System Administration

# Application Configuration
NODE_ENV=production
PORT=3000
NEXTAUTH_URL=https://your-domain.com
NEXTAUTH_SECRET=your-super-secure-secret-key

# Database Configuration
REDIS_URL=rediss://username:password@host:port/0
REDIS_MAX_RETRIES=3
REDIS_RETRY_DELAY=1000

# Storage Configuration
R2_ACCOUNT_ID=your-cloudflare-account-id
R2_ACCESS_KEY_ID=your-r2-access-key
R2_SECRET_ACCESS_KEY=your-r2-secret-key
R2_BUCKET_NAME=megavault-production
R2_ENDPOINT=https://your-account.r2.cloudflarestorage.com

# Security Configuration
CORS_ORIGIN=https://your-domain.com
RATE_LIMIT_WINDOW=900000
RATE_LIMIT_MAX=100

# Monitoring Configuration
SENTRY_DSN=https://your-sentry-dsn
LOG_LEVEL=info
METRICS_ENABLED=true

{
  "app": {
    "name": "MegaVault",
    "version": "1.0.0",
    "environment": "production"
  },
  "server": {
    "port": 3000,
    "host": "0.0.0.0",
    "timeout": 30000
  },
  "storage": {
    "provider": "r2",
    "maxFileSize": 104857600,
    "allowedTypes": ["image/*", "application/pdf", "text/*"],
    "thumbnailSizes": [150, 300, 600]
  },
  "security": {
    "helmet": {
      "contentSecurityPolicy": {
        "directives": {
          "defaultSrc": ["'self'"],
          "styleSrc": ["'self'", "'unsafe-inline'"],
          "scriptSrc": ["'self'"],
          "imgSrc": ["'self'", "data:", "https:"]
        }
      }
    },
    "cors": {
      "origin": ["https://your-domain.com"],
      "credentials": true
    }
  }
}

server {
    listen 443 ssl http2;
    server_name your-domain.com;

    # SSL Configuration
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;

    # Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;

    # Rate Limiting
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req zone=api burst=20 nodelay;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

#!/bin/bash
# daily-health-check.sh

LOG_FILE="/var/log/megavault/health-check.log"
DATE=$(date '+%Y-%m-%d %H:%M:%S')

echo "[$DATE] Starting daily health check" >> $LOG_FILE

# Check application status
if curl -f -s http://localhost:3000/api/health > /dev/null; then
    echo "[$DATE] ✓ Application is healthy" >> $LOG_FILE
else
    echo "[$DATE] ✗ Application health check failed" >> $LOG_FILE
    # Send alert
    curl -X POST https://hooks.slack.com/your-webhook         -H 'Content-type: application/json'         --data '{"text":"MegaVault health check failed"}'
fi

# Check Redis connectivity
if redis-cli ping | grep -q PONG; then
    echo "[$DATE] ✓ Redis is responding" >> $LOG_FILE
else
    echo "[$DATE] ✗ Redis connection failed" >> $LOG_FILE
fi

# Check disk usage
DISK_USAGE=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
if [ "$DISK_USAGE" -gt 80 ]; then
    echo "[$DATE] ⚠ Disk usage high: $DISK_USAGE%" >> $LOG_FILE
else
    echo "[$DATE] ✓ Disk usage normal: $DISK_USAGE%" >> $LOG_FILE
fi

echo "[$DATE] Health check completed" >> $LOG_FILE