Security hardening, backups, monitoring, and operational best practices for BAP production deployments.

Production Checklist

This guide covers hardening your BAP installation for production use.

Security Hardening

Environment Variables

# Generate secure keys
JWT_SECRET=$(openssl rand -hex 32)
MASTER_KEY=$(openssl rand -hex 32)

# Use strong passwords
POSTGRES_PASSWORD=$(openssl rand -base64 32)

Required Security Settings

Setting	Recommendation
TLS 1.3	Use latest protocol
HTTPS	Force redirect
CORS	Restrict to your domain
JWT Secret	32+ random characters
Master Key	64 random hex characters

Firewall

# Allow only necessary ports
sudo ufw default deny incoming
sudo ufw allow 22/tcp   # SSH
sudo ufw allow 80/tcp   # HTTP
sudo ufw allow 443/tcp  # HTTPS
sudo ufw enable

Docker Security

# docker-compose.yml additions
services:
  api:
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:size=10M

Backup Strategy

Database Backups

SQLite

# Backup script
#!/bin/bash
DATE=$(date +%Y%m%d_%H%M%S)
docker cp bap-api-1:/data/bap.db /backup/bap-$DATE.db
# Keep last 30 backups
find /backup -name "bap-*.db" -mtime +30 -delete

PostgreSQL

# Backup script
#!/bin/bash
DATE=$(date +%Y%m%d_%H%M%S)
docker exec bap-postgres-1 pg_dump -U bap bap > /backup/bap-$DATE.sql
find /backup -name "bap-*.sql" -mtime +30 -delete

Schedule Backups

# Crontab
0 2 * * * /path/to/backup.sh

Offsite Backups

Copy backups to cloud storage:

# Example: Upload to S3
aws s3 cp /backup/bap-$(date +%Y%m%d).db s3://your-bucket/backups/

Monitoring

Health Checks

# API health
curl https://api.yourdomain.com/api/health

# Expected response
{"status":"ok"}

Logs

# View logs
docker-compose logs -f --tail=100

# Ship to logging service (example)
docker-compose logs -f | journald

Metrics (Future)

Planned metrics:

API response times
Error rates
Active wills
Storage usage

Performance

Resource Limits

services:
  api:
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M

Database Connection Pool

For PostgreSQL:

DATABASE_URL=postgresql://user:pass@host:5432/db?pool_max_conns=25

Operational Procedures

Database Migration

# Backup first
./backup.sh

# Migrations run automatically on API startup
docker-compose up -d

Key Rotation

# Generate new master key
NEW_MASTER_KEY=$(openssl rand -hex 32)

# Update environment
# MASTER_KEY must be the OLD key during migration
docker-compose down
# Edit .env with new key
# Run migration script
docker-compose up -d