Security best practices

# docker-compose.yml
version: '3.8'

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true  # No external access

services:
  iqra-proxy:
    networks:
      - frontend
      - backend

  iqra-backend:
    networks:
      - backend

  mongodb:
    networks:
      - backend  # Only accessible from backend network

  redis:
    networks:
      - backend

server {
    listen 443 ssl http2;
    server_name app.yourdomain.com;

    # TLS configuration
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Proxy to Iqra AI
    location / {
        proxy_pass http://localhost:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name app.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

// appsettings.json (before first deployment)
{
  "DefaultAdmin": {
    "Email": "admin@yourdomain.com",
    "Password": "generate-strong-random-password-here"
  }
}

# Linux/macOS
openssl rand -base64 32

# PowerShell
[Convert]::ToBase64String((1..32 | ForEach-Object { Get-Random -Maximum 256 }))

# Generate 64-character API key
openssl rand -hex 32

export IQRA_API_SECRET_TOKEN="your-generated-secret-here"

public static string GenerateSecureApiKey(int length = 64)
{
    using var rng = RandomNumberGenerator.Create();
    var bytes = new byte[length];
    rng.GetBytes(bytes);
    return Convert.ToBase64String(bytes).Substring(0, length);
}

var serverConfig = new CreateUpdateServerRequestModel {
    Endpoint = "backend-us-east-1.yourdomain.com",
    APIKey = GenerateSecureApiKey(),
    // ... other config
};

// Create application user with limited permissions
use iqra
db.createUser({
  user: "iqra_app",
  pwd: "strong-password-here",
  roles: [
    { role: "readWrite", db: "iqra" }
  ]
})

// Do NOT use the admin user for application access

# Redis 6+ ACL
ACL SETUSER iqra_app on >strong-password ~iqra:* +@all

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222  # Use non-standard port

# Restart SSH
sudo systemctl restart sshd

# Generate SSH key pair
ssh-keygen -t ed25519 -C "your-email@example.com"

# Copy to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@server

public class AuditLogger
{
    public void LogSecurityEvent(
        string eventType,
        string userId,
        string resource,
        string action,
        bool success,
        string details = null)
    {
        var auditEntry = new AuditLogEntry
        {
            Timestamp = DateTime.UtcNow,
            EventType = eventType,
            UserId = userId,
            Resource = resource,
            Action = action,
            Success = success,
            Details = details,
            IpAddress = GetClientIpAddress()
        };

        // Write to secure audit log (append-only)
        _auditLogRepository.Insert(auditEntry);
    }
}

// Usage
auditLogger.LogSecurityEvent(
    "AUTHENTICATION",
    userId: "user@example.com",
    resource: "Admin Dashboard",
    action: "LOGIN",
    success: true
);