updating the documentation of the SilverLinux Insftracture

docs/security.md

@@ -0,0 +1,262 @@
+# Security
+
+## Overview
+
+SilverLinux hosts critical infrastructure for Silver Solutions.
+
+This document describes the security measures implemented on the server and operational security requirements.
+
+---
+
+## Access Control
+
+### SSH Access
+
+SSH access is limited to authorized administrators.
+
+Authentication:
+
+* SSH key authentication
+* Password login discouraged
+* Root login disabled
+
+Primary user:
+
+```text
+ubuntu
+```
+
+---
+
+## Firewall
+
+### UFW
+
+UFW is enabled and used as the primary host firewall.
+
+Allowed ports:
+
+| Port | Purpose |
+| ---- | ------- |
+| 22   | SSH     |
+| 80   | HTTP    |
+| 443  | HTTPS   |
+
+All other ports should remain blocked unless explicitly required.
+
+---
+
+## Intrusion Protection
+
+### Fail2Ban
+
+Fail2Ban is enabled.
+
+Purpose:
+
+* Detect brute-force attacks
+* Automatically block malicious IP addresses
+* Protect SSH access
+
+---
+
+## Secrets Management
+
+Shared secrets are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Examples:
+
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+Rules:
+
+* Never commit secrets to Git
+* Never share secrets in documentation
+* Never hardcode passwords in Docker Compose files
+
+See:
+
+```text
+docs/secrets.md
+```
+
+---
+
+## SSL Certificates
+
+SSL certificates are managed through Nginx Proxy Manager.
+
+Certificates are automatically renewed.
+
+All public services should be accessible through HTTPS only.
+
+---
+
+## Email Security
+
+Outgoing email is provided through Gmail SMTP.
+
+Credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Requirements:
+
+* Use Gmail App Passwords only
+* Never store personal account passwords
+* Rotate credentials if exposure is suspected
+
+Sender address:
+
+```text
+noreply@silveressence.net
+```
+
+---
+
+## Authentication
+
+### Current
+
+* Local user accounts
+* Strong passwords
+
+### Planned
+
+Future OAuth providers:
+
+* Google OAuth2
+* GitHub OAuth2
+
+Requirements:
+
+* Store client secrets in company.env
+* Use least-privilege scopes
+* Disable unused authentication providers
+
+### Disabled
+
+* OpenID authentication
+
+Reason:
+
+OpenID is not required and increases attack surface.
+
+---
+
+## Two-Factor Authentication
+
+Where supported:
+
+* Enable 2FA for administrator accounts
+* Encourage 2FA for all users
+
+Priority:
+
+1. Gitea administrators
+2. OpenProject administrators
+
+---
+
+## Database Security
+
+PostgreSQL is not exposed publicly.
+
+Database access is restricted to Docker internal networks.
+
+Applications communicate with PostgreSQL through the internal Docker network.
+
+---
+
+## Docker Security
+
+Services are isolated through Docker containers.
+
+Principles:
+
+* Public services should be exposed only through Nginx Proxy Manager
+* Internal services should not expose ports publicly
+* Services should communicate through Docker networks
+* Containers should run with the minimum required privileges
+
+Networks:
+
+* proxy
+* internal
+
+---
+
+## System Updates
+
+The operating system and containers should be updated regularly.
+
+Recommendations:
+
+* Apply Ubuntu security updates
+* Update Docker images periodically
+* Remove unused containers and images
+* Review security advisories for critical services
+
+---
+
+## Backup Security
+
+Backups must include:
+
+* Configuration files
+* Docker Compose files
+* Application data
+* PostgreSQL databases
+* Shared secrets
+
+Backups must never be stored inside public repositories.
+
+---
+
+## Security Review Checklist
+
+Periodically verify:
+
+* SSH keys are current
+* Unused accounts are removed
+* Fail2Ban is active
+* UFW is active
+* SSL certificates are valid
+* Secrets are not stored in repositories
+* Backups are functioning
+* Administrator accounts have 2FA enabled
+* Review application logs
+* Review Docker logs
+* Review authentication failures
+* Review Fail2Ban bans
+
+---
+
+## Incident Response
+
+If a credential is exposed:
+
+1. Rotate the credential immediately.
+2. Update `/srv/secrets/company.env`.
+3. Restart affected services.
+4. Review logs for unauthorized access.
+5. Update documentation if required.
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/secrets.md
+* docs/backups.md
+* docs/email.md
+* nginx-proxy-manager/README.md