add the main file structure requirements

q2-attack-simulation /prevention-policies.yaml

@@ -0,0 +1,206 @@
+# Network Policies & Container Security لمنع هجمات Brute Force
+# للتطبيقات المنشورة على غيمة (ghaymah.systems)
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 1. Network Policy - عزل قاعدة البيانات
+# ═══════════════════════════════════════════════════════════════
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: database-isolation
+  namespace: ghaymah-app
+  labels:
+    app: security-policy
+spec:
+  podSelector:
+    matchLabels:
+      app: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # السماح فقط للـ backend بالوصول لقاعدة البيانات
+    - from:
+        - podSelector:
+            matchLabels:
+              app: backend-api
+      ports:
+        - protocol: TCP
+          port: 5432
+  egress:
+    # منع قاعدة البيانات من الاتصال بالخارج
+    - to:
+        - podSelector:
+            matchLabels:
+              app: backend-api
+      ports:
+        - protocol: TCP
+          port: 5432
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 2. Network Policy - حماية API Login
+# ═══════════════════════════════════════════════════════════════
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-login-protection
+  namespace: ghaymah-app
+spec:
+  podSelector:
+    matchLabels:
+      app: login-api
+  policyTypes:
+    - Ingress
+  ingress:
+    # السماح فقط من خلال API Gateway/Ingress
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: ingress-nginx
+        - podSelector:
+            matchLabels:
+              app: api-gateway
+      ports:
+        - protocol: TCP
+          port: 8080
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 3. Network Policy - عزل Redis
+# ═══════════════════════════════════════════════════════════════
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: redis-isolation
+  namespace: ghaymah-app
+spec:
+  podSelector:
+    matchLabels:
+      app: redis
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: backend-api
+      ports:
+        - protocol: TCP
+          port: 6379
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 4. Pod Security Policy - منع تشغيل root
+# ═══════════════════════════════════════════════════════════════
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: restricted-psp
+spec:
+  privileged: false
+  runAsUser:
+    rule: MustRunAsNonRoot
+  runAsGroup:
+    rule: MustRunAs
+    ranges:
+      - min: 1000
+        max: 65535
+  fsGroup:
+    rule: MustRunAs
+    ranges:
+      - min: 1000
+        max: 65535
+  seLinux:
+    rule: RunAsAny
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'secret'
+    - 'persistentVolumeClaim'
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 5. Security Context للـ Deployment
+# ═══════════════════════════════════════════════════════════════
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: secure-api
+  namespace: ghaymah-app
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: backend-api
+  template:
+    metadata:
+      labels:
+        app: backend-api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: api
+          image: myapp:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - containerPort: 8080
+          resources:
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}
+
+---
+# ═══════════════════════════════════════════════════════════════
+# 6. Rate Limiting في Ingress (nginx)
+# ═══════════════════════════════════════════════════════════════
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-ingress
+  namespace: ghaymah-app
+  annotations:
+    # Rate limiting
+    nginx.ingress.kubernetes.io/limit-rps: "10"
+    nginx.ingress.kubernetes.io/limit-connections: "5"
+    # حماية من الهجمات
+    nginx.ingress.kubernetes.io/server-snippet: |
+      # حظر User-Agents المشبوهة
+      if ($http_user_agent ~* (curl|wget|python|nikto|sqlmap)) {
+        return 403;
+      }
+spec:
+  rules:
+    - host: app.ghaymah.systems
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: backend-api
+                port:
+                  number: 8080