# Network Policies & Container Security لمنع هجمات Brute Force
# للتطبيقات المنشورة على غيمة (ghaymah.systems)

---
# ═══════════════════════════════════════════════════════════════
# 1. Network Policy - عزل قاعدة البيانات
# ═══════════════════════════════════════════════════════════════
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-isolation
  namespace: ghaymah-app
  labels:
    app: security-policy
spec:
  podSelector:
    matchLabels:
      app: postgresql
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # السماح فقط للـ backend بالوصول لقاعدة البيانات
    - from:
        - podSelector:
            matchLabels:
              app: backend-api
      ports:
        - protocol: TCP
          port: 5432
  egress:
    # منع قاعدة البيانات من الاتصال بالخارج
    - to:
        - podSelector:
            matchLabels:
              app: backend-api
      ports:
        - protocol: TCP
          port: 5432

---
# ═══════════════════════════════════════════════════════════════
# 2. Network Policy - حماية API Login
# ═══════════════════════════════════════════════════════════════
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-login-protection
  namespace: ghaymah-app
spec:
  podSelector:
    matchLabels:
      app: login-api
  policyTypes:
    - Ingress
  ingress:
    # السماح فقط من خلال API Gateway/Ingress
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
        - podSelector:
            matchLabels:
              app: api-gateway
      ports:
        - protocol: TCP
          port: 8080

---
# ═══════════════════════════════════════════════════════════════
# 3. Network Policy - عزل Redis
# ═══════════════════════════════════════════════════════════════
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis-isolation
  namespace: ghaymah-app
spec:
  podSelector:
    matchLabels:
      app: redis
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend-api
      ports:
        - protocol: TCP
          port: 6379

---
# ═══════════════════════════════════════════════════════════════
# 4. Pod Security Policy - منع تشغيل root
# ═══════════════════════════════════════════════════════════════
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false
  runAsUser:
    rule: MustRunAsNonRoot
  runAsGroup:
    rule: MustRunAs
    ranges:
      - min: 1000
        max: 65535
  fsGroup:
    rule: MustRunAs
    ranges:
      - min: 1000
        max: 65535
  seLinux:
    rule: RunAsAny
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'secret'
    - 'persistentVolumeClaim'
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL

---
# ═══════════════════════════════════════════════════════════════
# 5. Security Context للـ Deployment
# ═══════════════════════════════════════════════════════════════
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-api
  namespace: ghaymah-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backend-api
  template:
    metadata:
      labels:
        app: backend-api
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: api
          image: myapp:latest
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: "500m"
              memory: "512Mi"
            requests:
              cpu: "100m"
              memory: "128Mi"
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

---
# ═══════════════════════════════════════════════════════════════
# 6. Rate Limiting في Ingress (nginx)
# ═══════════════════════════════════════════════════════════════
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: ghaymah-app
  annotations:
    # Rate limiting
    nginx.ingress.kubernetes.io/limit-rps: "10"
    nginx.ingress.kubernetes.io/limit-connections: "5"
    # حماية من الهجمات
    nginx.ingress.kubernetes.io/server-snippet: |
      # حظر User-Agents المشبوهة
      if ($http_user_agent ~* (curl|wget|python|nikto|sqlmap)) {
        return 403;
      }
spec:
  rules:
    - host: app.ghaymah.systems
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: backend-api
                port:
                  number: 8080