# MyCloudVault Production Deployment Guide

Complete guide for deploying MyCloudVault to production with security hardening, monitoring, and scaling.

## Table of Contents

1. [Prerequisites](#prerequisites)
2. [Server Setup](#server-setup)
3. [Database Configuration](#database-configuration)
4. [Application Deployment](#application-deployment)
5. [Security Hardening](#security-hardening)
6. [SSL/TLS Configuration](#ssltls-configuration)
7. [Monitoring & Logging](#monitoring--logging)
8. [Backup Strategy](#backup-strategy)
9. [Scaling](#scaling)
10. [Maintenance](#maintenance)

---

## Prerequisites

### Minimum Server Requirements

**For Small Deployments (< 10 devices):**
- CPU: 2 cores
- RAM: 4GB
- Storage: 100GB SSD
- Network: 100 Mbps

**For Medium Deployments (10-100 devices):**
- CPU: 4 cores
- RAM: 8GB
- Storage: 500GB SSD
- Network: 1 Gbps

**For Large Deployments (100+ devices):**
- CPU: 8+ cores
- RAM: 16GB+
- Storage: 1TB+ SSD (RAID 10)
- Network: 10 Gbps

### Software Requirements

- **OS**: Ubuntu 22.04 LTS or later
- **Node.js**: 20.x LTS
- **MySQL**: 8.0 or later
- **Nginx**: 1.24 or later
- **PM2**: Latest version
- **Certbot**: For SSL certificates

---

## Server Setup

### 1. Initial Server Configuration

```bash
# Update system
sudo apt update && sudo apt upgrade -y

# Install essential packages
sudo apt install -y curl git build-essential ufw fail2ban

# Create dedicated user
sudo adduser mycloudvault --disabled-password
sudo usermod -aG sudo mycloudvault

# Switch to mycloudvault user
sudo su - mycloudvault
```

### 2. Install Node.js

```bash
# Install Node.js 20.x LTS
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Verify installation
node --version  # Should show v20.x.x
npm --version
```

### 3. Install MySQL

```bash
# Install MySQL Server
sudo apt install -y mysql-server

# Secure MySQL installation
sudo mysql_secure_installation
# - Set root password
# - Remove anonymous users: Yes
# - Disallow root login remotely: Yes
# - Remove test database: Yes
# - Reload privilege tables: Yes

# Start and enable MySQL
sudo systemctl start mysql
sudo systemctl enable mysql
```

### 4. Install Nginx

```bash
# Install Nginx
sudo apt install -y nginx

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx
```

### 5. Configure Firewall

```bash
# Allow SSH, HTTP, HTTPS
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

# Verify firewall status
sudo ufw status
```

---

## Database Configuration

### 1. Create Database and User

```bash
# Login to MySQL as root
sudo mysql -u root -p
```

```sql
-- Create database
CREATE DATABASE mycloudvault CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

-- Create user with strong password
CREATE USER 'mycloudvault'@'localhost' IDENTIFIED BY 'STRONG_PASSWORD_HERE';

-- Grant privileges
GRANT ALL PRIVILEGES ON mycloudvault.* TO 'mycloudvault'@'localhost';
FLUSH PRIVILEGES;

-- Verify
SHOW GRANTS FOR 'mycloudvault'@'localhost';

EXIT;
```

### 2. Optimize MySQL Configuration

Edit `/etc/mysql/mysql.conf.d/mysqld.cnf`:

```ini
[mysqld]
# Performance tuning
innodb_buffer_pool_size = 2G  # 50-70% of available RAM
innodb_log_file_size = 512M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT

# Connection limits
max_connections = 200
max_allowed_packet = 64M

# Query cache (if needed)
query_cache_type = 1
query_cache_size = 128M

# Logging
log_error = /var/log/mysql/error.log
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2

# Security
bind-address = 127.0.0.1  # Only local connections
```

Restart MySQL:

```bash
sudo systemctl restart mysql
```

---

## Application Deployment

### 1. Clone Repository

```bash
# Clone your MyCloudVault repository
cd /home/mycloudvault
git clone https://github.com/yourusername/mycloudvault.git
cd mycloudvault
```

### 2. Install Dependencies

```bash
# Install production dependencies
npm ci --production

# Install PM2 globally
sudo npm install -g pm2
```

### 3. Configure Environment

Create `.env` file:

```bash
# Database
DB_HOST=localhost
DB_PORT=3306
DB_USER=mycloudvault
DB_PASSWORD=STRONG_PASSWORD_HERE
DB_NAME=mycloudvault

# Server
NODE_ENV=production
PORT=8080
HOST=0.0.0.0

# Security
JWT_SECRET=$(openssl rand -base64 32)
ENCRYPTION_KEY=$(openssl rand -base64 32)

# Storage
UPLOAD_DIR=/var/mycloudvault/uploads
BACKUP_DIR=/var/mycloudvault/backups
MAX_UPLOAD_SIZE=10737418240  # 10GB

# Rate Limiting
RATE_LIMIT_WINDOW=900000  # 15 minutes
RATE_LIMIT_MAX=100

# Logging
LOG_LEVEL=info
LOG_DIR=/var/log/mycloudvault
```

### 4. Create Storage Directories

```bash
# Create directories
sudo mkdir -p /var/mycloudvault/{uploads,backups}
sudo mkdir -p /var/log/mycloudvault

# Set permissions
sudo chown -R mycloudvault:mycloudvault /var/mycloudvault
sudo chown -R mycloudvault:mycloudvault /var/log/mycloudvault
sudo chmod 750 /var/mycloudvault
sudo chmod 750 /var/log/mycloudvault
```

### 5. Run Database Migrations

```bash
# Generate and run migrations
npm run db:generate
npm run db:migrate
```

### 6. Build Application

```bash
# Build frontend and backend
npm run build
```

### 7. Configure PM2

Create `ecosystem.config.js`:

```javascript
module.exports = {
  apps: [{
    name: 'mycloudvault',
    script: './bundle.js',
    instances: 'max',  // Use all CPU cores
    exec_mode: 'cluster',
    env: {
      NODE_ENV: 'production',
      PORT: 8080
    },
    error_file: '/var/log/mycloudvault/error.log',
    out_file: '/var/log/mycloudvault/out.log',
    log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
    merge_logs: true,
    max_memory_restart: '1G',
    autorestart: true,
    watch: false,
    max_restarts: 10,
    min_uptime: '10s'
  }]
};
```

### 8. Start Application

```bash
# Start with PM2
pm2 start ecosystem.config.js

# Save PM2 configuration
pm2 save

# Setup PM2 to start on boot
pm2 startup systemd -u mycloudvault --hp /home/mycloudvault
# Run the command it outputs

# Verify application is running
pm2 status
pm2 logs mycloudvault
```

---

## Security Hardening

### 1. Configure Fail2Ban

Create `/etc/fail2ban/jail.local`:

```ini
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log

[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /var/log/nginx/error.log

[nginx-limit-req]
enabled = true
filter = nginx-limit-req
port = http,https
logpath = /var/log/nginx/error.log
```

Restart Fail2Ban:

```bash
sudo systemctl restart fail2ban
sudo fail2ban-client status
```

### 2. Secure SSH

Edit `/etc/ssh/sshd_config`:

```
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
```

Restart SSH:

```bash
sudo systemctl restart sshd
```

### 3. Enable Automatic Security Updates

```bash
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
```

### 4. File Permissions

```bash
# Secure application files
chmod 750 /home/mycloudvault/mycloudvault
chmod 640 /home/mycloudvault/mycloudvault/.env

# Secure storage directories
chmod 750 /var/mycloudvault
chmod 750 /var/mycloudvault/uploads
chmod 750 /var/mycloudvault/backups
```

---

## SSL/TLS Configuration

### 1. Install Certbot

```bash
sudo apt install -y certbot python3-certbot-nginx
```

### 2. Obtain SSL Certificate

```bash
# Replace with your domain
sudo certbot --nginx -d mycloudvault.yourdomain.com

# Follow prompts:
# - Enter email address
# - Agree to terms
# - Choose to redirect HTTP to HTTPS: Yes
```

### 3. Configure Nginx

Create `/etc/nginx/sites-available/mycloudvault`:

```nginx
# Rate limiting
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=upload_limit:10m rate=2r/s;

# Upstream Node.js application
upstream mycloudvault_backend {
    least_conn;
    server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
    keepalive 64;
}

# HTTP to HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name mycloudvault.yourdomain.com;
    
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mycloudvault.yourdomain.com;

    # SSL certificates (managed by Certbot)
    ssl_certificate /etc/letsencrypt/live/mycloudvault.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mycloudvault.yourdomain.com/privkey.pem;
    
    # SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_stapling on;
    ssl_stapling_verify on;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    
    # Logging
    access_log /var/log/nginx/mycloudvault-access.log;
    error_log /var/log/nginx/mycloudvault-error.log;
    
    # Client body size (for uploads)
    client_max_body_size 10G;
    client_body_timeout 300s;
    client_body_buffer_size 128k;
    
    # Proxy timeouts
    proxy_connect_timeout 300s;
    proxy_send_timeout 300s;
    proxy_read_timeout 300s;
    send_timeout 300s;
    
    # API endpoints with rate limiting
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        
        proxy_pass http://mycloudvault_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
    
    # Upload endpoints with stricter rate limiting
    location ~ ^/api/backup/(upload|upload-chunk|upload-encrypted) {
        limit_req zone=upload_limit burst=5 nodelay;
        
        proxy_pass http://mycloudvault_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Disable buffering for uploads
        proxy_request_buffering off;
    }
    
    # Static files
    location / {
        proxy_pass http://mycloudvault_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}
```

Enable site and restart Nginx:

```bash
sudo ln -s /etc/nginx/sites-available/mycloudvault /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx
```

### 4. Auto-Renew SSL Certificates

```bash
# Test renewal
sudo certbot renew --dry-run

# Certbot automatically creates a cron job for renewal
# Verify it exists:
sudo systemctl list-timers | grep certbot
```

---

## Monitoring & Logging

### 1. Install Monitoring Tools

```bash
# Install monitoring packages
sudo apt install -y htop iotop nethogs
```

### 2. Configure Log Rotation

Create `/etc/logrotate.d/mycloudvault`:

```
/var/log/mycloudvault/*.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 mycloudvault mycloudvault
    sharedscripts
    postrotate
        pm2 reloadLogs
    endscript
}

/var/log/nginx/mycloudvault-*.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}
```

### 3. PM2 Monitoring

```bash
# Install PM2 monitoring
pm2 install pm2-logrotate

# Configure log rotation
pm2 set pm2-logrotate:max_size 10M
pm2 set pm2-logrotate:retain 7
pm2 set pm2-logrotate:compress true

# View real-time monitoring
pm2 monit

# View logs
pm2 logs mycloudvault --lines 100
```

### 4. Setup Health Check Monitoring

Create a monitoring script `/home/mycloudvault/monitor.sh`:

```bash
#!/bin/bash

# Health check endpoint
HEALTH_URL="https://mycloudvault.yourdomain.com/api/health"
ALERT_EMAIL="admin@yourdomain.com"

# Check if service is responding
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" $HEALTH_URL)

if [ $HTTP_CODE -ne 200 ]; then
    echo "MyCloudVault health check failed with HTTP $HTTP_CODE" | \
        mail -s "MyCloudVault Alert: Service Down" $ALERT_EMAIL
    
    # Attempt restart
    pm2 restart mycloudvault
fi

# Check disk space
DISK_USAGE=$(df /var/mycloudvault | tail -1 | awk '{print $5}' | sed 's/%//')
if [ $DISK_USAGE -gt 90 ]; then
    echo "MyCloudVault disk usage is at ${DISK_USAGE}%" | \
        mail -s "MyCloudVault Alert: Low Disk Space" $ALERT_EMAIL
fi
```

Make executable and add to crontab:

```bash
chmod +x /home/mycloudvault/monitor.sh

# Add to crontab (run every 5 minutes)
crontab -e
# Add line:
*/5 * * * * /home/mycloudvault/monitor.sh
```

---

## Backup Strategy

### 1. Database Backups

Create backup script `/home/mycloudvault/backup-db.sh`:

```bash
#!/bin/bash

BACKUP_DIR="/var/mycloudvault/db-backups"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/mycloudvault_$DATE.sql.gz"
RETENTION_DAYS=30

# Create backup directory
mkdir -p $BACKUP_DIR

# Dump database
mysqldump -u mycloudvault -p'PASSWORD' mycloudvault | gzip > $BACKUP_FILE

# Delete old backups
find $BACKUP_DIR -name "mycloudvault_*.sql.gz" -mtime +$RETENTION_DAYS -delete

# Log
echo "$(date): Database backup completed: $BACKUP_FILE" >> /var/log/mycloudvault/backup.log
```

Make executable and schedule:

```bash
chmod +x /home/mycloudvault/backup-db.sh

# Add to crontab (daily at 2 AM)
crontab -e
# Add line:
0 2 * * * /home/mycloudvault/backup-db.sh
```

### 2. File Backups

```bash
# Install rsync
sudo apt install -y rsync

# Create backup script
cat > /home/mycloudvault/backup-files.sh << 'EOF'
#!/bin/bash

SOURCE="/var/mycloudvault"
DEST="/backup/mycloudvault-files"
DATE=$(date +%Y%m%d)

# Create incremental backup
rsync -av --delete \
    --link-dest="$DEST/latest" \
    "$SOURCE/" \
    "$DEST/$DATE/"

# Update latest symlink
rm -f "$DEST/latest"
ln -s "$DEST/$DATE" "$DEST/latest"

# Delete backups older than 30 days
find "$DEST" -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \;
EOF

chmod +x /home/mycloudvault/backup-files.sh

# Schedule (daily at 3 AM)
crontab -e
# Add line:
0 3 * * * /home/mycloudvault/backup-files.sh
```

### 3. Offsite Backups

Consider using:
- **AWS S3**: For cloud storage
- **Backblaze B2**: Cost-effective alternative
- **rsync.net**: Secure rsync hosting

Example S3 sync:

```bash
# Install AWS CLI
sudo apt install -y awscli

# Configure AWS credentials
aws configure

# Sync backups to S3
aws s3 sync /var/mycloudvault/db-backups s3://your-bucket/mycloudvault/db-backups/
aws s3 sync /backup/mycloudvault-files s3://your-bucket/mycloudvault/files/
```

---

## Scaling

### Horizontal Scaling

**Load Balancer Setup (Nginx):**

```nginx
upstream mycloudvault_cluster {
    least_conn;
    server 192.168.1.10:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.12:8080 max_fails=3 fail_timeout=30s;
    keepalive 64;
}

server {
    # ... SSL config ...
    
    location / {
        proxy_pass http://mycloudvault_cluster;
        # ... proxy settings ...
    }
}
```

**Shared Storage:**

Use NFS or object storage for shared uploads:

```bash
# Install NFS client
sudo apt install -y nfs-common

# Mount shared storage
sudo mount -t nfs 192.168.1.100:/exports/mycloudvault /var/mycloudvault

# Add to /etc/fstab for persistence
192.168.1.100:/exports/mycloudvault /var/mycloudvault nfs defaults 0 0
```

### Database Scaling

**MySQL Replication:**

1. Configure master server
2. Setup read replicas
3. Use read/write splitting in application

**Connection Pooling:**

Already configured in `src/server/db/client.ts`:

```typescript
pool: {
  min: 2,
  max: 10
}
```

---

## Maintenance

### Regular Tasks

**Daily:**
- Check application logs
- Monitor disk usage
- Verify backups completed

**Weekly:**
- Review security logs
- Check for failed login attempts
- Analyze performance metrics

**Monthly:**
- Update system packages
- Review and rotate logs
- Test backup restoration
- Review SSL certificate expiry

### Update Procedure

```bash
# 1. Backup current version
cd /home/mycloudvault/mycloudvault
git tag backup-$(date +%Y%m%d)

# 2. Pull latest changes
git pull origin main

# 3. Install dependencies
npm ci --production

# 4. Run migrations
npm run db:migrate

# 5. Build application
npm run build

# 6. Restart with zero-downtime
pm2 reload mycloudvault

# 7. Verify
pm2 logs mycloudvault --lines 50
curl https://mycloudvault.yourdomain.com/api/health
```

### Rollback Procedure

```bash
# 1. Stop application
pm2 stop mycloudvault

# 2. Checkout previous version
git checkout backup-YYYYMMDD

# 3. Restore database (if needed)
gunzip < /var/mycloudvault/db-backups/mycloudvault_YYYYMMDD_HHMMSS.sql.gz | \
    mysql -u mycloudvault -p mycloudvault

# 4. Rebuild
npm ci --production
npm run build

# 5. Restart
pm2 restart mycloudvault
```

---

## Troubleshooting

### Application Won't Start

```bash
# Check PM2 logs
pm2 logs mycloudvault --err

# Check system resources
htop
df -h

# Check port availability
sudo netstat -tlnp | grep 8080

# Restart application
pm2 restart mycloudvault
```

### High Memory Usage

```bash
# Check PM2 memory
pm2 monit

# Restart if needed
pm2 restart mycloudvault

# Adjust max memory in ecosystem.config.js
max_memory_restart: '2G'
```

### Database Connection Issues

```bash
# Check MySQL status
sudo systemctl status mysql

# Check connections
mysql -u mycloudvault -p -e "SHOW PROCESSLIST;"

# Check logs
sudo tail -f /var/log/mysql/error.log
```

### SSL Certificate Issues

```bash
# Check certificate expiry
sudo certbot certificates

# Force renewal
sudo certbot renew --force-renewal

# Restart Nginx
sudo systemctl restart nginx
```

---

## Security Checklist

- [ ] Firewall configured (UFW)
- [ ] SSH hardened (key-only, no root)
- [ ] Fail2Ban installed and configured
- [ ] SSL/TLS certificates installed
- [ ] Strong database passwords
- [ ] Environment variables secured
- [ ] File permissions set correctly
- [ ] Automatic security updates enabled
- [ ] Regular backups configured
- [ ] Monitoring and alerting setup
- [ ] Log rotation configured
- [ ] Rate limiting enabled
- [ ] Security headers configured

---

## Performance Optimization

### 1. Enable Gzip Compression

Add to Nginx config:

```nginx
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss;
```

### 2. Enable Caching

```nginx
# Cache static assets
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
}
```

### 3. Database Query Optimization

```bash
# Enable slow query log
mysql -u root -p -e "SET GLOBAL slow_query_log = 'ON';"

# Review slow queries
sudo mysqldumpslow /var/log/mysql/slow.log
```

---

## Support

For issues or questions:
- GitHub Issues: https://github.com/yourusername/mycloudvault/issues
- Documentation: https://docs.mycloudvault.yourdomain.com
- Email: support@yourdomain.com

---

## License

See LICENSE file for details.
