# Server Hardening

This project now includes a built-in one-click hardening workflow that is executed during deployment.

## Entry point

Run as root from repository root:

```bash
bash scripts/security/install-security-stack.sh
```

This installer will:

1. Install/update `perf-guard` malware cleanup timer.
2. Apply baseline server hardening (`harden-server.sh`).

## What hardening does

- Enforces npm/pnpm registry to `https://registry.npmjs.org`.
- Adds SSH hardening drop-in file:
  - limits auth retries and login grace time
  - disables X11/TCP forwarding
  - can enforce key-only login in strict mode
- Installs/configures fail2ban (`sshd` + nginx jails).
- Applies firewall rules (keep SSH port + 80/443, and optional custom ports).
- Applies kernel/network sysctl hardening.

## Runtime options

- `HARDEN_SSH_STRICT=1`  
  Enable key-only SSH auth (`PasswordAuthentication no`) when `/root/.ssh/authorized_keys` exists.

- `HARDEN_ALLOW_PORTS=3000,8080`  
  Extra TCP ports to allow in firewall.

- `HARDEN_FIREWALL_MODE=skip`  
  Skip firewall changes.

- `HARDEN_SKIP_PACKAGE_INSTALL=1`  
  Skip package installation (only apply config).

## Logs

- Hardening log: `/var/log/ai-chatbot-hardening.log`
- Perf guard log: `/var/log/perf-guard.log`