# === CRITICAL SECURITY VARIABLES ===
JWT_SECRET="minimum-32-characters-ultra-secure-random-string"
ENCRYPTION_KEY="256-bit-base64-encoded-encryption-key"
ADMIN_PASSWORD="complex-password-with-upper-lower-numbers-symbols-123!"

# === HCAPTCHA (ANTI-BOT) ===
HCAPTCHA_SITE_KEY="your-secure-hcaptcha-site-key"
HCAPTCHA_SECRET="your-secure-hcaptcha-secret-key"

# === SSL/TLS ===
SSL_CERT_PATH="./ssl/server.crt"
SSL_KEY_PATH="./ssl/server.key"
SSL_CA_PATH="./ssl/ca.crt"

# === MONITORING ALERTS ===
SECURITY_EMAIL="security@your-domain.com"
ALERT_WEBHOOK="https://your-webhook-url.com/alerts"

#!/bin/bash
# RBT Security Hardening Script
# Run as root for maximum effectiveness

echo "🔒 Starting RBT Security Hardening..."

# 1. Update system
apt update && apt upgrade -y

# 2. Configure firewall
ufw --force enable
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp    # SSH
ufw allow 3000/tcp  # RBT Dashboard
ufw allow 9090/tcp  # RBT Metrics

# 3. Harden SSH
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
echo "MaxAuthTries 3" >> /etc/ssh/sshd_config
systemctl restart sshd

# 4. Configure fail2ban
apt install fail2ban -y
cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[rbt]
enabled = true
port = 3000
filter = rbt
logpath = /var/log/rbt/auth.log
maxretry = 3
EOF

systemctl enable fail2ban
systemctl start fail2ban

echo "✅ Security hardening completed!"

# اجرای ممیزی کامل
npx tsx scripts/security-manager.ts audit

# ممیوز امنیتی سریع
npx tsx scripts/security-manager.ts quick-audit

# اسکن آسیب‌پذیری‌ها
npx tsx scripts/security-manager.ts vulnerability-scan

# گزارش امنیتی جامع
npx tsx scripts/security-manager.ts full-report

# مانیتورینگ real-time
tail -f /var/log/rbt/security.log | grep "ALERT\|ERROR\|CRITICAL"

# بررسی لاگ‌های سیستم
journalctl -u rbt -f --since "5 minutes ago"

# بررسی اتصالات مشکوک
netstat -tulpn | grep ESTABLISHED | wc -l

# بلاک کردن IP مشکوه
npx tsx scripts/security-manager.ts block-ip 1.2.3.4

# غیرفعال کردن اکانت مشکوک
npx tsx scripts/security-manager.ts disable-user suspicious-user

# ایزوله کردن سرویس
systemctl stop rbt

# حذف فایل‌های مخرب
find /var/lib/rbt -name "*.malicious" -delete

# پاکسازی کش و لاگ‌ها
npx tsx scripts/security-manager.ts cleanup

# بازنشانی پیکربندی به حالت امن
cp config.secure.toml config.toml

# بررسی یکپارچگی سیستم
npx tsx scripts/security-manager.ts integrity-check

# بازگردانی از بکاپ
npx tsx scripts/backup-manager.ts restore --date 2024-01-15

# راه‌اندازی مجدد سرویس
systemctl start rbt

#!/bin/bash
# RBT Security Update Script
# Run weekly via cron

echo "🔄 Starting security updates..."

# 1. Update system packages
apt update && apt upgrade -y

# 2. Update RBT
npm update

# 3. Update security definitions
npx tsx scripts/security-manager.ts update-definitions

# 4. Renew certificates
npx tsx scripts/security-manager.ts renew-certs

# 5. Run security scan
npx tsx scripts/security-manager.ts scan

# 6. Generate report
npx tsx scripts/security-manager.ts report --format json > security-report-$(date +%Y%m%d).json

echo "✅ Security updates completed!"

# گزارش هفتگی
npx tsx scripts/security-manager.ts weekly-report

# گزارش ماهانه
npx tsx scripts/security-manager.ts monthly-report

# گزارش سالانه
npx tsx scripts/security-manager.ts annual-report

# گزارش سفارشی
npx tsx scripts/security-manager.ts custom-report --start-date 2024-01-01 --end-date 2024-01-31