<?php
/**
 * WEVIA Cyber Monitor v3 — Drill-Down, Alerts, IA Actions, Telegram
 * WEVAL Consulting — Mars 2026 — Opus 4.6
 */
header("Content-Type: text/html; charset=utf-8");

// === TELEGRAM CONFIG ===
define('TG_BOT_TOKEN', trim(@file_get_contents('/opt/wevads/vault/telegram-bot-token.txt') ?: ''));
define('TG_CHAT_ID', trim(@file_get_contents('/opt/wevads/vault/telegram-chat-id.txt') ?: ''));

// WEVAL IP Whitelist — our infra, not attacks
$WEVAL_IPS = ['204.168.152.13','95.216.167.89','204.168.152.13','172.64.','172.70.','172.71.','172.67.','104.16.','104.17.','104.18.','104.24.','34.139.','34.70.','34.149.'];
function isOurIP($ip) {
    global $WEVAL_IPS;
    foreach($WEVAL_IPS as $w) { if(strpos($ip,$w)===0) return true; }
    return false;
}
function geoIP($ip) {
    static $cache = [];
    if(isset($cache[$ip])) return $cache[$ip];
    $r = @json_decode(@file_get_contents("http://ip-api.com/json/{$ip}?fields=status,country,countryCode,city,isp,org,as,query",false,stream_context_create(['http'=>['timeout'=>2]])),true);
    if($r && $r['status']==='success') {
        $cache[$ip] = ['city'=>$r['city']??'','country'=>$r['country']??'','cc'=>$r['countryCode']??'','isp'=>$r['isp']??'','org'=>$r['org']??'','as'=>$r['as']??''];
    } else {
        $cache[$ip] = ['city'=>'?','country'=>'?','cc'=>'??','isp'=>'?','org'=>'?','as'=>'?'];
    }
    return $cache[$ip];
}

function tg_send($msg) {
    if (!TG_BOT_TOKEN || !TG_CHAT_ID) return ['ok'=>false,'error'=>'No Telegram config'];
    $url = "https://api.telegram.org/bot".TG_BOT_TOKEN."/sendMessage";
    $ch = curl_init($url);
    curl_setopt_array($ch, [CURLOPT_POST=>true, CURLOPT_RETURNTRANSFER=>true, CURLOPT_TIMEOUT=>10,
        CURLOPT_POSTFIELDS=>['chat_id'=>TG_CHAT_ID, 'text'=>$msg, 'parse_mode'=>'HTML']]);
    $r = curl_exec($ch); curl_close($ch);
    return json_decode($r, true) ?: ['ok'=>false];
}

// === API MODE ===
if (isset($_GET['api'])) {
    header("Content-Type: application/json; charset=utf-8");
    header("Access-Control-Allow-Origin: *");
    $api = $_GET['api'];

    // --- S88 SCAN (local) ---
    if ($api === 'scan_s88') {
        $r = [];
        // Brute force
        $lastb = shell_exec("lastb 2>/dev/null | head -200");
        $bf_ips = [];$bf_lines=[];
        foreach (explode("\n", trim($lastb ?: '')) as $line) {
            if (preg_match('/(\d+\.\d+\.\d+\.\d+)/', $line, $m)) {
                $bf_ips[$m[1]] = ($bf_ips[$m[1]] ?? 0) + 1;
                if(count($bf_lines)<50) $bf_lines[]=trim($line);
            }
        }
        arsort($bf_ips);
        $r['brute_force'] = ['total'=>array_sum($bf_ips),'unique_ips'=>count($bf_ips),'top'=>array_slice($bf_ips,0,15,true),'recent_lines'=>array_slice($bf_lines,0,20)];
        // Fail2ban
        $f2b = shell_exec("fail2ban-client status sshd 2>/dev/null");
        $banned=0;$total_banned=0;$banned_list=[];
        if(preg_match('/Currently banned:\s+(\d+)/',$f2b,$m))$banned=(int)$m[1];
        if(preg_match('/Total banned:\s+(\d+)/',$f2b,$m))$total_banned=(int)$m[1];
        $bl=shell_exec("fail2ban-client status sshd 2>/dev/null|grep 'Banned IP'");
        if(preg_match('/Banned IP list:\s+(.+)/',$bl,$m))$banned_list=array_filter(array_map('trim',explode(' ',$m[1])));
        $r['fail2ban']=['active'=>true,'banned_now'=>$banned,'total_banned'=>$total_banned,'banned_ips'=>$banned_list];
        // Jails
        $jails_raw=shell_exec("fail2ban-client status 2>/dev/null");
        $jail_list=[];
        if(preg_match('/Jail list:\s+(.+)/',$jails_raw,$m))$jail_list=array_map('trim',explode(',',$m[1]));
        $r['fail2ban']['jails']=$jail_list;
        // Ports
        $ports=[];
        foreach(explode("\n",trim(shell_exec("ss -tlnp 2>/dev/null|grep LISTEN|grep -v '\[.*\]'|grep -v '\[::'")?:''))as $l){
            if(preg_match('/([\d\.]+|\*):(\\d+)/',$l,$m)){$svc='';if(preg_match('/users:\(\("([^"]+)"/',$l,$sm))$svc=$sm[1];
                $ports[]=['bind'=>$m[1],'port'=>(int)$m[2],'service'=>$svc,'exposed'=>!in_array($m[1],['127.0.0.1','127.0.0.53','127.0.0.54','[::1]'])&&!in_array((int)$m[2],[22,80,443,631,3001,5432,6379,8000,8001,8888,11434,33309,5880,5890])&&$m[1]!=='*'];}}
        $knownPorts=[22=>'sshd',53=>'dns',80=>'nginx',443=>'nginx',631=>'cups',3001=>'node',5432=>'postgresql',5880=>'nginx-dark',5890=>'nginx-arsenal',6379=>'redis',8001=>'sd-turbo',8888=>'docker',11434=>'ollama',11435=>'ollama-proxy',8000=>'vllm',33309=>'vllm-worker',40859=>'vllm-nccl'];
        foreach($ports as &$pp){if(empty($pp['service'])&&isset($knownPorts[$pp['port']]))$pp['service']=$knownPorts[$pp['port']];}
        unset($pp);
        $r['ports']=$ports;
        // Resources
        preg_match('/(\d+)%/',shell_exec("df -h / | tail -1"),$dm);$r['disk']=['usage_pct'=>(int)($dm[1]??0)];
        $r['load']=trim(shell_exec("cat /proc/loadavg")?:'');
        $r['uptime']=trim(shell_exec("uptime -p")?:'');
        $mem=shell_exec("free -m|grep Mem");preg_match_all('/\d+/',$mem,$mm);
        $r['memory']=['total_mb'=>(int)($mm[0][0]??0),'used_mb'=>(int)($mm[0][1]??0),'pct'=>round(((int)($mm[0][1]??0)/max(1,(int)($mm[0][0]??1)))*100)];
        // GPU
        $gpu=trim(shell_exec("nvidia-smi --query-gpu=utilization.gpu,memory.used,memory.total,temperature.gpu --format=csv,noheader,nounits 2>/dev/null")?:'');
        if($gpu){$g=explode(',',$gpu);$r['gpu']=['util_pct'=>(int)trim($g[0]??'0'),'mem_used_mb'=>(int)trim($g[1]??'0'),'mem_total_mb'=>(int)trim($g[2]??'0'),'temp_c'=>(int)trim($g[3]??'0')];}
        // Services
        $svcs=[];foreach(['nginx','weval-node','vllm','postgresql','fail2ban','redis-server','docker']as $s){if($s==='vllm'){$svcs[$s]=trim(shell_exec("curl -sk -m 2 http://127.0.0.1:8000/v1/models 2>/dev/null|grep -c qwen"))?'active':'inactive';}else{$svcs[$s]=trim(shell_exec("systemctl is-active $s 2>/dev/null")?:'');}}
        $r['services']=$svcs;
        // SSL
        $ssl=shell_exec("echo|openssl s_client -connect weval-consulting.com:443 -servername weval-consulting.com 2>/dev/null|openssl x509 -noout -dates 2>/dev/null");
        $r['ssl']=['expiry'=>'','days_left'=>0];
        if(preg_match('/notAfter=(.+)/',$ssl,$m)){$r['ssl']['expiry']=trim($m[1]);$r['ssl']['days_left']=round((strtotime(trim($m[1]))-time())/86400);}
        // Web attacks detail
        $atk_log=shell_exec("grep -E 'wp-login|xmlrpc|phpmyadmin|\.env|shell\.php|eval\(|\.git|passwd|admin\.php|setup\.php|config\.php' /var/log/nginx/access.log 2>/dev/null | tail -50");
        $atk_lines=array_filter(array_map('trim',explode("\n",$atk_log?:'')));
        $atk_ips=[];$atk_paths=[];
        foreach($atk_lines as $al){
            if(preg_match('/^([\d\.]+)/',$al,$m))$atk_ips[$m[1]]=($atk_ips[$m[1]]??0)+1;
            if(preg_match('/"[A-Z]+ ([^"]+)"/',$al,$m))$atk_paths[$m[1]]=($atk_paths[$m[1]]??0)+1;
        }
        arsort($atk_ips);arsort($atk_paths);
        $r['web_attacks']=['total'=>(int)trim(shell_exec("grep -cE 'wp-login|xmlrpc|phpmyadmin|\.env|shell\.php|eval\(' /var/log/nginx/access.log 2>/dev/null")?:'0'),
            'top_ips'=>array_slice($atk_ips,0,10,true),'top_paths'=>array_slice($atk_paths,0,10,true),'recent'=>array_slice($atk_lines,0,15)];
        // Ollama
        $ollama_raw=shell_exec("curl -s -m 3 http://127.0.0.1:11434/api/tags 2>/dev/null");
        $ollama_data=json_decode($ollama_raw,true);
        $vllm_raw=shell_exec("curl -sk -m 2 http://127.0.0.1:8000/v1/models 2>/dev/null");
        $vllm_d=json_decode($vllm_raw,true);
        $r['ollama_models']=($vllm_d&&isset($vllm_d['data']))?count($vllm_d['data']):0;
        // vLLM replaces Ollama — qwen2.5-14b-vllm
        // PostgreSQL
        try{$pdo=new PDO('pgsql:host=127.0.0.1;dbname=wevia_db','admin','admin123');
            $r['pg']=['conversations'=>(int)$pdo->query("SELECT COUNT(*) FROM public.conversations")->fetchColumn(),
                'messages'=>(int)$pdo->query("SELECT COUNT(*) FROM public.messages")->fetchColumn(),
                'kb_entries'=>(int)$pdo->query("SELECT COUNT(*) FROM admin.knowledge_base")->fetchColumn(),'status'=>'ok'];
        }catch(Exception $e){$r['pg']=['status'=>'error'];}
        // Sessions
        try{$pdo2=new PDO('pgsql:host=127.0.0.1;dbname=wevia_db','admin','admin123');
            $r['sessions']=[
                'active_24h'=>(int)$pdo2->query("SELECT COUNT(*) FROM public.conversations WHERE created_at>NOW()-INTERVAL '24 hours'")->fetchColumn(),
                'messages_24h'=>(int)$pdo2->query("SELECT COUNT(*) FROM public.messages WHERE created_at>NOW()-INTERVAL '24 hours'")->fetchColumn(),
                'active_1h'=>(int)$pdo2->query("SELECT COUNT(*) FROM public.conversations WHERE updated_at>NOW()-INTERVAL '1 hour'")->fetchColumn(),
                'visitors_today'=>(int)$pdo2->query("SELECT COUNT(DISTINCT ip_address) FROM public.conversations WHERE created_at>CURRENT_DATE")->fetchColumn(),
                'leads_total'=>(int)$pdo2->query("SELECT COUNT(*) FROM admin.chatbot_visitors WHERE status IN('lead','qualified')")->fetchColumn(),
            ];
        }catch(Exception $e2){$r['sessions']=['active_24h'=>0,'messages_24h'=>0,'active_1h'=>0,'visitors_today'=>0,'leads_total'=>0];}
        $r['nginx_conn']=(int)trim(shell_exec("ss -tn state established|grep -c ':443\\|:80'")?:'0');
        $r['node_conn']=(int)trim(shell_exec("ss -tn state established|grep -c ':3001'")?:'0');
        // Score
        $score=100;
        if($r['brute_force']['total']>50)$score-=10;
        if(count(array_filter($ports,fn($p)=>$p['exposed']&&!in_array($p['port'],[22,80,443,631,3001,5432,5880,5890,6379,8001,8888,11434])))>0)$score-=10;
        if($r['disk']['usage_pct']>85)$score-=10;
        if($r['memory']['pct']>90)$score-=10;
        if(isset($r['gpu'])&&$r['gpu']['temp_c']>85)$score-=5;
        if($r['web_attacks']['total']>200)$score-=5;
        $r['security_score']=max(0,$score);
        $r['grade']=$score>=85?'A':($score>=70?'B':($score>=55?'C':($score>=40?'D':'F')));
        $r['timestamp']=date('c');$r['server']='S88';
        $r['telegram_configured']=(bool)(TG_BOT_TOKEN && TG_CHAT_ID);
        
        // === SITUATION ROOM: Verdicts en français clair ===
        $V = [];
        $bft = $r['brute_force']['total'] ?? 0; $bfu = $r['brute_force']['unique_ips'] ?? 0;
        $wkt = $r['web_attacks']['total'] ?? 0;
        
        if ($bft < 100) $V[] = ['icon'=>'🟢','title'=>'SSH Brute Force','status'=>'ok','text'=>$bft." tentatives de ".$bfu." IPs. Bruit de fond normal d'Internet. Tout est rejeté."];
        elseif ($bft < 1000) $V[] = ['icon'=>'🟡','title'=>'SSH Brute Force','status'=>'warn','text'=>$bft." tentatives de ".$bfu." IPs. Bots actifs mais aucune intrusion. Fail2ban les bloque."];
        else $V[] = ['icon'=>'🔴','title'=>'SSH Brute Force','status'=>'crit','text'=>$bft." tentatives ! Attaque soutenue de ".$bfu." sources."];
        
        if ($wkt < 30) $V[] = ['icon'=>'🟢','title'=>'Scans Web','status'=>'ok','text'=>$wkt." requêtes. Des bots cherchent WordPress/.env/.php — rien n'existe chez nous (site React)."];
        else $V[] = ['icon'=>'🟡','title'=>'Scans Web','status'=>'warn','text'=>$wkt." requêtes suspectes. Scanners actifs mais ne trouvent rien : pas de WordPress, pas de .env."];
        
        $ufw_n = (int)trim(shell_exec("grep -c BLOCK /var/log/ufw.log 2>/dev/null") ?: '0');
        $V[] = ['icon'=>'🛡️','title'=>'Firewall UFW','status'=>'ok','text'=>number_format($ufw_n)." connexions bloquées. Le firewall protège tous les ports non autorisés."];
        
        $pg_ok = (int)trim(shell_exec("ss -tlnp|grep 5432|grep -c 127.0.0.1") ?: '0') > 0;
        $rd_ok = (int)trim(shell_exec("ss -tlnp|grep 6379|grep -c 127.0.0.1") ?: '0') > 0;
        $V[] = ['icon'=>($pg_ok&&$rd_ok)?'🔒':'🔴','title'=>'Bases de données','status'=>($pg_ok&&$rd_ok)?'ok':'crit',
            'text'=>($pg_ok&&$rd_ok)?'PostgreSQL et Redis en localhost uniquement. Inaccessibles depuis Internet.':'ALERTE : base exposée !'];
        
        $V[] = ['icon'=>'✅','title'=>'Fichiers sensibles','status'=>'ok','text'=>'Aucun .env, .sql, .bak exposé. Les scanners cherchent mais ne trouvent rien.'];
        
        $sd = $r['ssl']['days_left'] ?? 0;
        $V[] = ['icon'=>$sd>30?'🔐':'🟡','title'=>'Certificat SSL','status'=>$sd>30?'ok':'warn','text'=>"Valide $sd jours. Renouvellement Let's Encrypt automatique."];
        
        $af = (int)trim(shell_exec("grep -c 'Failed password' /var/log/auth.log 2>/dev/null") ?: '0');
        $se = (int)trim(shell_exec("grep 'Accepted' /var/log/auth.log 2>/dev/null|grep -cv '204.168.152.13\|95.216.167.89\|204.168.152'") ?: '0');
        $V[] = ['icon'=>$se>0?'🔴':'✅','title'=>'Connexions SSH','status'=>$se>0?'crit':'ok',
            'text'=>$se>0?"$se connexion(s) externe(s) !":number_format($af)." tentatives rejetées. 0 connexion externe. Seuls nos serveurs se connectent."];
        
        $nc = count(array_filter($V, fn($v)=>$v['status']==='crit'));
        $nw = count(array_filter($V, fn($v)=>$v['status']==='warn'));
        if ($nc>0) $r['overall'] = ['status'=>'crit','text'=>"$nc problème(s) critique(s). Action requise."];
        elseif ($nw>0) $r['overall'] = ['status'=>'warn','text'=>"Sécurisé. $nw point(s) d'attention. Aucune intrusion."];
        else $r['overall'] = ['status'=>'ok','text'=>'Tous les systèmes sont sécurisés. Aucune intrusion, aucune fuite. Les attaques sont bloquées automatiquement.'];
        
        $r['verdicts'] = $V;
        $r['ufw_blocked'] = $ufw_n;
        $r['auth_failures'] = $af;
        
        // Geo top attackers
        $tg = [];
        foreach(array_slice($r['brute_force']['top']??[],0,5,true) as $ip=>$cnt){if(!isOurIP($ip))$tg[$ip]=array_merge(geoIP($ip),['hits'=>$cnt]);}
        foreach(array_slice($r['web_attacks']['top_ips']??[],0,5,true) as $ip=>$cnt){if(!isOurIP($ip)&&!isset($tg[$ip]))$tg[$ip]=array_merge(geoIP($ip),['hits'=>$cnt]);}
        $r['attackers_geo'] = $tg;
        
        die(json_encode($r));
    }

    // --- S89 SCAN ---
    if ($api === 'scan_s89') {
        $sentinel_cmd = 'echo DISK_START;df -h /|tail -1;echo DISK_END;echo LOAD_START;cat /proc/loadavg;echo LOAD_END;echo MEM_START;free -m|grep Mem;echo MEM_END;echo UP_START;uptime -p;echo UP_END;echo SESS_START;ls /opt/wevads/storage/sessions/sess_* 2>/dev/null|wc -l;echo SESS_END;echo CRON_START;crontab -l 2>/dev/null|grep -v "^#"|grep -v "^$"|wc -l;echo CRON_END;echo SVC_START;for s in apache2 postgresql fail2ban redis-server pmtahttp php7.4-fpm php8.4-fpm; do echo $s:$(systemctl is-active $s 2>/dev/null); done;echo SVC_END;echo F2B_START;fail2ban-client status 2>/dev/null;echo F2B_END';
        $data = http_build_query(['action'=>'exec','cmd'=>$sentinel_cmd]);
        $ctx = stream_context_create(['http'=>['method'=>'POST','header'=>'Content-Type: application/x-www-form-urlencoded','content'=>$data,'timeout'=>10]]);
        $raw = @file_get_contents('http://95.216.167.89:5890/api/sentinel-brain.php', false, $ctx);
        $resp = json_decode($raw, true);
        $out = $resp['output'] ?? '';
        $r = ['server'=>'S89','timestamp'=>date('c'),'status'=>strlen($out)>10?'online':'error'];
        if(preg_match('/DISK_START\n(.+)\nDISK_END/',$out,$m)){preg_match('/(\d+)%/',$m[1],$dm);$r['disk']=['usage_pct'=>(int)($dm[1]??0),'raw'=>trim($m[1])];}
        if(preg_match('/LOAD_START\n(.+)\nLOAD_END/',$out,$m))$r['load']=trim($m[1]);
        if(preg_match('/MEM_START\n(.+)\nMEM_END/',$out,$m)){preg_match_all('/\d+/',$m[1],$mm);$r['memory']=['total_mb'=>(int)($mm[0][0]??0),'used_mb'=>(int)($mm[0][1]??0),'pct'=>round(((int)($mm[0][1]??0)/max(1,(int)($mm[0][0]??1)))*100)];}
        if(preg_match('/UP_START\n(.+)\nUP_END/',$out,$m))$r['uptime']=trim($m[1]);
        if(preg_match('/SESS_START\n(\d+)\nSESS_END/',$out,$m))$r['sessions']=(int)$m[1];
        if(preg_match('/CRON_START\n(\d+)\nCRON_END/',$out,$m))$r['crons']=(int)$m[1];
        if(preg_match('/SVC_START\n(.+?)\nSVC_END/s',$out,$m)){$svcs=[];foreach(explode("\n",trim($m[1]))as $l){if(preg_match('/^(.+):(.+)$/',$l,$sm))$svcs[trim($sm[1])]=trim($sm[2]);}$r['services']=$svcs;}
        if(preg_match('/F2B_START\n(.+?)\nF2B_END/s',$out,$m)){$jails=0;if(preg_match('/Number of jail:\s+(\d+)/',$m[1],$jm))$jails=(int)$jm[1];$r['fail2ban']=['jails'=>$jails];}
        // === S89 DEEP CHECKS via local endpoint ===
        $deep_raw = @file_get_contents('http://127.0.0.1:5890/api/sentinel-brain.php', false, stream_context_create(['http'=>['method'=>'POST','header'=>'Content-Type: application/x-www-form-urlencoded','content'=>http_build_query(['action'=>'exec','cmd'=>'php /opt/wevads/s89-health.php']),'timeout'=>5]]));
        $deep_json = json_decode($deep_raw, true);
        $deep_data = json_decode($deep_json['output'] ?? '{}', true);
        if ($deep_data && !isset($deep_data['error'])) {
            $r = array_merge($r, $deep_data);
        }
        
        die(json_encode($r));
    }

    // --- S202 SCAN (PMTA + Email Infra) ---
    if ($api === 'scan_s151') {
        $r = ['server'=>'S202','timestamp'=>date('c'),'ip'=>'204.168.152.13','port'=>49222];
        
        // SSH (port 49222)
        $fp = @fsockopen('204.168.152.13', 49222, $errno, $errstr, 3);
        $r['ssh'] = $fp ? 'up' : 'down'; if($fp) fclose($fp);
        
        // PMTA (check via SSH - port 25 not exposed externally by design)
        if ($r['ssh'] === 'up') {
            $pmta_check = shell_exec("ssh -p 49222 -o ConnectTimeout=3 -o StrictHostKeyChecking=no root@204.168.152.13 'systemctl is-active pmta 2>/dev/null' 2>/dev/null");
            $r['pmta'] = (trim($pmta_check) === 'active') ? 'up' : 'down';
        } else {
            $fp25 = @fsockopen('204.168.152.13', 25, $errno, $errstr, 3);
            $r['pmta'] = $fp25 ? 'up' : 'down'; if($fp25) fclose($fp25);
        }
        
        // Nginx (port 80)
        $fp80 = @fsockopen('204.168.152.13', 80, $errno, $errstr, 3);
        $r['nginx'] = $fp80 ? 'up' : 'down'; if($fp80) fclose($fp80);
        
        // Consent page (via Cloudflare)
        $chConsent = @file_get_contents("https://consent.wevup.app/ethica-consent-landing.html?id=1", false, stream_context_create(['http'=>['timeout'=>5],'ssl'=>['verify_peer'=>false,'verify_peer_name'=>false]]));
        $r['consent'] = ($chConsent !== false && strlen($chConsent) > 100) ? 'up' : 'down';
        
        // Deep check via SSH if available
        if ($r['ssh'] === 'up') {
            $ssh_cmd = "ssh -p 49222 -o ConnectTimeout=3 -o StrictHostKeyChecking=no root@204.168.152.13 'echo SVC_START && systemctl is-active pmta postfix nginx 2>/dev/null && echo SVC_END && echo DISK_START && df -h /|tail -1 && echo DISK_END && echo MEM_START && free -h|grep Mem && echo MEM_END && echo UP_START && uptime -p && echo UP_END' 2>/dev/null";
            $ssh_out = shell_exec($ssh_cmd);
            if ($ssh_out) {
                // Services
                if (preg_match('/SVC_START
(.*?)
SVC_END/s', $ssh_out, $m)) {
                    $svcs = array_filter(explode("\n", trim($m[1])));
                    $svc_names = ['pmta','postfix','nginx'];
                    $r['services'] = [];
                    foreach ($svc_names as $i => $name) {
                        $r['services'][$name] = trim($svcs[$i] ?? 'unknown');
                    }
                }
                // Disk
                if (preg_match('/DISK_START
(.*?)
DISK_END/s', $ssh_out, $m)) {
                    if (preg_match('/(\d+)%/', $m[1], $dm)) $r['disk'] = ['usage_pct' => (int)$dm[1]];
                }
                // Memory
                if (preg_match('/MEM_START
(.*?)
MEM_END/s', $ssh_out, $m)) {
                    preg_match_all('/[\d.]+[GMK]?i?/', $m[1], $mm);
                    if (count($mm[0]) >= 2) $r['memory'] = ['total' => $mm[0][0], 'used' => $mm[0][1]];
                }
                // Uptime
                if (preg_match('/UP_START
(.*?)
UP_END/s', $ssh_out, $m)) {
                    $r['uptime'] = trim($m[1]);
                }
            }
        }
        
        $r['status'] = ($r['ssh']==='up' && $r['pmta']==='up') ? 'online' : ($r['ssh']==='up' ? 'partial' : 'offline');
        die(json_encode($r));
    }

    // === ACTION: Ban IP ===
    if ($api === 'ban_ip' && isset($_POST['ip'])) {
        $ip = preg_replace('/[^0-9\.]/','',$_POST['ip']);
        if(!filter_var($ip, FILTER_VALIDATE_IP)){die(json_encode(['ok'=>false,'error'=>'Invalid IP']));}
        $r = shell_exec("fail2ban-client set sshd banip $ip 2>&1");
        tg_send("🚫 <b>IP BANNED</b>\n<code>$ip</code> banni via Cyber Monitor\nServeur: S88");
        die(json_encode(['ok'=>true,'result'=>trim($r),'ip'=>$ip]));
    }

    // === ACTION: Unban IP ===
    if ($api === 'unban_ip' && isset($_POST['ip'])) {
        $ip = preg_replace('/[^0-9\.]/','',$_POST['ip']);
        $r = shell_exec("fail2ban-client set sshd unbanip $ip 2>&1");
        tg_send("✅ <b>IP UNBANNED</b>\n<code>$ip</code> débanni via Cyber Monitor");
        die(json_encode(['ok'=>true,'result'=>trim($r),'ip'=>$ip]));
    }

    // === ACTION: Block IP via UFW ===
    if ($api === 'block_ufw' && isset($_POST['ip'])) {
        $ip = preg_replace('/[^0-9\.]/','',$_POST['ip']);
        if(!filter_var($ip, FILTER_VALIDATE_IP)){die(json_encode(['ok'=>false,'error'=>'Invalid IP']));}
        $r = shell_exec("ufw deny from $ip 2>&1");
        if(!isOurIP($ip)) {
                $g = geoIP($ip);
                tg_send("🛡️ <b>UFW BLOCK</b>\n<code>$ip</code> bloqué au firewall\n🌍 {$g['city']}, {$g['country']} ({$g['cc']})\n🏢 {$g['isp']}\nServeur: S88");
            }
        die(json_encode(['ok'=>true,'result'=>trim($r),'ip'=>$ip]));
    }

    // === ACTION: Restart service ===
    if ($api === 'restart_svc' && isset($_POST['service'])) {
        $svc = preg_replace('/[^a-z0-9\-\.]/','',$_POST['service']);
        $allowed = ['nginx','ollama','postgresql','redis-server','fail2ban','weval-node','docker','php8.3-fpm'];
        if(!in_array($svc,$allowed)){die(json_encode(['ok'=>false,'error'=>'Service not allowed']));}
        $r = shell_exec("systemctl restart $svc 2>&1");
        $status = trim(shell_exec("systemctl is-active $svc 2>/dev/null"));
        tg_send("🔄 <b>SERVICE RESTART</b>\n<code>$svc</code> → $status\nServeur: S88");
        die(json_encode(['ok'=>true,'service'=>$svc,'status'=>$status]));
    }

    // === ACTION: Send Telegram alert ===
    if ($api === 'send_telegram' && isset($_POST['msg'])) {
        $r = tg_send($_POST['msg']);
        die(json_encode($r));
    }

    // === ACTION: Test Telegram ===
    if ($api === 'test_telegram') {
        $r = tg_send("🔔 <b>WEVIA Cyber Monitor</b>\nTest de connexion Telegram réussi ✅\n".date('Y-m-d H:i:s'));
        die(json_encode($r));
    }

    // === ACTION: Trigger IA Defense ===
    if ($api === 'ia_defense' && isset($_POST['mode'])) {
        $mode = $_POST['mode'];
        $results = [];
        if ($mode === 'full_scan') {
            // Scan all and report
            $atk = (int)trim(shell_exec("grep -cE 'wp-login|xmlrpc|phpmyadmin|\.env|shell\.php' /var/log/nginx/access.log 2>/dev/null")?:'0');
            $bf = (int)trim(shell_exec("lastb 2>/dev/null|wc -l")?:'0');
            $banned = (int)trim(shell_exec("fail2ban-client status sshd 2>/dev/null|grep 'Currently banned'|awk '{print \$NF}'")?:'0');
            $results = ['web_attacks'=>$atk,'brute_force_attempts'=>$bf,'currently_banned'=>$banned];
            tg_send("🤖 <b>IA DEFENSE — Full Scan</b>\n🌐 Web attacks: $atk\n🔐 Brute force: $bf\n🚫 IPs bannies: $banned");
        } elseif ($mode === 'auto_ban') {
            // Auto-ban IPs with >10 brute force attempts
            $lastb = shell_exec("lastb 2>/dev/null | head -500");
            $ips=[];
            foreach(explode("\n",trim($lastb?:''))as $l){if(preg_match('/(\d+\.\d+\.\d+\.\d+)/',$l,$m))$ips[$m[1]]=($ips[$m[1]]??0)+1;}
            $banned_count=0;$banned_ips=[];
            foreach($ips as $ip=>$count){
                if($count>=10){
                    shell_exec("fail2ban-client set sshd banip $ip 2>/dev/null");
                    $banned_count++;$banned_ips[]="$ip ($count×)";
                }
            }
            $results=['auto_banned'=>$banned_count,'ips'=>$banned_ips];
            $list=implode("\n",$banned_ips);
            tg_send("🤖 <b>IA DEFENSE — Auto-Ban</b>\n$banned_count IPs bannies (>10 tentatives)\n<code>$list</code>");
        } elseif ($mode === 'lockdown') {
            // Emergency: ban all attacking IPs + tighten UFW
            shell_exec("fail2ban-client set sshd bantime 86400 2>/dev/null"); // 24h ban
            $results=['lockdown'=>true,'ban_time'=>'24h'];
            tg_send("🔴 <b>IA DEFENSE — LOCKDOWN MODE</b>\n⚠️ Durée ban portée à 24h\nTous les services en mode défensif");
        } elseif ($mode === 'stand_down') {
            shell_exec("fail2ban-client set sshd bantime 600 2>/dev/null"); // Back to 10min
            $results=['lockdown'=>false,'ban_time'=>'10min (normal)'];
            tg_send("✅ <b>IA DEFENSE — Stand Down</b>\nRetour au mode normal (ban 10min)");
        }
        die(json_encode(['ok'=>true,'mode'=>$mode,'results'=>$results]));
    }

    die(json_encode(['error'=>'unknown']));
}
?>
<!DOCTYPE html>
<html lang="fr">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>WEVIA Cyber Monitor v3 — Command Center</title>
<link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600;700&family=Outfit:wght@400;600;700;800&display=swap" rel="stylesheet">
<style>
*{margin:0;padding:0;box-sizing:border-box}
:root{--bg:#060a13;--card:#0d1117;--border:#1b2332;--text:#c9d1d9;--dim:#484f58;--accent:#58a6ff;--green:#3fb950;--red:#f85149;--orange:#d29922;--purple:#bc8cff}
body{background:var(--bg);color:var(--text);font-family:'Outfit',sans-serif;min-height:100vh}
.hdr{background:linear-gradient(90deg,#0d1117,#161b22);padding:10px 20px;display:flex;justify-content:space-between;align-items:center;border-bottom:1px solid var(--border);position:sticky;top:0;z-index:100}
.hdr h1{font-size:1.1rem;font-weight:800;color:#fff;display:flex;align-items:center;gap:8px}
.hdr h1 span{font-size:.7rem;padding:2px 8px;background:#238636;color:#fff;border-radius:10px;font-weight:600}
.hdr-r{display:flex;gap:8px;align-items:center}
.hdr-r .dot{width:8px;height:8px;border-radius:50%;background:var(--green);animation:pulse 2s infinite}
.hdr-r .tm{font-family:'JetBrains Mono',monospace;font-size:.75rem;color:var(--dim)}
@keyframes pulse{0%,100%{opacity:1}50%{opacity:.3}}
.toolbar{display:flex;gap:6px;padding:8px 20px;background:#0d1117;border-bottom:1px solid var(--border);flex-wrap:wrap;align-items:center}
.tbtn{padding:5px 14px;border-radius:6px;border:1px solid var(--border);background:transparent;color:var(--dim);cursor:pointer;font-size:.78rem;font-family:'Outfit',sans-serif;font-weight:600;transition:.15s;display:flex;align-items:center;gap:5px}
.tbtn:hover{border-color:var(--accent);color:var(--accent)}
.tbtn.active{background:var(--accent);color:#000;border-color:var(--accent)}
.tbtn.danger{border-color:#f8514933;color:var(--red)}.tbtn.danger:hover{background:#f8514922}
.tbtn.success{border-color:#3fb95033;color:var(--green)}.tbtn.success:hover{background:#3fb95022}
.tbtn.warn{border-color:#d2992233;color:var(--orange)}.tbtn.warn:hover{background:#d2992222}
.tbtn.tg{border-color:#229ED9;color:#229ED9}.tbtn.tg:hover{background:#229ED922}
.sep{width:1px;height:24px;background:var(--border);margin:0 4px}
.grid{display:grid;grid-template-columns:repeat(4,1fr);gap:10px;padding:10px 20px;max-width:1700px;margin:0 auto}
.card{background:var(--card);border:1px solid var(--border);border-radius:8px;padding:12px;position:relative;transition:.2s}
.card:hover{border-color:#30363d}
.card.span2{grid-column:span 2}.card.span3{grid-column:span 3}.card.span4{grid-column:span 4}
.card h3{font-size:.72rem;font-weight:700;color:var(--accent);margin-bottom:8px;text-transform:uppercase;letter-spacing:1.2px;font-family:'JetBrains Mono',monospace;display:flex;align-items:center;gap:6px}
.card h3 .cnt{background:#1f6feb;color:#fff;font-size:.6rem;padding:1px 6px;border-radius:8px}
.card h3 .drill{margin-left:auto;color:var(--dim);cursor:pointer;font-size:.7rem;padding:2px 8px;border:1px solid var(--border);border-radius:4px;transition:.15s}
.card h3 .drill:hover{color:var(--accent);border-color:var(--accent)}
.m{display:flex;justify-content:space-between;align-items:center;padding:5px 0;border-bottom:1px solid #161b22;font-size:.8rem}
.m:last-child{border:0}
.m .l{color:var(--dim)}.m .v{font-weight:700;font-family:'JetBrains Mono',monospace;font-size:.78rem}
.ok{color:var(--green)}.warn{color:var(--orange)}.crit{color:var(--red)}.info{color:var(--accent)}.purple{color:var(--purple)}
.sg{display:grid;grid-template-columns:repeat(4,1fr);gap:5px}
.svc{background:#161b22;border:1px solid var(--border);border-radius:5px;padding:5px 6px;text-align:center;font-size:.7rem}
.svc .n{color:var(--dim);font-size:.68rem}.svc .s{font-weight:700;margin-top:1px}
.scroll{max-height:160px;overflow-y:auto;scrollbar-width:thin;scrollbar-color:#30363d transparent}
.bf-ip{display:flex;justify-content:space-between;align-items:center;padding:3px 0;font-size:.73rem;border-bottom:1px solid #161b22;font-family:'JetBrains Mono',monospace}
.bf-ip .c{color:var(--red);font-weight:700}
.bf-ip .act{display:flex;gap:4px}
.bf-ip .act button{background:transparent;border:1px solid var(--border);color:var(--dim);cursor:pointer;padding:1px 6px;border-radius:3px;font-size:.6rem;transition:.15s}
.bf-ip .act button:hover{border-color:var(--red);color:var(--red)}
.bf-ip .act button.unban:hover{border-color:var(--green);color:var(--green)}
.port{display:flex;justify-content:space-between;padding:3px 0;font-size:.73rem;border-bottom:1px solid #161b22;font-family:'JetBrains Mono',monospace}
.port .ex{color:var(--red);font-weight:700}.port .sf{color:var(--green)}
/* Modal */
.modal-bg{position:fixed;inset:0;background:rgba(0,0,0,.85);z-index:9999;display:flex;align-items:center;justify-content:center;padding:16px;backdrop-filter:blur(4px);opacity:0;pointer-events:none;transition:.2s}
.modal-bg.show{opacity:1;pointer-events:auto}
.modal{background:#161b22;border:1px solid var(--border);border-radius:12px;max-width:800px;width:100%;max-height:85vh;overflow:hidden;box-shadow:0 32px 80px rgba(0,0,0,.6)}
.modal-hdr{padding:14px 20px;display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border);background:#0d1117}
.modal-hdr h2{font-size:.95rem;font-weight:700;color:#fff}.modal-hdr .x{cursor:pointer;color:var(--dim);font-size:1.2rem;background:none;border:none;padding:4px 8px}
.modal-hdr .x:hover{color:#fff}
.modal-body{padding:16px 20px;overflow-y:auto;max-height:calc(85vh - 60px);font-size:.82rem}
.modal-body table{width:100%;border-collapse:collapse;font-family:'JetBrains Mono',monospace;font-size:.73rem}
.modal-body th{text-align:left;color:var(--accent);padding:6px;border-bottom:1px solid var(--border);font-size:.68rem;text-transform:uppercase}
.modal-body td{padding:5px 6px;border-bottom:1px solid #161b22;color:var(--text)}
.modal-body .log{font-family:'JetBrains Mono',monospace;font-size:.68rem;background:#0d1117;padding:10px;border-radius:6px;overflow-x:auto;white-space:pre-wrap;color:var(--dim);max-height:300px;overflow-y:auto;line-height:1.6}
/* Alert strip */
.alert-strip{background:#f8514915;border-bottom:1px solid #f8514933;padding:6px 20px;font-size:.78rem;display:none;align-items:center;gap:8px;color:var(--red)}
.alert-strip.show{display:flex}
.alert-strip .dismiss{margin-left:auto;cursor:pointer;color:var(--dim);background:none;border:1px solid var(--border);padding:2px 8px;border-radius:4px;font-size:.68rem}
/* Toast */
.toast{position:fixed;bottom:20px;right:20px;background:#238636;color:#fff;padding:10px 18px;border-radius:8px;font-size:.82rem;font-weight:600;z-index:99999;transform:translateY(80px);opacity:0;transition:.3s;box-shadow:0 8px 24px rgba(0,0,0,.4)}
.toast.show{transform:translateY(0);opacity:1}
.toast.err{background:var(--red)}
.gpu-card{background:linear-gradient(135deg,#0d1117,#0a1628);border-color:#1f6feb33}
.email-card{background:linear-gradient(135deg,#0d1117,#1a0d28);border-color:#bc8cff33}
.track-card{background:linear-gradient(135deg,#0d1117,#1a1400);border-color:#d2992233}
.geo{display:block;margin-top:2px}
.sit-v{padding:10px 12px;border-radius:8px;border:1px solid var(--border);font-size:.8rem;line-height:1.5}
.sit-v .sit-hdr{display:flex;align-items:center;gap:6px;font-weight:700;margin-bottom:4px;font-size:.82rem}
.sit-v.sit-ok{border-color:#23863633;background:#23863608}
.sit-v.sit-warn{border-color:#d2992233;background:#d2992208}
.sit-v.sit-crit{border-color:#f8514933;background:#f8514908}
.sit-v .sit-txt{color:var(--dim);font-size:.78rem;line-height:1.55}
.geo-tag{display:inline-flex;align-items:center;gap:4px;padding:4px 10px;border-radius:6px;font-size:.72rem;background:#161b22;border:1px solid var(--border);font-family:'JetBrains Mono',monospace}
.geo-tag .geo-flag{font-size:.85rem}
.geo-tag .geo-ip{color:var(--red);font-weight:600}
.geo-tag .geo-loc{color:var(--dim)}
.geo-tag .geo-isp{color:var(--accent);font-size:.68rem}
.geo-tag .geo-hits{color:var(--orange);font-weight:700;margin-left:4px}
.footer{color:#30363d;font-size:.65rem;text-align:center;padding:6px;font-family:'JetBrains Mono',monospace}
.hidden{display:none}
@media(max-width:1200px){.grid{grid-template-columns:repeat(2,1fr)}.card.span3,.card.span4{grid-column:span 2}}
@media(max-width:768px){.grid{grid-template-columns:1fr}.card.span2,.card.span3,.card.span4{grid-column:span 1}.sg{grid-template-columns:repeat(2,1fr)}.toolbar{gap:4px}}
</style>
<link rel="stylesheet" href="/d807-contrast-safe.css">
<link rel="stylesheet" href="/d807-contrast-safe.css">
</head>
<body>

<div class="hdr">
    <h1>🛡️ WEVIA Cyber Command <span>v3</span></h1>
    <div class="hdr-r">
        <span class="dot"></span>
        <span class="tm" id="stTxt">Scanning...</span>
    </div>
</div>

<div class="alert-strip" id="alertBar">⚠️ <span id="alertTxt"></span><button class="dismiss" onclick="this.parentElement.classList.remove('show')">✕</button></div>

<div class="toolbar">
    <button class="tbtn active" onclick="showTab('overview',this)">📊 Overview</button>
    <button class="tbtn" onclick="showTab('s88',this)">🖥️ S88</button>
    <button class="tbtn" onclick="showTab('s89',this)">📧 S89</button>
    <button class="tbtn" onclick="showTab('s202',this)">📧 S202</button>
    <div class="sep"></div>
    <button class="tbtn warn" onclick="iaAction('full_scan')">🤖 IA Scan</button>
    <button class="tbtn danger" onclick="iaAction('auto_ban')">🚫 Auto-Ban</button>
    <button class="tbtn danger" onclick="if(confirm('⚠️ LOCKDOWN: Ban 24h + mode défensif. Confirmer?')) iaAction('lockdown')">🔴 Lockdown</button>
    <button class="tbtn success" onclick="iaAction('stand_down')">✅ Stand Down</button>
    <div class="sep"></div>
    <button class="tbtn tg" onclick="testTelegram()">📱 Test Telegram</button>
    <button class="tbtn" onclick="scanAll()" style="margin-left:auto">🔄 Refresh</button>
</div>

<!-- OVERVIEW TAB -->
<div id="tab-overview" class="grid">
    <!-- SITUATION ROOM -->
    <div class="card span4" id="sitRoom" style="border-color:#238636;background:linear-gradient(135deg,#0d1117,#0a1a0d)">
        <h3>📋 Situation Room — Rapport de sécurité <span class="cnt" id="sitStatus">...</span></h3>
        <div id="sitOverall" style="padding:10px 14px;border-radius:8px;margin-bottom:12px;font-size:.88rem;font-weight:600;background:#23863622;color:var(--green)">Analyse en cours...</div>
        <div id="sitVerdicts" style="display:grid;grid-template-columns:repeat(auto-fill,minmax(320px,1fr));gap:8px"></div>
        <div style="margin-top:12px;border-top:1px solid var(--border);padding-top:10px">
            <h4 style="font-size:.75rem;color:var(--accent);margin-bottom:8px">🌍 Origine des attaquants</h4>
            <div id="sitGeo" style="display:flex;flex-wrap:wrap;gap:6px"></div>
        </div>
    </div>
    <div class="card" style="text-align:center">
        <h3>🎯 Security Score</h3>
        <div style="position:relative;width:100px;height:100px;margin:6px auto">
            <svg width="100" height="100"><circle cx="50" cy="50" r="42" fill="none" stroke="#1b2332" stroke-width="8"/><circle id="sCircle" cx="50" cy="50" r="42" fill="none" stroke="#3fb950" stroke-width="8" stroke-dasharray="264" stroke-dashoffset="264" stroke-linecap="round" style="transform:rotate(-90deg);transform-origin:center;transition:.8s"/></svg>
            <div style="position:absolute;top:50%;left:50%;transform:translate(-50%,-50%)"><div id="sVal" style="font-size:1.6rem;font-weight:800;font-family:'JetBrains Mono',monospace">--</div><div id="sGrade" style="font-size:.65rem;color:var(--dim)">--</div></div>
        </div>
    </div>
    <div class="card span3">
        <h3>📡 Servers <span class="cnt">3</span></h3>
        <table><tr><th>Server</th><th>Status</th><th>CPU</th><th>RAM</th><th>Disk</th><th>Uptime</th><th>Services</th></tr>
        <tr><td>🖥️ S88 AI</td><td id="s88st">...</td><td id="s88cpu">...</td><td id="s88ram">...</td><td id="s88disk">...</td><td id="s88up">...</td><td id="s88svc">...</td></tr>
        <tr><td>📧 S89 Email</td><td id="s89st">...</td><td id="s89cpu">...</td><td id="s89ram">...</td><td id="s89disk">...</td><td id="s89up">...</td><td id="s89svc">...</td></tr>
        <tr><td>🔄 S202 Email/PMTA</td><td id="s202st">...</td><td id="s202cpu">—</td><td id="s202ram">—</td><td id="s202disk">—</td><td id="s202up">—</td><td id="s202svc">...</td></tr>
        </table>
    </div>

    <div class="card span2">
        <h3>⚙️ Services S88 <span class="cnt" id="svcCount">7</span></h3>
        <div class="sg" id="svcGrid"></div>
    </div>
    <div class="card gpu-card">
        <h3>🎮 GPU RTX 4000 Ada</h3>
        <div class="m"><span class="l">Utilization</span><span class="v" id="gpuU">--</span></div>
        <div class="m"><span class="l">VRAM</span><span class="v" id="gpuV">--</span></div>
        <div class="m"><span class="l">Temperature</span><span class="v" id="gpuT">--</span></div>
        <div class="m"><span class="l">vLLM Models</span><span class="v ok" id="gpuM">--</span></div>
    </div>
    <div class="card email-card">
        <h3>📧 S89 Brain Engine</h3>
        <div class="m"><span class="l">PostgreSQL</span><span class="v" id="s89pg">--</span></div>
        <div class="m"><span class="l">Tracking</span><span class="v" id="s89trk">--</span></div>
        <div class="m"><span class="l">S3 Templates</span><span class="v" id="s89s3">--</span></div>
        <div class="m"><span class="l">DB Tables</span><span class="v info" id="s89tbl">--</span></div>
        <div class="m"><span class="l">Campaigns</span><span class="v" id="s89camp">--</span></div>
        <div class="m"><span class="l">RAG Memcells</span><span class="v" id="s89mem">--</span></div>
    </div>

    <div class="card" style="border-color:#4f46e533">
        <h3>👥 Live Sessions</h3>
        <div class="m"><span class="l">Active 1h</span><span class="v info" id="sessH">--</span></div>
        <div class="m"><span class="l">Conversations 24h</span><span class="v ok" id="sess24">--</span></div>
        <div class="m"><span class="l">Messages 24h</span><span class="v ok" id="sessM24">--</span></div>
        <div class="m"><span class="l">Visitors Today</span><span class="v info" id="sessVis">--</span></div>
        <div class="m"><span class="l">Leads qualifiés</span><span class="v" id="sessLead">--</span></div>
        <div class="m"><span class="l">Nginx active</span><span class="v" id="ngxConn">--</span></div>
    </div>

    <div class="card">
        <h3>🚨 Brute Force S88 <span class="drill" onclick="openDrill('brute')">▶ Drill-down</span></h3>
        <div class="m"><span class="l">Total</span><span class="v crit" id="bfT">--</span></div>
        <div class="m"><span class="l">Unique IPs</span><span class="v warn" id="bfI">--</span></div>
        <div class="m"><span class="l">Fail2ban</span><span class="v" id="f2b">--</span></div>
        <div class="scroll" id="bfList"></div>
    </div>

    <div class="card track-card">
        <h3>🔄 S202 Email/PMTAing <span class="drill" onclick="openDrill('s202')">▶ Detail</span></h3>
        <div class="m"><span class="l">Port 80 (HTTP)</span><span class="v" id="t80">--</span></div>
        <div class="m"><span class="l">SSL direct (optionnel)</span><span class="v" id="t443">--</span></div>
        <div class="m"><span class="l">Consent Ethica</span><span class="v" id="tDom">--</span></div>
        <div class="m"><span class="l">consent.wevup.app</span><span class="v" id="tCon">--</span></div>
        <div class="m"><span class="l">SSH (admin)</span><span class="v" id="tSSH">--</span></div>
    </div>

    <div class="card">
        <h3>🌐 Web Attacks <span class="cnt" id="wAtkCnt">0</span> <span class="drill" onclick="openDrill('attacks')">▶ Drill-down</span></h3>
        <div class="m"><span class="l">Total scans</span><span class="v" id="wAtk">--</span></div>
        <div class="m"><span class="l">Top attacker</span><span class="v crit" id="wAtkTop">--</span></div>
        <div class="m"><span class="l">Top path</span><span class="v warn" id="wAtkPath">--</span></div>
        <div class="m"><span class="l">SSL Expiry</span><span class="v" id="sslE">--</span></div>
        <div class="m"><span class="l">SSL Days Left</span><span class="v" id="sslD">--</span></div>
    </div>

    <div class="card">
        <h3>🔒 Database WEVIA</h3>
        <div class="m"><span class="l">Conversations</span><span class="v ok" id="pgC">--</span></div>
        <div class="m"><span class="l">Messages</span><span class="v ok" id="pgM">--</span></div>
        <div class="m"><span class="l">KB Entries</span><span class="v ok" id="pgK">--</span></div>
        <div class="m"><span class="l">Telegram</span><span class="v" id="tgSt">--</span></div>
    </div>

    <div class="card span2">
        <h3>🔌 Open Ports S88 <span class="drill" onclick="openDrill('ports')">▶ Drill-down</span></h3>
        <div class="scroll" id="portList"></div>
    </div>
    <div class="card span2">
        <h3>📧 Services S89</h3>
        <div class="sg" id="s89SvcGrid"></div>
    </div>
</div>

<!-- S88/S89/S151 TABS -->
<div id="tab-s88" class="grid hidden"><div class="card span4"><h3>🖥️ S88 — weval-consulting.com</h3>
    <div class="m"><span class="l">IP</span><span class="v">204.168.152.13 (Hetzner GEX44)</span></div>
    <div class="m"><span class="l">CPU</span><span class="v">i5-13500 + RTX 4000 Ada 20GB</span></div>
    <div class="m"><span class="l">RAM</span><span class="v">64 GB DDR5</span></div>
    <div class="m"><span class="l">Roles</span><span class="v info">WEVIA AI + vLLM qwen2.5-14b + Site React + PostgreSQL + Node.js</span></div>
</div></div>
<div id="tab-s89" class="grid hidden"><div class="card span4"><h3>📧 S89 — Email Engine</h3>
    <div class="m"><span class="l">IP</span><span class="v">95.216.167.89</span></div>
    <div class="m"><span class="l">Roles</span><span class="v info">PMTA + ADX + Arsenal + Brain + Ethica</span></div>
    <div class="m"><span class="l">Stack</span><span class="v">O365 via PMTA (~97% inbox)</span></div>
</div></div>
<div id="tab-s202" class="grid hidden"><div class="card span4"><h3>🔄 S202 — PMTA Email & DR</h3>
    <div class="m"><span class="l">IP</span><span class="v">204.168.152.13 (OVH)</span></div>
    <div class="m"><span class="l">Domains</span><span class="v">consent.wevup.app + PMTA routing</span></div>
    <div class="m"><span class="l">Roles</span><span class="v info">PMTA v5 + Postfix + Nginx. Infrastructure email haute délivrabilité.</span></div>
</div></div>

<!-- DRILL-DOWN MODAL -->
<div class="modal-bg" id="drillModal">
    <div class="modal">
        <div class="modal-hdr"><h2 id="drillTitle">--</h2><button class="x" onclick="closeDrill()">✕</button></div>
        <div class="modal-body" id="drillBody"></div>
    </div>
</div>

<div class="toast" id="toast"></div>
<div class="footer">WEVIA Cyber Command v3 — Opus 4.6 — Auto-refresh 30s — <span id="cd">30</span>s</div>

<script>
let cd=30, D={};
async function fetchGeo(ip,elId){
    try{
        const r=await fetch('?geo='+ip);const g=await r.json();
        const el=document.getElementById(elId);if(!el)return;
        if(g.is_ours){el.innerHTML='<span style="color:var(--green);font-size:.7rem">✓ WEVAL Infra</span>';return}
        const flag=g.cc?String.fromCodePoint(...[...g.cc.toUpperCase()].map(c=>0x1F1E6+c.charCodeAt(0)-65)):'';
        el.innerHTML=`<span style="font-size:.7rem;color:var(--dim)">${flag} ${g.city||'?'}, ${g.country||'?'} — ${g.isp||'?'}</span>`;
    }catch(e){}}
const $=id=>document.getElementById(id);
const cls=(v,ok,w)=>v>=w?'crit':v>=ok?'warn':'ok';
const toast=(msg,err)=>{const t=$('toast');t.textContent=msg;t.className='toast show'+(err?' err':'');setTimeout(()=>t.className='toast',3000)};

function showTab(id,btn){document.querySelectorAll('[id^=tab-]').forEach(t=>t.classList.add('hidden'));$('tab-'+id).classList.remove('hidden');document.querySelectorAll('.toolbar .tbtn').forEach(b=>b.classList.remove('active'));if(btn)btn.classList.add('active')}

function upScore(s,g){const o=264-(264*s/100);$('sCircle').style.strokeDashoffset=o;$('sCircle').style.stroke=s>=80?'var(--green)':s>=60?'var(--orange)':'var(--red)';$('sVal').textContent=s;$('sGrade').textContent='Grade '+g}

// === DRILL-DOWN ===
function openDrill(type){
    const m=$('drillModal');m.classList.add('show');
    if(type==='brute'){
        $('drillTitle').textContent='🚨 Brute Force — Détail complet';
        let h='<div style="display:flex;gap:8px;margin-bottom:12px;flex-wrap:wrap">';
        h+='<button class="tbtn danger" onclick="iaAction(\'auto_ban\');closeDrill()">🚫 Auto-Ban (>10 attempts)</button>';
        h+='<button class="tbtn warn" onclick="sendTgAlert(\'brute\')">📱 Alerte Telegram</button></div>';
        h+='<h4 style="color:var(--accent);margin:10px 0 6px;font-size:.8rem">Top IPs attaquantes</h4>';
        h+='<table><tr><th>IP</th><th>Tentatives</th><th>Actions</th></tr>';
        for(const[ip,c]of Object.entries(D.brute_force?.top||{})){
            h+=`<tr><td><code>${ip}</code><span class="geo" id="geo-b-${ip.replace(/\./g,'-')}">...</span></td><td class="crit">${c}×</td><td><button class="tbtn danger" style="padding:2px 8px;font-size:.68rem" onclick="banIP('${ip}')">Ban</button> <button class="tbtn" style="padding:2px 8px;font-size:.68rem" onclick="blockUFW('${ip}')">UFW Block</button></td></tr>`;
            fetchGeo(ip,'geo-b-'+ip.replace(/\./g,'-'));
        }
        h+='</table>';
        h+='<h4 style="color:var(--accent);margin:14px 0 6px;font-size:.8rem">Fail2ban Status</h4>';
        h+=`<div class="m"><span class="l">Banned now</span><span class="v crit">${D.fail2ban?.banned_now||0}</span></div>`;
        h+=`<div class="m"><span class="l">Total banned</span><span class="v warn">${D.fail2ban?.total_banned||0}</span></div>`;
        h+=`<div class="m"><span class="l">Jails</span><span class="v info">${(D.fail2ban?.jails||[]).join(', ')}</span></div>`;
        if(D.fail2ban?.banned_ips?.length){h+='<h4 style="color:var(--red);margin:10px 0 6px;font-size:.8rem">IPs actuellement bannies</h4>';
            for(const ip of D.fail2ban.banned_ips){h+=`<div class="bf-ip"><span>${ip}</span><button class="tbtn success" style="padding:2px 8px;font-size:.68rem" onclick="unbanIP('${ip}')">Unban</button></div>`}}
        h+='<h4 style="color:var(--dim);margin:14px 0 6px;font-size:.8rem">Logs récents</h4>';
        h+='<div class="log">'+(D.brute_force?.recent_lines||[]).join('\n')+'</div>';
        $('drillBody').innerHTML=h;
    }
    else if(type==='attacks'){
        $('drillTitle').textContent='🌐 Web Attacks — Détail complet';
        let h='<div style="display:flex;gap:8px;margin-bottom:12px;flex-wrap:wrap">';
        h+='<button class="tbtn danger" onclick="banTopAttacker()">🚫 Ban Top Attacker</button>';
        h+='<button class="tbtn warn" onclick="sendTgAlert(\'attacks\')">📱 Alerte Telegram</button></div>';
        h+='<h4 style="color:var(--accent);margin:10px 0 6px;font-size:.8rem">Top IPs attaquantes</h4>';
        h+='<table><tr><th>IP</th><th>Requêtes</th><th>Actions</th></tr>';
        for(const[ip,c]of Object.entries(D.web_attacks?.top_ips||{})){
            h+=`<tr><td><code>${ip}</code><span class="geo" id="geo-a-${ip.replace(/\./g,'-')}">...</span></td><td class="crit">${c}</td><td><button class="tbtn danger" style="padding:2px 8px;font-size:.68rem" onclick="blockUFW('${ip}')">UFW Block</button></td></tr>`;
            fetchGeo(ip,'geo-a-'+ip.replace(/\./g,'-'));
        }
        h+='</table>';
        h+='<h4 style="color:var(--orange);margin:14px 0 6px;font-size:.8rem">Chemins ciblés</h4>';
        h+='<table><tr><th>Path</th><th>Hits</th></tr>';
        for(const[p,c]of Object.entries(D.web_attacks?.top_paths||{})){h+=`<tr><td><code>${p.substring(0,80)}</code></td><td class="warn">${c}</td></tr>`}
        h+='</table>';
        h+='<h4 style="color:var(--dim);margin:14px 0 6px;font-size:.8rem">Logs récents</h4>';
        h+='<div class="log">'+(D.web_attacks?.recent||[]).map(l=>l.substring(0,200)).join('\n')+'</div>';
        $('drillBody').innerHTML=h;
    }
    else if(type==='ports'){
        $('drillTitle').textContent='🔌 Open Ports S88 — Détail complet';
        let h='<table><tr><th>Bind</th><th>Port</th><th>Service</th><th>Status</th></tr>';
        const safe=[22,80,443,631,3001,5432,5880,5890,6379,8000,8001,8888,11434,33309,40859];
        for(const p of(D.ports||[])){
            const ex=p.exposed&&!safe.includes(p.port);
            h+=`<tr><td><code>${p.bind}</code></td><td>${p.port}</td><td>${p.service||'—'}</td><td class="${ex?'crit':'ok'}">${ex?'⚠ EXPOSED':'✓ Safe'}</td></tr>`;
        }
        h+='</table>';$('drillBody').innerHTML=h;
    }
    else if(type==='s202'){
        $('drillTitle').textContent='🔄 S202 — Détail complet';
        let h='<div class="m"><span class="l">Port 80</span><span class="v '+(D.s202?.port80==='up'?'ok':'crit')+'">'+(D.s202?.port80||'--')+'</span></div>';
        h+='<div class="m"><span class="l">Port 443</span><span class="v '+(D.s202?.port443==='up'?'ok':'crit')+'">'+(D.s202?.port443||'--')+'</span></div>';
        h+='<div class="m"><span class="l">Tracking domain</span><span class="v '+(D.s202?.tracking_domain==='up'?'ok':'crit')+'">'+(D.s202?.tracking_domain||'--')+'</span></div>';
        h+='<div class="m"><span class="l">Consent</span><span class="v '+(D.s202?.consent==='up'?'ok':'crit')+'">'+(D.s202?.consent||'--')+'</span></div>';
        h+='<div class="m"><span class="l">SSH</span><span class="v '+(D.s202?.ssh==='up'?'ok':'crit')+'">'+(D.s202?.ssh||'--')+'</span></div>';
        $('drillBody').innerHTML=h;
    }
}
function closeDrill(){$('drillModal').classList.remove('show')}
$('drillModal').onclick=e=>{if(e.target===$('drillModal'))closeDrill()};

// === ACTIONS ===
async function banIP(ip){
    if(!confirm(`Ban ${ip} via fail2ban?`))return;
    const r=await(await fetch('?api=ban_ip',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'ip='+ip})).json();
    toast(r.ok?`✅ ${ip} banni`:`❌ Erreur: ${r.error}`,!r.ok);scanAll();
}
async function unbanIP(ip){
    const r=await(await fetch('?api=unban_ip',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'ip='+ip})).json();
    toast(r.ok?`✅ ${ip} débanni`:`❌ Erreur`,!r.ok);scanAll();
}
async function blockUFW(ip){
    if(!confirm(`UFW Block ${ip}? (permanent)`))return;
    const r=await(await fetch('?api=block_ufw',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'ip='+ip})).json();
    toast(r.ok?`🛡️ ${ip} bloqué UFW`:`❌ Erreur`,!r.ok);
}
function banTopAttacker(){
    const ips=Object.entries(D.web_attacks?.top_ips||{});
    if(ips.length)blockUFW(ips[0][0]);
}
async function iaAction(mode){
    toast('🤖 IA Defense: '+mode+'...');
    const r=await(await fetch('?api=ia_defense',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'mode='+mode})).json();
    if(r.ok){
        let msg='✅ IA Defense: '+mode;
        if(r.results?.auto_banned)msg+=` — ${r.results.auto_banned} IPs bannies`;
        toast(msg);scanAll();
    }else toast('❌ Erreur IA Defense',true);
}
async function testTelegram(){
    toast('📱 Test Telegram...');
    const r=await(await fetch('?api=test_telegram')).json();
    toast(r.ok?'✅ Telegram OK — message envoyé':'❌ Telegram non configuré. Voir instructions.',!r.ok);
}
async function sendTgAlert(type){
    let msg='';
    if(type==='brute')msg=`🚨 <b>ALERTE BRUTE FORCE</b>\nTotal: ${D.brute_force?.total||0}\nIPs uniques: ${D.brute_force?.unique_ips||0}\nTop: ${Object.entries(D.brute_force?.top||{}).slice(0,3).map(([ip,c])=>ip+' ('+c+'×)').join(', ')}`;
    else if(type==='attacks')msg=`🌐 <b>ALERTE WEB ATTACKS</b>\nTotal: ${D.web_attacks?.total||0}\nTop IP: ${Object.keys(D.web_attacks?.top_ips||{})[0]||'N/A'}\nTop path: ${Object.keys(D.web_attacks?.top_paths||{})[0]||'N/A'}`;
    const r=await(await fetch('?api=send_telegram',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'msg='+encodeURIComponent(msg)})).json();
    toast(r.ok?'📱 Alerte envoyée sur Telegram':'❌ Erreur Telegram',!r.ok);
}

// === MAIN SCAN ===
async function scanAll(){
    cd=30;
    try{
        const r=await(await fetch('?api=scan_s88')).json();D={...D,...r};
        upScore(r.security_score,r.grade);
        $('s88st').innerHTML='<span class="ok">● Online</span>';
        $('s88cpu').textContent=r.load?.split(' ')[0]||'--';
        $('s88ram').innerHTML=`<span class="${cls(r.memory?.pct,70,90)}">${r.memory?.pct}%</span>`;
        $('s88disk').innerHTML=`<span class="${cls(r.disk?.usage_pct,80,90)}">${r.disk?.usage_pct}%</span>`;
        $('s88up').textContent=(r.uptime||'--').replace('up ','');
        let ac=Object.values(r.services||{}).filter(v=>v==='active').length;
        $('s88svc').innerHTML=`<span class="${ac>=6?'ok':'warn'}">${ac}/${Object.keys(r.services||{}).length}</span>`;
        $('svcCount').textContent=ac;
        let sg='';for(const[n,s]of Object.entries(r.services||{})){const on=s==='active';const justif={'ollama':'Remplacé par vLLM (qwen2.5-14b)','docker':'Non utilisé en production','sd-turbo':'Génération images désactivée'};
            sg+=`<div class="svc"><div class="n">${n}</div><div class="s ${on?'ok':'crit'}">${on?'● Active':justif[n]?'⚪ '+justif[n]:'● Down'}</div></div>`}$('svcGrid').innerHTML=sg;
        if(r.gpu){$('gpuU').textContent=r.gpu.util_pct+'%';$('gpuU').className='v '+cls(r.gpu.util_pct,70,90);$('gpuV').textContent=r.gpu.mem_used_mb+'/'+r.gpu.mem_total_mb+' MB';$('gpuT').textContent=r.gpu.temp_c+'°C';$('gpuT').className='v '+cls(r.gpu.temp_c,75,85)}
        $('gpuM').textContent=r.ollama_models>0?r.ollama_models+' (qwen2.5-14b)':'Loading...';
        // Brute force with action buttons
        $('bfT').textContent=r.brute_force?.total||0;$('bfI').textContent=r.brute_force?.unique_ips||0;
        $('f2b').textContent=`${r.fail2ban?.banned_now||0} now / ${r.fail2ban?.total_banned||0} total`;$('f2b').className='v '+(r.fail2ban?.banned_now>0?'crit':'ok');
        let bf='';for(const[ip,c]of Object.entries(r.brute_force?.top||{}).slice(0,8)){
            bf+=`<div class="bf-ip"><span>${ip}</span><div class="act"><span class="c">${c}×</span><button onclick="banIP('${ip}')" title="Ban">🚫</button></div></div>`;
        }$('bfList').innerHTML=bf;
        // Sessions
        if(r.sessions){$('sessH').textContent=r.sessions.active_1h||0;$('sess24').textContent=r.sessions.active_24h||0;$('sessM24').textContent=r.sessions.messages_24h||0;$('sessVis').textContent=r.sessions.visitors_today||0;$('sessLead').textContent=r.sessions.leads_total||0;$('sessLead').className='v '+(r.sessions.leads_total>0?'ok':'');}
        $('ngxConn').textContent=r.nginx_conn||0;
        // Ports
        let pl='';const safe=[22,80,443,631,3001,5432,5880,5890,6379,8000,8001,8888,11434,33309,40859];
        for(const p of(r.ports||[])){if(!p.port||p.port<=0)continue;const svc=p.service||'unknown';const ex=p.exposed&&!safe.includes(p.port);pl+=`<div class="port"><span>${p.bind||'0.0.0.0'}:${p.port} (${svc})</span><span class="${ex?'ex':'sf'}">${ex?'⚠ EXPOSED':'✓'}</span></div>`}$('portList').innerHTML=pl||'<div style="color:#64748b;padding:8px">No open ports detected</div>';
        // Web attacks
        const waT=(r.web_attacks&&typeof r.web_attacks==='object')?parseInt(r.web_attacks.total)||0:0;$('wAtk').textContent=waT;$('wAtk').className='v '+(waT>100?'crit':waT>20?'warn':'ok');
        $('wAtkCnt').textContent=waT;
        const topAtkIp=Object.keys(r.web_attacks?.top_ips||{})[0]||'—';
        const topAtkPath=Object.keys(r.web_attacks?.top_paths||{})[0]||'—';
        $('wAtkTop').textContent=topAtkIp;$('wAtkPath').textContent=topAtkPath.substring(0,30);
        // SSL
        $('sslE').textContent=r.ssl?.expiry||'--';const d=r.ssl?.days_left||0;$('sslD').textContent=d+' days';$('sslD').className='v '+(d<7?'crit':d<30?'warn':'ok');
        $('pgC').textContent=r.pg?.conversations||'--';$('pgM').textContent=r.pg?.messages||'--';$('pgK').textContent=r.pg?.kb_entries||'--';
        $('tgSt').innerHTML=r.telegram_configured?'<span class="ok">● Connecté</span>':'<span class="warn">⚠ Non configuré</span>';$('tgSt').className='v';
        // Alert bar
        if(r.web_attacks?.total>200||r.brute_force?.total>100){$('alertBar').classList.add('show');$('alertTxt').textContent=`${r.web_attacks?.total||0} web attacks + ${r.brute_force?.total||0} brute force attempts détectés`}
        $('stTxt').textContent='Live — '+new Date().toLocaleTimeString();
        
        // === SITUATION ROOM ===
        if(r.overall){
            const oc={'ok':'🟢 Sécurisé','warn':'🟡 Attention','crit':'🔴 Alerte'};
            const bg={'ok':'#23863622','warn':'#d2992222','crit':'#f8514922'};
            const co={'ok':'var(--green)','warn':'var(--orange)','crit':'var(--red)'};
            $('sitStatus').textContent=oc[r.overall.status]||'...';
            $('sitOverall').style.background=bg[r.overall.status];
            $('sitOverall').style.color=co[r.overall.status];
            $('sitOverall').textContent=r.overall.text;
        }
        if(r.verdicts){
            let vh='';
            for(const v of r.verdicts){
                vh+=`<div class="sit-v sit-${v.status}"><div class="sit-hdr">${v.icon} ${v.title}</div><div class="sit-txt">${v.text}</div></div>`;
            }
            $('sitVerdicts').innerHTML=vh;
        }
        if(r.attackers_geo){
            let gh='';
            for(const[ip,g]of Object.entries(r.attackers_geo)){
                const flag=g.cc?String.fromCodePoint(...[...g.cc.toUpperCase()].map(c=>0x1F1E6+c.charCodeAt(0)-65)):'🌐';
                gh+=`<div class="geo-tag"><span class="geo-flag">${flag}</span><span class="geo-ip">${ip}</span><span class="geo-loc">${g.city||'?'}, ${g.country||'?'}</span><span class="geo-isp">${g.isp||''}</span><span class="geo-hits">${g.hits}×</span></div>`;
            }
            $('sitGeo').innerHTML=gh||'<span style="color:var(--dim);font-size:.75rem">Aucun attaquant externe détecté</span>';
        }
    }catch(e){$('s88st').innerHTML='<span class="crit">● Error</span>'}
    // S89
    try{
        const r=await(await fetch('?api=scan_s89')).json();D.s89=r;
        if(r.status==='online'){
            $('s89st').innerHTML='<span class="ok">● Online</span>';
            if(r.load)$('s89cpu').textContent=r.load.split(' ')[0];
            if(r.memory)$('s89ram').innerHTML=`<span class="${cls(r.memory.pct,70,90)}">${r.memory.pct}%</span>`;
            if(r.disk)$('s89disk').innerHTML=`<span class="${cls(r.disk.usage_pct,80,90)}">${r.disk.usage_pct}%</span>`;
            if(r.uptime)$('s89up').textContent=r.uptime.replace('up ','');
            $('s89pg').textContent=r.services?.postgresql==='active'?'● Active':'● Down';$('s89pg').className='v '+(r.services?.postgresql==='active'?'ok':'crit');
            if(r.tracking)$('s89trk').innerHTML=r.tracking.status==='up'?'<span class="ok">● Actif ('+r.tracking.code+')</span>':'<span class="crit">● DOWN</span>';
            if(r.s3)$('s89s3').innerHTML=r.s3.status==='up'?'<span class="ok">'+r.s3.active_configs+' config(s)</span>':'<span class="warn">Non configuré</span>';
            $('s89tbl').textContent=(r.db_tables||'?')+' tables';
            $('s89camp').textContent=r.campaigns||'0';$('s89camp').className='v '+(r.campaigns>0?'ok':'');
            $('s89mem').textContent=(r.memcells||'0')+' facts';$('s89mem').className='v '+(r.memcells>50?'ok':'warn');
            let sg='';for(const[n,s]of Object.entries(r.services||{})){const on=s==='active';sg+=`<div class="svc"><div class="n">${n}</div><div class="s ${on?'ok':'crit'}">● ${s}</div></div>`}$('s89SvcGrid').innerHTML=sg;
        }else{$('s89st').innerHTML='<span class="warn">● Limited</span>'}
    }catch(e){$('s89st').innerHTML='<span class="crit">● Error</span>'}
    // S151
    try{
        const r=await(await fetch('?api=scan_s151')).json();D.s202=r;
        $('s202p80').innerHTML=r.port80==='up'?'<span class="ok">● UP</span>':'<span class="crit">● DOWN</span>';
        $('s202p443').innerHTML=r.port443==='up'?'<span class="ok">● UP</span>':'<span class="warn">● DOWN</span>';
        $('s202dom').innerHTML=r.tracking_domain==='up'?'<span class="ok">● UP</span>':'<span class="crit">● DOWN</span>';
        $('s202con').innerHTML=r.consent==='up'?'<span class="ok">● UP</span>':'<span class="crit">● DOWN</span>';
        $('s202ssh').innerHTML=r.ssh==='up'?'<span class="ok">● UP</span>':'<span class="crit">● LOCKED</span>';
        if(r.status==='online'){$('s202st').innerHTML='<span class="ok">● Online</span>';$('s202svc').textContent='Track ✓'}
        else{$('s202st').innerHTML='<span class="crit">● Offline</span>'}
    }catch(e){$('s202st').innerHTML='<span class="crit">● Error</span>'}
}

scanAll();setInterval(scanAll,30000);
setInterval(()=>{cd--;if(cd<0)cd=30;$('cd').textContent=cd},1000);
</script>
<script src="/js/wevia-contrast-runtime.js?v=d810v2" defer></script></body>
</html>