Before=network.target firewalld.service ikyy_monitor.service
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c 'ipset create ikyy_blacklist hash:ip maxelem 1000000 2>/dev/null || true; iptables -C INPUT -m set --match-set ikyy_blacklist src -j DROP 2>/dev/null || iptables -I INPUT -m set --match-set ikyy_blacklist src -j DROP; iptables -C FORWARD -m set --match-set ikyy_blacklist src -j DROP 2>/dev/null || iptables -I FORWARD -m set --match-set ikyy_blacklist src -j DROP'
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF
  systemctl enable ikyy-ipset
fi

systemctl daemon-reload
systemctl enable ikyy_monitor ikyy_bot
systemctl start ikyy_monitor ikyy_bot

echo -e "${GREEN}  [OK] Service monitoring & bot aktif${NC}"
echo -e "${GREEN}  [OK] CPU limit: monitor 30%, bot 10%${NC}"
echo -e "${GREEN}  [OK] ipset survive reboot${NC}"

# ============================================================
# STEP 6: SETUP CRON
# FIX K2: Blacklist update HANYA via cron (jam 02:00)
# ============================================================
echo -e "${CYAN}${BOLD}[STEP 6/6] Setup cron...${NC}"

(crontab -l 2>/dev/null; echo "0 2 * * * /bin/bash /opt/ikyy_monitor/monitor.sh update_blacklist >> /var/log/ikyy_monitor/blacklist_update.log 2>&1") | crontab -

echo -e "${GREEN}  [OK] Blacklist update dijadwalkan jam 02:00 setiap hari${NC}"

# ============================================================
# RINGKASAN
# ============================================================
SERVER_IP=$(hostname -I | awk '{print $1}')

echo ""
echo -e "${CYAN}${BOLD}"
echo "  ================================================================"
echo "   MONITORING v3.0 AKTIF! ANTI VPS DOWN — ULTRA RINGAN"
echo "  ================================================================"
echo -e "${NC}"
echo -e "${BOLD}  YANG AKTIF SEKARANG:${NC}"
echo ""
echo -e "  🛡  Auto Ban SSH Brute Force   : ${GREEN}AKTIF${NC}"
echo -e "  🛡  Auto Ban HTTP Flood/DDoS   : ${GREEN}AKTIF${NC}"
echo -e "  🛡  Auto Ban Port Scanner      : ${GREEN}AKTIF${NC} (threshold lebih aman)"
echo -e "  ⚡  Engine Ban                 : ${GREEN}ipset (ultra ringan)${NC}"
if [[ -n "$CF_TOKEN" && -n "$CF_ZONE_ID" ]]; then
  echo -e "  🛡  Cloudflare Auto Ban        : ${GREEN}AKTIF${NC}"
else
  echo -e "  🛡  Cloudflare Auto Ban        : ${YELLOW}TIDAK DIKONFIGURASI${NC}"
fi
if [[ -n "$ABUSE_KEY" ]]; then
  echo -e "  🛡  AbuseIPDB Auto Report      : ${GREEN}AKTIF${NC}"
else
  echo -e "  🛡  AbuseIPDB Auto Report      : ${YELLOW}TIDAK DIKONFIGURASI${NC}"
fi
echo -e "  🛡  IP Blacklist Update        : ${GREEN}AKTIF${NC} (jam 02:00, via cron)"
echo -e "  🤖  Telegram Bot Control       : ${GREEN}AKTIF${NC}"
echo -e "  🔔  Notifikasi Batch           : ${GREEN}AKTIF${NC} (tiap 60 detik)"
echo -e "  ⚡  CPU Limit Monitor          : ${GREEN}30%${NC}"
echo -e "  ⚡  Interval Monitoring        : ${GREEN}${MONITOR_INTERVAL_INPUT} detik${NC}"
echo ""
echo -e "${BOLD}  COMMAND TELEGRAM BOT:${NC}"
echo -e "  /status           — Status server"
echo -e "  /banned_list      — Daftar IP banned"
echo -e "  /unban IP         — Unban IP"
echo -e "  /whitelist_add IP — Whitelist IP lo"
echo -e "  /update_blacklist — Update blacklist sekarang"
echo -e "  /restart_server   — Restart service panel"
echo -e "  /pause_reassert   — Jeda auto-reassert"
echo -e "  /help             — Semua command"
echo ""
echo -e "${YELLOW}  LANGKAH SELANJUTNYA:${NC}"
echo -e "  1. Buka Telegram → ketik /whitelist_add IP_LO"
echo -e "  2. Ketik /status untuk verifikasi"
echo ""
echo -e "  📋 Log monitor : ${CYAN}/var/log/ikyy_monitor/monitor.log${NC}"
echo -e "${CYAN}  ================================================================${NC}"
echo ""