# 1. Run security audit
nself audit security

# 2. Review findings
# Check for: weak secrets, exposed ports, CORS wildcards, root containers

# 3. Apply automated fixes (if issues found)
nself harden

# 4. Rebuild and restart
nself build && nself restart

# Full security audit
nself audit security

# Check specific components
nself audit security secrets      # Check secret strength
nself audit security cors         # Check CORS configuration
nself audit security ports        # Check exposed ports
nself audit security containers   # Check container users

# Automated hardening
nself harden                      # Interactive wizard
nself harden all                  # Apply all fixes automatically
nself harden secrets              # Rotate weak secrets only
nself harden cors                 # Fix CORS only

ENV=dev
BASE_DOMAIN=local.nself.org

# CORS - allows localhost and local domains
HASURA_GRAPHQL_CORS_DOMAIN=http://localhost:*,http://*.local.nself.org,https://*.local.nself.org

# Port exposure - database accessible from host
POSTGRES_EXPOSE_PORT=auto  # Exposes on 127.0.0.1:5432

# Console access - enabled for debugging
HASURA_GRAPHQL_ENABLE_CONSOLE=true

# SSL - self-signed (automatic)
SSL_MODE=local

ENV=staging
BASE_DOMAIN=staging.myapp.com

# CORS - staging domain + localhost for testing
HASURA_GRAPHQL_CORS_DOMAIN=https://*.staging.myapp.com,http://localhost:3000

# Port exposure - internal only
POSTGRES_EXPOSE_PORT=false

# Console access - enabled but requires admin secret
HASURA_GRAPHQL_ENABLE_CONSOLE=true

# SSL - Let's Encrypt
SSL_MODE=letsencrypt

ENV=production
BASE_DOMAIN=myapp.com

# CORS - production domain only
HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com

# Port exposure - all internal
POSTGRES_EXPOSE_PORT=false

# Console access - disabled
HASURA_GRAPHQL_ENABLE_CONSOLE=false

# SSL - required
SSL_MODE=letsencrypt

# Email - real provider (not Mailpit)
EMAIL_PROVIDER=sendgrid
SENDGRID_API_KEY=SG.xxxxx

# Monitoring - enabled
MONITORING_ENABLED=true

# Development - allows multiple origins for testing
dev:     http://localhost:*,http://*.local.nself.org,https://*.local.nself.org

# Staging - staging domain + localhost for testing
staging: https://*.staging.myapp.com,http://localhost:3000

# Production - strict domain restriction
prod:    https://*.myapp.com

# Manual override (not recommended)
HASURA_GRAPHQL_CORS_DOMAIN=https://app.myapp.com,https://admin.myapp.com

# PostgreSQL (32 chars alphanumeric)
POSTGRES_PASSWORD=a8F3xK9mP2qR7nL4vY6wZ1eC5tB8jH0i

# Hasura Admin Secret (64 chars hex)
HASURA_GRAPHQL_ADMIN_SECRET=8f3c2a1b6e5d4f7a9c0b3e1d5f8a2c4b7e9d1f3a5c7b9e1d3f5a7c9b1e3d5f7a

# JWT Key (64 chars hex)
HASURA_JWT_KEY=3f5a7c9b1e3d5f7a8c0b2e4d6f8a1c3b5e7d9f1a3c5b7e9d1f3a5c7b9e1d3f5a

# MinIO (32 chars alphanumeric)
MINIO_ROOT_PASSWORD=mN7pQ2vL9xK4fY6wZ8eC1tB5jH3rG0iA

# Auto (default) - exposes in dev only
POSTGRES_EXPOSE_PORT=auto

# Always expose (not recommended for production)
POSTGRES_EXPOSE_PORT=true

# Never expose (production default)
POSTGRES_EXPOSE_PORT=false

# During init
chown -R 999:999 ./data/postgres  # postgres user
chown -R 1001:1001 ./data/minio   # minio user
chown -R 472:472 ./data/grafana   # grafana user

# Mailpit enabled for email testing
MAILPIT_ENABLED=true
MAILPIT_UI_PORT=8025
MAILPIT_ROUTE=mail.local.nself.org

# No authentication required (local only)

# Mailpit disabled - use real email provider
MAILPIT_ENABLED=false

# Configure production email
EMAIL_PROVIDER=sendgrid
SENDGRID_API_KEY=SG.xxxxx

# Development
nself build  # Mailpit included

# Production
# 1. Set email provider
EMAIL_PROVIDER=sendgrid
SENDGRID_API_KEY=your-key

# 2. Disable Mailpit
MAILPIT_ENABLED=false

# 3. Rebuild
nself build && nself restart

# Full security audit (all checks)
nself audit security

# Specific checks
nself audit security secrets      # Check weak secrets
nself audit security cors         # Check CORS configuration
nself audit security ports        # Check exposed ports
nself audit security containers   # Check container users

⚠ HIGH - Secret too short: REDIS_PASSWORD
  Current: 12 characters, Minimum: 24
  → Generate: openssl rand -hex 32

⚠ CRITICAL - Default secret detected: POSTGRES_PASSWORD
  Value: postgres-dev-password
  → Rotate: nself harden secrets

⚠ CRITICAL - Wildcard CORS in production
  Current: HASURA_GRAPHQL_CORS_DOMAIN=*
  → Fix: nself harden cors

⚠ HIGH - Database exposed in production
  Current: POSTGRES_EXPOSE_PORT=true
  → Fix: Set POSTGRES_EXPOSE_PORT=false

⚠ MEDIUM - Service running as root: redis
  → Fix: Add user: "999:999" in docker-compose.yml

# Check exit code
nself audit security
echo $?

# Exit codes:
# 0 - All checks passed
# 1 - Issues found
# 2 - Critical issues found

# .github/workflows/security-audit.yml
name: Security Audit

on:
  push:
    branches: [main, staging, production]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install nself
        run: curl -sSL https://install.nself.org | bash

      - name: Run security audit
        run: nself audit security

      - name: Fail on critical issues
        run: |
          if [ $? -eq 2 ]; then
            echo "Critical security issues found"
            exit 1
          fi

# Run interactive wizard
nself harden

# Apply all fixes without prompting
nself harden all

# Rotate weak secrets only
nself harden secrets

# Fix CORS configuration only
nself harden cors

# Hardening creates backups automatically
ls -la .env.backup-*
# .env.backup-20260211-143000

# Rollback if needed
cp .env.backup-20260211-143000 .env
nself build && nself restart

# Create backup first
cp .env .env.manual-backup

# Then harden
nself harden all

# Rollback if needed
cp .env.manual-backup .env

# Allow only your main domain
HASURA_GRAPHQL_CORS_DOMAIN=https://myapp.com

# Wildcard subdomain
HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com

# Comma-separated list
HASURA_GRAPHQL_CORS_DOMAIN=https://app.myapp.com,https://admin.myapp.com,https://dashboard.myapp.com

# Development
HASURA_GRAPHQL_CORS_DOMAIN=http://localhost:*,https://*.local.nself.org

# Production
HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com

# Test from browser console
fetch('https://api.myapp.com/v1/graphql', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ query: '{ __typename }' })
})
.then(r => r.json())
.then(console.log)
.catch(console.error);

# Hex (for admin secrets, JWT keys)
openssl rand -hex 48  # 96 characters

# Base64 (for general secrets)
openssl rand -base64 48  # 64 characters

# Alphanumeric (for passwords)
openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32

# Hex
head -c 48 /dev/urandom | xxd -p -c 48

# Base64
head -c 48 /dev/urandom | base64 | tr -d '\n'

# From another container (always works)
psql -h postgres -U postgres -d myapp

# From host in development
psql -h 127.0.0.1 -U postgres -d myapp

# From host in production (use docker exec)
docker exec -it myapp_postgres psql -U postgres -d myapp

# Running as root (BAD)
docker run -it --rm alpine sh
whoami  # root - can do anything

# Running as user (GOOD)
docker run -it --rm --user 1000:1000 alpine sh
whoami  # 1000 - limited permissions

# Must match container user
sudo chown -R 1000:1000 ./data/myservice

# Or use docker to set ownership
docker run --rm -v $(pwd)/data/myservice:/data alpine \
  sh -c "chown -R 1000:1000 /data"

# System users (< 1000)
0     - root (never use)
101   - nginx
472   - grafana
999   - postgres, redis

# Regular users (>= 1000)
1000  - hasura, auth, custom services
1001  - minio

# 1. Set production environment
export ENV=production

# 2. Run comprehensive security audit
nself audit security

# 3. Check for critical issues
if [ $? -ne 0 ]; then
  echo "Fix security issues before deploying"
  exit 1
fi

# 4. Verify all checks pass
# Expected: "All security checks passed!"

# Check secret lengths
grep -E "(PASSWORD|SECRET|KEY)" .env | while read line; do
  key=$(echo $line | cut -d= -f1)
  value=$(echo $line | cut -d= -f2)
  length=${#value}

  if [ $length -lt 24 ]; then
    echo "⚠ $key is too short ($length chars)"
  else
    echo "✓ $key is strong ($length chars)"
  fi
done

# Verify CORS setting
grep CORS .env

# Expected (production):
# HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com

# NOT:
# HASURA_GRAPHQL_CORS_DOMAIN=*
# HASURA_GRAPHQL_CORS_DOMAIN=http://localhost:*

# Verify no exposed ports
docker-compose config | grep -A 5 "ports:"

# Expected: Only nginx with 80/443
# nginx:
#   ports:
#     - "80:80"
#     - "443:443"

# Option 1: Let's Encrypt (recommended)
SSL_MODE=letsencrypt
[email protected]
BASE_DOMAIN=myapp.com

# Option 2: Custom certificate
SSL_MODE=custom
SSL_CERT_PATH=/path/to/cert.pem
SSL_KEY_PATH=/path/to/key.pem

# Option 3: Cloudflare (if using Cloudflare)
SSL_MODE=cloudflare
# Let Cloudflare handle SSL

# Check certificate
openssl s_client -connect myapp.com:443 -servername myapp.com

# Check SSL grade
curl -s https://www.ssllabs.com/ssltest/analyze.html?d=myapp.com

# Enable monitoring stack
MONITORING_ENABLED=true

# Configure Grafana
GRAFANA_ADMIN_PASSWORD=strong-password-here

# Configure Alertmanager
ALERTMANAGER_SMTP_HOST=smtp.gmail.com
[email protected]
[email protected]

# Enable daily backups
BACKUP_ENABLED=true
BACKUP_SCHEDULE="0 2 * * *"  # Daily at 2 AM
BACKUP_RETENTION_DAYS=30

# Cloud backup (recommended)
BACKUP_CLOUD_PROVIDER=s3
S3_BACKUP_BUCKET=myapp-backups
S3_BACKUP_ACCESS_KEY=xxx
S3_BACKUP_SECRET_KEY=xxx

# Run complete production checklist
nself audit security

# Start services
nself build && nself start

# Verify all services healthy
docker ps --filter "health=healthy"

# Test application
curl -I https://myapp.com
curl -I https://api.myapp.com

# Check logs for errors
docker-compose logs --tail=100

# Monitor for 10 minutes
watch -n 30 'docker ps'

# Enable audit logging
NSELF_AUDIT_ENABLED=true

# Enable monitoring
MONITORING_ENABLED=true

# Run security audits regularly
nself audit security >> /var/log/nself/security-audits.log

# Enable encryption
POSTGRES_SSL_MODE=require
MINIO_ENCRYPTION=true

# Enable audit logging
NSELF_AUDIT_ENABLED=true
AUDIT_RETENTION_DAYS=2555  # 7 years for GDPR

# Configure data retention
DATA_RETENTION_DAYS=365

# Encryption required
SSL_MODE=letsencrypt
POSTGRES_SSL_MODE=require

# Audit logging required
NSELF_AUDIT_ENABLED=true
AUDIT_LOG_PHI_ACCESS=true

# Session timeout
AUTH_JWT_ACCESS_TOKEN_EXPIRES_IN=900  # 15 minutes
AUTH_REQUIRE_REAUTH_FOR_PHI=true

# PostgreSQL
# Enable pgcrypto extension
POSTGRES_EXTENSIONS=pgcrypto,uuid-ossp

# Encrypt sensitive columns
CREATE EXTENSION IF NOT EXISTS pgcrypto;

CREATE TABLE patients (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  name TEXT,
  ssn TEXT,  -- Will be encrypted
  email TEXT
);

-- Encrypt SSN
INSERT INTO patients (name, ssn, email)
VALUES ('John Doe', pgp_sym_encrypt('123-45-6789', 'encryption-key'), '[email protected]');

-- Decrypt SSN
SELECT name, pgp_sym_decrypt(ssn::bytea, 'encryption-key') as ssn, email
FROM patients;

# Force SSL for database connections
POSTGRES_SSL_MODE=require

# Force HTTPS for all web traffic
NGINX_FORCE_HTTPS=true

# TLS 1.2+ only
NGINX_SSL_PROTOCOLS="TLSv1.2 TLSv1.3"

# MinIO server-side encryption
MINIO_ENCRYPTION=true
MINIO_ENCRYPTION_KEY=your-encryption-key-here

# Encrypt backups
BACKUP_ENCRYPTION=true
BACKUP_ENCRYPTION_KEY=your-backup-encryption-key

# Option 1: Fix ownership on host
sudo chown -R 999:999 ./data/postgres
sudo chown -R 1001:1001 ./data/minio
sudo chown -R 472:472 ./data/grafana

# Option 2: Use docker to fix ownership
docker run --rm -v $(pwd)/data/postgres:/data alpine \
  sh -c "chown -R 999:999 /data"

# Option 3: Reinitialize (destructive)
nself stop
rm -rf ./data/postgres
nself start  # Will recreate with correct permissions

# nself init automatically sets correct permissions
nself init

# Or run setup script
bash scripts/setup-permissions.sh

# 1. Check current CORS setting
grep CORS .env

# 2. Add your domain
# Before:
HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com

# After:
HASURA_GRAPHQL_CORS_DOMAIN=https://*.myapp.com,https://admin.myapp.com

# 3. Rebuild and restart
nself build && nself restart

# 4. Test from browser console
fetch('https://api.myapp.com/v1/graphql', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({ query: '{ __typename }' })
})

# Check CORS headers
curl -I -X OPTIONS \
  -H "Origin: https://app.myapp.com" \
  -H "Access-Control-Request-Method: POST" \
  https://api.myapp.com/v1/graphql

# Expected response includes:
# Access-Control-Allow-Origin: https://app.myapp.com
# Access-Control-Allow-Credentials: true

# 1. Generate secret
SECRET=$(openssl rand -hex 48)

# 2. Add to .env
echo "HASURA_GRAPHQL_ADMIN_SECRET=$SECRET" >> .env

# 3. Rebuild
nself build && nself restart

# Use hardening command
nself harden secrets

# Or regenerate all secrets
nself init --regenerate-secrets

# 1. Find what's using the port
sudo lsof -i :5432
# or
netstat -tulpn | grep 5432

# 2. Option A: Stop conflicting service
sudo systemctl stop postgresql

# 3. Option B: Change nself port
# Edit .env:
POSTGRES_PORT=5433

# 4. Rebuild
nself build && nself restart

# Don't expose ports in production
POSTGRES_EXPOSE_PORT=false

# Access via docker exec instead
docker exec -it myapp_postgres psql -U postgres

# Rotate specific secret
nself harden secrets

# Or manual
NEW_SECRET=$(openssl rand -hex 48)
sed -i "s/POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$NEW_SECRET/" .env
nself restart

# Create rotation script
cat > /opt/nself/rotate-secrets.sh << 'EOF'
#!/bin/bash
cd /var/www/myapp
source .env

# Rotate secrets
nself harden secrets

# Rebuild and restart
nself build && nself restart

# Notify team
curl -X POST https://slack.com/api/chat.postMessage \
  -H "Authorization: Bearer $SLACK_TOKEN" \
  -d "channel=#devops" \
  -d "text=Secrets rotated for myapp"
EOF

# Schedule monthly rotation
0 2 1 * * /opt/nself/rotate-secrets.sh >> /var/log/nself/rotation.log 2>&1

# 1. Create new secrets (don't apply yet)
NEW_POSTGRES_PW=$(openssl rand -hex 48)
NEW_HASURA_SECRET=$(openssl rand -hex 96)

# 2. Update auth service to accept BOTH old and new secrets
# (requires code changes to support dual-secret validation)

# 3. Deploy updated auth service
nself deploy auth

# 4. Update .env with new secrets
sed -i "s/POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$NEW_POSTGRES_PW/" .env
sed -i "s/HASURA_GRAPHQL_ADMIN_SECRET=.*/HASURA_GRAPHQL_ADMIN_SECRET=$NEW_HASURA_SECRET/" .env

# 5. Rolling restart (one service at a time)
nself restart postgres --wait
nself restart hasura --wait
nself restart auth --wait

# 6. Remove old secret support from auth service
# 7. Deploy final auth service

# Import security dashboard
curl -X POST https://grafana.myapp.com/api/dashboards/import \
  -H "Authorization: Bearer $GRAFANA_API_KEY" \
  -d @monitoring/dashboards/security.json

# 1. Initialize with strong secrets
nself init

# 2. Configure for your environment
export ENV=production

# 3. Run security audit
nself audit security

# 4. Apply hardening if needed
nself harden

# 5. Deploy
nself build && nself start

# 6. Verify
curl -f https://api.myapp.com/healthz