# settings/production.py - Secure production settings
import os
from pathlib import Path

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
if not SECRET_KEY:
    raise ValueError("DJANGO_SECRET_KEY environment variable must be set")

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = False

# Allowed hosts configuration
ALLOWED_HOSTS = [
    'yourdomain.com',
    'www.yourdomain.com',
    'api.yourdomain.com',
]

# Security middleware configuration
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'whitenoise.middleware.WhiteNoiseMiddleware',  # Static files
    'django.contrib.sessions.middleware.SessionMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

# Database security
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.environ.get('DB_NAME'),
        'USER': os.environ.get('DB_USER'),
        'PASSWORD': os.environ.get('DB_PASSWORD'),
        'HOST': os.environ.get('DB_HOST'),
        'PORT': os.environ.get('DB_PORT', '5432'),
        'OPTIONS': {
            'sslmode': 'require',
        },
        'CONN_MAX_AGE': 600,
    }
}

# Cache security
CACHES = {
    'default': {
        'BACKEND': 'django_redis.cache.RedisCache',
        'LOCATION': os.environ.get('REDIS_URL'),
        'OPTIONS': {
            'CLIENT_CLASS': 'django_redis.client.DefaultClient',
            'CONNECTION_POOL_KWARGS': {
                'ssl_cert_reqs': 'required',
                'ssl_ca_certs': '/path/to/ca-certificates.crt',
            }
        }
    }
}

# Session security
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
SESSION_CACHE_ALIAS = 'default'
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Strict'
SESSION_COOKIE_AGE = 3600  # 1 hour
SESSION_EXPIRE_AT_BROWSER_CLOSE = True
SESSION_SAVE_EVERY_REQUEST = True

# CSRF protection
CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True
CSRF_COOKIE_SAMESITE = 'Strict'
CSRF_TRUSTED_ORIGINS = [
    'https://yourdomain.com',
    'https://www.yourdomain.com',
]

# Security headers
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_HSTS_SECONDS = 31536000  # 1 year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_SSL_REDIRECT = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

# X-Frame-Options
X_FRAME_OPTIONS = 'DENY'

# File upload security
FILE_UPLOAD_MAX_MEMORY_SIZE = 5242880  # 5MB
DATA_UPLOAD_MAX_MEMORY_SIZE = 5242880  # 5MB
FILE_UPLOAD_PERMISSIONS = 0o644
FILE_UPLOAD_DIRECTORY_PERMISSIONS = 0o755

# .env.production - Production environment variables
# Never commit this file to version control!

# Django configuration
DJANGO_SECRET_KEY=your-super-secret-key-here-make-it-long-and-random
DJANGO_SETTINGS_MODULE=myproject.settings.production
ADMIN_URL=secret-admin-path-12345/
ADMIN_EMAIL=admin@yourdomain.com

# Database configuration
DB_NAME=production_db
DB_USER=db_user
DB_PASSWORD=secure-database-password
DB_HOST=db.internal.yourdomain.com
DB_PORT=5432

# Cache configuration
REDIS_URL=rediss://username:password@redis.internal.yourdomain.com:6380/0

# Email configuration
EMAIL_HOST=smtp.yourdomain.com
EMAIL_HOST_USER=noreply@yourdomain.com
EMAIL_HOST_PASSWORD=secure-email-password
DEFAULT_FROM_EMAIL=noreply@yourdomain.com

# Third-party service keys
AWS_ACCESS_KEY_ID=your-aws-access-key
AWS_SECRET_ACCESS_KEY=your-aws-secret-key
AWS_STORAGE_BUCKET_NAME=your-s3-bucket

# Encryption keys
FIELD_ENCRYPTION_KEY=your-field-encryption-key
FILE_ENCRYPTION_KEY=your-file-encryption-key

# Monitoring and logging
SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id

# /etc/nginx/sites-available/yourdomain.com
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    
    # Redirect all HTTP to HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;
    
    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozTLS:10m;
    ssl_session_tickets off;
    
    # Modern SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    
    # Security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # Hide server information
    server_tokens off;
    
    # Rate limiting
    limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
    limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
    
    # Main application
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    
    # Admin interface with rate limiting
    location /secret-admin-path-12345/ {
        limit_req zone=login burst=5 nodelay;
        
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Additional security for admin
        allow 192.168.1.0/24;  # Office IP range
        allow 10.0.0.0/8;      # VPN range
        deny all;
    }
    
    # Static files
    location /static/ {
        alias /path/to/your/staticfiles/;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
    
    # Media files with security
    location /media/ {
        alias /path/to/your/media/;
        
        # Prevent execution of uploaded files
        location ~* \.(php|pl|py|jsp|asp|sh|cgi)$ {
            deny all;
        }
    }
}

# gunicorn.conf.py - Secure Gunicorn configuration
import multiprocessing
import os

# Server socket
bind = "127.0.0.1:8000"
backlog = 2048

# Worker processes
workers = multiprocessing.cpu_count() * 2 + 1
worker_class = "sync"
worker_connections = 1000
timeout = 30
keepalive = 2
max_requests = 1000
max_requests_jitter = 50

# Security
limit_request_line = 4094
limit_request_fields = 100
limit_request_field_size = 8190

# Logging
accesslog = "/var/log/gunicorn/access.log"
errorlog = "/var/log/gunicorn/error.log"
loglevel = "info"

# Process naming
proc_name = "django_app"

# Server mechanics
daemon = False
pidfile = "/var/run/gunicorn/django.pid"
user = "django"
group = "django"

# /etc/systemd/system/django.service
[Unit]
Description=Django Application
After=network.target postgresql.service redis.service
Requires=postgresql.service redis.service

[Service]
Type=notify
User=django
Group=django
WorkingDirectory=/opt/django-app
Environment=DJANGO_SETTINGS_MODULE=myproject.settings.production
EnvironmentFile=/opt/django-app/.env.production
ExecStart=/opt/django-app/venv/bin/gunicorn --config /opt/django-app/gunicorn.conf.py myproject.wsgi:application
ExecReload=/bin/kill -s HUP $MAINPID
KillMode=mixed
TimeoutStopSec=5
PrivateTmp=true
Restart=on-failure
RestartSec=5

# Security settings
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/django-app/media /var/log/django /var/log/gunicorn
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target

-- Database security setup
-- Create dedicated database user
CREATE USER django_user WITH PASSWORD 'secure_password';

-- Create database
CREATE DATABASE django_production OWNER django_user;

-- Grant minimal required permissions
GRANT CONNECT ON DATABASE django_production TO django_user;
GRANT USAGE ON SCHEMA public TO django_user;
GRANT CREATE ON SCHEMA public TO django_user;

-- Revoke unnecessary permissions
REVOKE ALL ON DATABASE django_production FROM PUBLIC;
REVOKE ALL ON SCHEMA public FROM PUBLIC;

#!/bin/bash
# secure_backup.sh - Secure database backup script

set -euo pipefail

# Configuration
DB_NAME="django_production"
DB_USER="django_user"
BACKUP_DIR="/secure/backups"
ENCRYPTION_KEY="/secure/keys/backup.key"
RETENTION_DAYS=30

# Create backup directory
mkdir -p "$BACKUP_DIR"

# Generate backup filename
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/django_backup_$TIMESTAMP.sql"
ENCRYPTED_FILE="$BACKUP_FILE.gpg"

# Create database dump
pg_dump -h localhost -U "$DB_USER" -d "$DB_NAME" \
    --no-password --verbose --clean --no-acl --no-owner \
    > "$BACKUP_FILE"

# Encrypt backup
gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
    --s2k-digest-algo SHA512 --s2k-count 65536 \
    --symmetric --output "$ENCRYPTED_FILE" "$BACKUP_FILE"

# Remove unencrypted backup
rm "$BACKUP_FILE"

# Set secure permissions
chmod 600 "$ENCRYPTED_FILE"

# Clean old backups
find "$BACKUP_DIR" -name "django_backup_*.sql.gpg" \
    -mtime +$RETENTION_DAYS -delete

# Log backup completion
logger "Django database backup completed: $ENCRYPTED_FILE"

echo "Backup completed successfully: $ENCRYPTED_FILE"

# monitoring.py - Security monitoring utilities
import logging
import time
from django.core.cache import cache
from django.http import HttpResponseForbidden
from django.utils.deprecation import MiddlewareMixin

logger = logging.getLogger('security')

class SecurityMonitoringMiddleware(MiddlewareMixin):
    """Monitor and log security events"""
    
    def __init__(self, get_response):
        self.get_response = get_response
        super().__init__(get_response)
    
    def process_request(self, request):
        """Monitor incoming requests for suspicious activity"""
        
        # Log admin access attempts
        if request.path.startswith('/admin/'):
            logger.info(
                f"Admin access attempt: {request.META.get('REMOTE_ADDR')} "
                f"-> {request.path} [{request.method}]"
            )
        
        # Monitor for suspicious patterns
        self.check_suspicious_patterns(request)
        
        # Rate limiting check
        if self.is_rate_limited(request):
            logger.warning(
                f"Rate limit exceeded: {request.META.get('REMOTE_ADDR')} "
                f"-> {request.path}"
            )
            return HttpResponseForbidden("Rate limit exceeded")
    
    def check_suspicious_patterns(self, request):
        """Check for suspicious request patterns"""
        
        # Check for SQL injection attempts
        suspicious_params = ['union', 'select', 'drop', 'insert', 'delete']
        query_string = request.META.get('QUERY_STRING', '').lower()
        
        for param in suspicious_params:
            if param in query_string:
                logger.warning(
                    f"Suspicious SQL pattern detected: {request.META.get('REMOTE_ADDR')} "
                    f"-> {request.path}?{query_string}"
                )
                break
        
        # Check for XSS attempts
        xss_patterns = ['<script', 'javascript:', 'onerror=', 'onload=']
        for pattern in xss_patterns:
            if pattern in query_string:
                logger.warning(
                    f"Suspicious XSS pattern detected: {request.META.get('REMOTE_ADDR')} "
                    f"-> {request.path}?{query_string}"
                )
                break
    
    def is_rate_limited(self, request):
        """Simple rate limiting implementation"""
        client_ip = request.META.get('REMOTE_ADDR')
        cache_key = f"rate_limit:{client_ip}"
        
        # Get current request count
        current_requests = cache.get(cache_key, 0)
        
        # Check if limit exceeded (100 requests per minute)
        if current_requests >= 100:
            return True
        
        # Increment counter
        cache.set(cache_key, current_requests + 1, 60)  # 1 minute timeout
        return False

#!/bin/bash
# ssl_setup.sh - SSL certificate setup and renewal

# Install Certbot
sudo apt-get update
sudo apt-get install certbot python3-certbot-nginx

# Obtain SSL certificate
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Set up automatic renewal
sudo crontab -e
# Add: 0 12 * * * /usr/bin/certbot renew --quiet

# Test renewal
sudo certbot renew --dry-run

# Create certificate monitoring script
cat > /opt/scripts/cert_monitor.sh << 'EOF'
#!/bin/bash
# Monitor SSL certificate expiration

DOMAIN="yourdomain.com"
THRESHOLD_DAYS=30

# Check certificate expiration
EXPIRY_DATE=$(echo | openssl s_client -servername $DOMAIN -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
CURRENT_EPOCH=$(date +%s)
DAYS_UNTIL_EXPIRY=$(( ($EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))

if [ $DAYS_UNTIL_EXPIRY -lt $THRESHOLD_DAYS ]; then
    echo "WARNING: SSL certificate for $DOMAIN expires in $DAYS_UNTIL_EXPIRY days"
    # Send alert email
    echo "SSL certificate for $DOMAIN expires in $DAYS_UNTIL_EXPIRY days" | \
        mail -s "SSL Certificate Expiration Warning" admin@yourdomain.com
fi
EOF

chmod +x /opt/scripts/cert_monitor.sh

# Add to cron (daily check)
echo "0 9 * * * /opt/scripts/cert_monitor.sh" | sudo crontab -

#!/bin/bash
# comprehensive_backup.sh - Complete application backup

set -euo pipefail

# Configuration
BACKUP_ROOT="/secure/backups"
APP_ROOT="/opt/django-app"
DB_NAME="django_production"
DB_USER="django_user"
RETENTION_DAYS=30

# Create backup directory structure
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="$BACKUP_ROOT/$TIMESTAMP"
mkdir -p "$BACKUP_DIR"

echo "Starting comprehensive backup: $TIMESTAMP"

# 1. Database backup
echo "Backing up database..."
pg_dump -h localhost -U "$DB_USER" -d "$DB_NAME" \
    --no-password --verbose --clean --no-acl --no-owner \
    > "$BACKUP_DIR/database.sql"

# 2. Application code backup
echo "Backing up application code..."
tar -czf "$BACKUP_DIR/application.tar.gz" \
    --exclude="*.pyc" \
    --exclude="__pycache__" \
    --exclude=".git" \
    --exclude="node_modules" \
    --exclude="venv" \
    -C "$APP_ROOT" .

# 3. Media files backup
echo "Backing up media files..."
if [ -d "$APP_ROOT/media" ]; then
    tar -czf "$BACKUP_DIR/media.tar.gz" -C "$APP_ROOT" media/
fi

# 4. Configuration files backup
echo "Backing up configuration files..."
mkdir -p "$BACKUP_DIR/config"
cp /etc/nginx/sites-available/yourdomain.com "$BACKUP_DIR/config/"
cp /etc/systemd/system/django.service "$BACKUP_DIR/config/"
cp "$APP_ROOT/.env.production" "$BACKUP_DIR/config/"

# 5. Create backup manifest
echo "Creating backup manifest..."
cat > "$BACKUP_DIR/manifest.txt" << EOF
Backup created: $(date)
Hostname: $(hostname)
Database size: $(du -h "$BACKUP_DIR/database.sql" | cut -f1)
Application size: $(du -h "$BACKUP_DIR/application.tar.gz" | cut -f1)

Files included:
$(ls -la "$BACKUP_DIR")
EOF

# 6. Encrypt entire backup
echo "Encrypting backup..."
tar -czf - -C "$BACKUP_ROOT" "$TIMESTAMP" | \
    gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
        --s2k-digest-algo SHA512 --s2k-count 65536 \
        --symmetric --output "$BACKUP_ROOT/backup_$TIMESTAMP.tar.gz.gpg"

# 7. Remove unencrypted backup
rm -rf "$BACKUP_DIR"

# 8. Set secure permissions
chmod 600 "$BACKUP_ROOT/backup_$TIMESTAMP.tar.gz.gpg"

# 9. Clean old backups
find "$BACKUP_ROOT" -name "backup_*.tar.gz.gpg" \
    -mtime +$RETENTION_DAYS -delete

# 10. Log completion
BACKUP_SIZE=$(du -h "$BACKUP_ROOT/backup_$TIMESTAMP.tar.gz.gpg" | cut -f1)
logger "Django backup completed: backup_$TIMESTAMP.tar.gz.gpg ($BACKUP_SIZE)"

echo "Backup completed successfully: backup_$TIMESTAMP.tar.gz.gpg ($BACKUP_SIZE)"

# security_audit.py - Automated security audit script
import os
import subprocess
import json
from pathlib import Path

class SecurityAuditor:
    """Perform automated security audits"""
    
    def __init__(self, project_root):
        self.project_root = Path(project_root)
        self.results = {}
    
    def run_full_audit(self):
        """Run complete security audit"""
        
        print("Starting security audit...")
        
        # Check Django configuration
        self.audit_django_settings()
        
        # Check dependencies for vulnerabilities
        self.audit_dependencies()
        
        # Check file permissions
        self.audit_file_permissions()
        
        # Generate report
        self.generate_report()
    
    def audit_django_settings(self):
        """Audit Django settings for security issues"""
        
        print("Auditing Django settings...")
        
        settings_issues = []
        
        # Check common security settings
        security_checks = [
            ('DEBUG', False, "DEBUG should be False in production"),
            ('ALLOWED_HOSTS', None, "ALLOWED_HOSTS should not contain wildcards"),
            ('SECRET_KEY', None, "SECRET_KEY should be set from environment"),
        ]
        
        # This would check actual Django settings in practice
        # For now, we'll simulate the checks
        
        self.results['django_settings'] = settings_issues
    
    def audit_dependencies(self):
        """Check dependencies for known vulnerabilities"""
        
        print("Auditing dependencies...")
        
        try:
            # Run safety check (requires 'safety' package)
            result = subprocess.run(
                ['safety', 'check', '--json'],
                capture_output=True,
                text=True,
                cwd=self.project_root
            )
            
            if result.returncode == 0:
                self.results['dependencies'] = []
            else:
                vulnerabilities = json.loads(result.stdout)
                self.results['dependencies'] = vulnerabilities
                
        except (subprocess.CalledProcessError, json.JSONDecodeError, FileNotFoundError):
            self.results['dependencies'] = ["Could not run dependency audit"]
    
    def audit_file_permissions(self):
        """Check file permissions for security issues"""
        
        print("Auditing file permissions...")
        
        permission_issues = []
        
        # Check sensitive files
        sensitive_files = [
            '.env',
            '.env.production',
            'db.sqlite3',
        ]
        
        for filename in sensitive_files:
            filepath = self.project_root / filename
            if filepath.exists():
                stat = filepath.stat()
                mode = oct(stat.st_mode)[-3:]
                
                # Check if file is world-readable
                if int(mode[2]) > 0:
                    permission_issues.append(f"{filename} is world-readable ({mode})")
        
        self.results['file_permissions'] = permission_issues
    
    def generate_report(self):
        """Generate security audit report"""
        
        print("\n" + "="*50)
        print("SECURITY AUDIT REPORT")
        print("="*50)
        
        total_issues = sum(len(issues) for issues in self.results.values() if isinstance(issues, list))
        
        print(f"Total issues found: {total_issues}")
        print()
        
        for category, issues in self.results.items():
            print(f"{category.upper().replace('_', ' ')}:")
            if isinstance(issues, list):
                if issues:
                    for issue in issues:
                        print(f"  ❌ {issue}")
                else:
                    print("  ✅ No issues found")
            else:
                print(f"  ℹ️  {issues}")
            print()

if __name__ == "__main__":
    import sys
    
    project_root = sys.argv[1] if len(sys.argv) > 1 else "/opt/django-app"
    
    auditor = SecurityAuditor(project_root)
    auditor.run_full_audit()

# Django Security Deployment Checklist

## Environment Configuration
- [ ] DEBUG = False in production settings
- [ ] SECRET_KEY is set from environment variable
- [ ] ALLOWED_HOSTS is properly configured (no wildcards)
- [ ] Database credentials are in environment variables
- [ ] All sensitive data is in environment variables
- [ ] .env files are not in version control
- [ ] Environment variables are properly secured

## Security Settings
- [ ] SecurityMiddleware is enabled
- [ ] SECURE_SSL_REDIRECT = True
- [ ] SECURE_HSTS_SECONDS = 31536000 (1 year)
- [ ] SECURE_HSTS_INCLUDE_SUBDOMAINS = True
- [ ] SECURE_HSTS_PRELOAD = True
- [ ] SECURE_CONTENT_TYPE_NOSNIFF = True
- [ ] SECURE_BROWSER_XSS_FILTER = True
- [ ] X_FRAME_OPTIONS = 'DENY'
- [ ] SESSION_COOKIE_SECURE = True
- [ ] SESSION_COOKIE_HTTPONLY = True
- [ ] CSRF_COOKIE_SECURE = True
- [ ] CSRF_COOKIE_HTTPONLY = True

## Database Security
- [ ] Database user has minimal required permissions
- [ ] Database connection uses SSL
- [ ] Database password is strong and unique
- [ ] Database backups are encrypted
- [ ] Row-level security is configured (if needed)

## Server Configuration
- [ ] Web server (Nginx/Apache) is properly configured
- [ ] SSL certificate is installed and valid
- [ ] Security headers are configured
- [ ] Rate limiting is implemented
- [ ] Admin interface URL is obscured
- [ ] Static files are served securely
- [ ] File upload restrictions are in place

## Application Security
- [ ] All user input is validated and sanitized
- [ ] SQL injection protection is verified
- [ ] XSS protection is implemented
- [ ] CSRF protection is enabled
- [ ] Authentication system is secure
- [ ] Password validation is comprehensive
- [ ] Session management is secure

## Infrastructure Security
- [ ] Server OS is updated and patched
- [ ] Firewall is properly configured
- [ ] SSH access is secured (key-based, no root)
- [ ] Unnecessary services are disabled
- [ ] Log files are properly secured
- [ ] Backup system is implemented and tested

## Monitoring and Logging
- [ ] Security logging is enabled
- [ ] Log rotation is configured
- [ ] Monitoring alerts are set up
- [ ] Intrusion detection is configured
- [ ] Performance monitoring is in place
- [ ] Error tracking is implemented (Sentry, etc.)

## Backup and Recovery
- [ ] Automated backup system is implemented
- [ ] Backups are encrypted
- [ ] Backup restoration is tested
- [ ] Disaster recovery plan is documented
- [ ] Backup retention policy is defined

## Compliance and Documentation
- [ ] Security policies are documented
- [ ] Incident response plan is prepared
- [ ] Security audit is completed
- [ ] Penetration testing is performed
- [ ] Compliance requirements are met
- [ ] Security training is provided to team

## Post-Deployment
- [ ] Security monitoring is active
- [ ] SSL certificate auto-renewal is working
- [ ] Backup system is running correctly
- [ ] Performance metrics are being collected
- [ ] Security alerts are being received
- [ ] Regular security updates are scheduled