docker-maintenance.sh

#!/bin/bash
# ============================================================
# Docker Maintenance & Troubleshooting Script with Firewall
# Author: Mr. Taiwo Micheal
# Version: 3.0
#
# This script provides a menu-driven interface for managing
# Docker containers, images, networks, system resources, and
# firewall rules for the security lab environment.
#
# Features:
#   - Start/stop/restart containers
#   - View running or all containers
#   - Inspect logs and exec into containers
#   - Cleanup unused Docker resources
#   - Aggressive cleanup (dangerous: removes ALL resources)
#   - Service, ports, and firewall troubleshooting
#   - Firewall management (enable/disable/configure rules)
#
# Usage:
#   chmod +x docker-maintenance.sh
#   ./docker-maintenance.sh
# ============================================================

# Configuration
COMPOSE_DIR="$HOME/docker/security-lab"  # Update to your actual path

# Define lab ports (update based on your docker-compose.yml)
declare -A LAB_PORTS=(
    [3000]="Juice Shop"
    [3001]="DVRA (REST API)"
    [5000]="VulnBank"
    [5013]="DVGA (GraphQL)"
    [8080]="WebGoat"
    [8082]="DVWA"
    [8083]="Mutillidae II"
    [8084]="WrongSecrets"
    [8085]="Pixi"
    [8087]="SSRF App"
    [9000]="Portainer HTTP"
    [9090]="WebWolf"
    [9443]="Portainer HTTPS"
)

# Database ports (optional - only allow from localhost)
declare -A DB_PORTS=(
    [3307]="DVWA MySQL"
    [3308]="Mutillidae MySQL"
    [5432]="VulnBank PostgreSQL"
)

# --- Startup Banner ---
clear
echo "=========================================="
echo "     🚀 Docker Lab Maintenance Console"
echo "     👤 Maintainer: Mr. Taiwo Micheal"
echo "     🔒 Version: 3.0 (with Firewall)"
echo "=========================================="
sleep 3
echo
echo "⚠️  Maintenance console ready..."
sleep 2

# --- Firewall Functions ---

setup_firewall_rules() {
    echo "🔥 Setting up firewall rules for Security Lab..."
    echo ""
    
    # Check if UFW is installed
    if ! command -v ufw &> /dev/null; then
        echo "❌ UFW not installed. Install with: sudo apt install ufw"
        return 1
    fi
    
    read -p "⚠️  This will modify firewall rules. Continue? (yes/no): " confirm
    if [ "$confirm" != "yes" ]; then
        echo "❌ Cancelled."
        return 1
    fi
    
    echo ""
    echo "📋 Configuration options:"
    echo "1) Lab access from LAN only (recommended for local lab)"
    echo "2) Lab access from anywhere (⚠️  dangerous for production)"
    echo "3) Lab access from specific IP/subnet"
    read -p "Choose access mode: " access_mode
    
    # Enable UFW if not already enabled
    echo "🔓 Enabling UFW..."
    sudo ufw --force enable
    
    # Always allow SSH (critical!)
    echo "✅ Allowing SSH (port 22)..."
    sudo ufw allow 22/tcp
    
    # Set default policies
    echo "🛡️  Setting default policies..."
    sudo ufw default deny incoming
    sudo ufw default allow outgoing
    
    # Allow lab ports based on access mode
    case $access_mode in
        1)
            # LAN only - Allow from private network ranges
            echo "🏠 Configuring LAN-only access..."
            for port in "${!LAB_PORTS[@]}"; do
                echo "  ✅ Allowing ${LAB_PORTS[$port]} (port $port) from LAN"
                sudo ufw allow from 192.168.0.0/16 to any port "$port" proto tcp
                sudo ufw allow from 172.16.0.0/12 to any port "$port" proto tcp
                sudo ufw allow from 10.0.0.0/8 to any port "$port" proto tcp
            done
            ;;
        2)
            # From anywhere (less secure)
            echo "🌍 Configuring access from anywhere..."
            for port in "${!LAB_PORTS[@]}"; do
                echo "  ✅ Allowing ${LAB_PORTS[$port]} (port $port) from anywhere"
                sudo ufw allow "$port"/tcp
            done
            ;;
        3)
            # Specific IP/subnet
            read -p "Enter IP or subnet (e.g., 192.168.1.0/24 or 10.0.0.5): " custom_source
            echo "🎯 Configuring access from $custom_source..."
            for port in "${!LAB_PORTS[@]}"; do
                echo "  ✅ Allowing ${LAB_PORTS[$port]} (port $port) from $custom_source"
                sudo ufw allow from "$custom_source" to any port "$port" proto tcp
            done
            ;;
        *)
            echo "❌ Invalid choice. Aborting."
            return 1
            ;;
    esac
    
    # Database ports - localhost only (security best practice)
    echo ""
    echo "🔒 Securing database ports (localhost only)..."
    for port in "${!DB_PORTS[@]}"; do
        echo "  ✅ ${DB_PORTS[$port]} (port $port) - localhost only"
        sudo ufw deny "$port"/tcp
    done
    
    # Reload and show status
    echo ""
    echo "🔄 Reloading firewall..."
    sudo ufw reload
    
    echo ""
    echo "✅ Firewall configuration complete!"
    echo ""
    sudo ufw status numbered
}

remove_firewall_rules() {
    echo "🔥 Removing Security Lab firewall rules..."
    echo ""
    
    read -p "⚠️  This will remove lab port rules. Continue? (yes/no): " confirm
    if [ "$confirm" != "yes" ]; then
        echo "❌ Cancelled."
        return 1
    fi
    
    # Remove rules for each lab port
    for port in "${!LAB_PORTS[@]}"; do
        echo "  🗑️  Removing rules for ${LAB_PORTS[$port]} (port $port)"
        sudo ufw delete allow "$port"/tcp 2>/dev/null
        # Also try to remove LAN-specific rules
        sudo ufw delete allow from 192.168.0.0/16 to any port "$port" proto tcp 2>/dev/null
        sudo ufw delete allow from 172.16.0.0/12 to any port "$port" proto tcp 2>/dev/null
        sudo ufw delete allow from 10.0.0.0/8 to any port "$port" proto tcp 2>/dev/null
    done
    
    echo ""
    echo "✅ Lab firewall rules removed!"
    sudo ufw status numbered
}

disable_firewall() {
    echo "🔓 Disabling firewall..."
    read -p "⚠️  This will disable UFW completely. Continue? (yes/no): " confirm
    if [ "$confirm" = "yes" ]; then
        sudo ufw disable
        echo "✅ Firewall disabled!"
    else
        echo "❌ Cancelled."
    fi
}

show_firewall_status() {
    echo "🔥 Firewall Status:"
    echo ""
    sudo ufw status verbose
    echo ""
    echo "📋 Expected Lab Ports:"
    for port in "${!LAB_PORTS[@]}"; do
        printf "  Port %5s - %s\n" "$port" "${LAB_PORTS[$port]}"
    done | sort -n
}

# --- Main Menu Loop ---
while true; do
    clear
    echo "===== DOCKER MAINTENANCE MENU ====="
    echo "--- Container Management ---"
    echo "1)  Start containers (docker compose up -d)"
    echo "2)  Stop containers (docker compose down)"
    echo "3)  Restart all running containers"
    echo "4)  Show running containers"
    echo "5)  Show ALL containers (including stopped)"
    echo "6)  Show logs of a container"
    echo "7)  Exec into a container shell"
    echo ""
    echo "--- System Management ---"
    echo "8)  Docker disk usage report"
    echo "9)  Cleanup (unused images/volumes/networks)"
    echo "10) Aggressive cleanup (⚠️  removes EVERYTHING!)"
    echo "11) Check Docker service status"
    echo "12) Check listening ports (all lab apps)"
    echo "13) View container resource usage"
    echo ""
    echo "--- Firewall Management ---"
    echo "14) Setup firewall rules for lab"
    echo "15) Remove lab firewall rules"
    echo "16) Show firewall status"
    echo "17) Disable firewall (⚠️  not recommended)"
    echo ""
    echo "18) Exit"
    echo "====================================="
    read -p "Choose an option: " choice

    case $choice in
        1) 
            echo "📂 Navigating to: $COMPOSE_DIR"
            cd "$COMPOSE_DIR" || { echo "❌ Directory not found!"; sleep 2; continue; }
            sudo docker compose up -d
            ;;
        2) 
            echo "📂 Navigating to: $COMPOSE_DIR"
            cd "$COMPOSE_DIR" || { echo "❌ Directory not found!"; sleep 2; continue; }
            sudo docker compose down
            ;;
        3) 
            echo "🔄 Restarting all running containers..."
            sudo docker restart $(sudo docker ps -q) 
            ;;
        4) 
            echo "📋 Running containers:"
            sudo docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
            ;;
        5) 
            echo "📋 All containers:"
            sudo docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
            ;;
        6) 
            read -p "Enter container name: " cname
            sudo docker logs -f "$cname" 
            ;;
        7) 
            read -p "Enter container name: " cname
            echo "🐚 Trying /bin/bash first..."
            sudo docker exec -it "$cname" /bin/bash 2>/dev/null || \
            { echo "⚠️  /bin/bash not found, trying /bin/sh..."; sudo docker exec -it "$cname" /bin/sh; }
            ;;
        8) 
            echo "💾 Docker disk usage:"
            sudo docker system df -v
            ;;
        9) 
            echo "🧹 Starting cleanup of unused resources..."
            sudo docker system prune -f
            sudo docker volume prune -f
            sudo docker network prune -f
            echo "✅ Cleanup complete!"
            ;;
        10) 
            read -p "⚠️  This will DELETE EVERYTHING! Type 'DELETE' to confirm: " confirm
            if [ "$confirm" = "DELETE" ]; then
                echo "💣 Nuclear cleanup initiated..."
                cd "$COMPOSE_DIR" && sudo docker compose down -v
                sudo docker stop $(sudo docker ps -aq) 2>/dev/null
                sudo docker rm -f $(sudo docker ps -aq) 2>/dev/null
                sudo docker rmi -f $(sudo docker images -aq) 2>/dev/null
                sudo docker volume rm $(sudo docker volume ls -q) 2>/dev/null
                sudo docker network prune -f
                sudo docker system prune -a --volumes -f
                echo "✅ Complete wipe finished!"
            else
                echo "❌ Cancelled (must type 'DELETE' exactly)."
            fi
            ;;
        11) 
            echo "🐳 Docker service status:"
            sudo systemctl status docker
            ;;
        12) 
            echo "🔌 Checking listening ports for lab applications..."
            echo "Expected ports: ${!LAB_PORTS[@]}"
            echo ""
            sudo ss -tlnp | grep -E '3000|3001|5000|5013|8080|8082|8083|8084|8085|8087|9000|9090|9443' || echo "⚠️  No matching ports found"
            ;;
        13) 
            echo "📊 Container resource usage:"
            sudo docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}"
            ;;
        14) 
            setup_firewall_rules
            ;;
        15) 
            remove_firewall_rules
            ;;
        16) 
            show_firewall_status
            ;;
        17) 
            disable_firewall
            ;;
        18) 
            echo "👋 Goodbye Mr. Taiwo Micheal!"
            exit 0 
            ;;
        *) 
            echo "❌ Invalid choice!"
            sleep 2 
            ;;
    esac

    echo
    read -p "Press Enter to continue..." dummy
done