# 1. Update everything
sudo apt update && sudo apt upgrade -y

# 2. Create a non-root user
adduser deploy
usermod -aG sudo deploy

# 3. Set up SSH key auth (from your local machine)
ssh-copy-id deploy@your-server-ip

# 4. Disable password auth
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# 5. Set up firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

# 6. Install essentials
sudo apt install -y nginx certbot python3-certbot-nginx nodejs npm git htop

# 7. Set up automatic security updates
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

// uptime-monitor.js — checks every 60 seconds, alerts via webhook
const https = require('https');
const http = require('http');

const SITES = [
  { url: 'https://yoursite.com', name: 'Main Site' },
  { url: 'https://api.yoursite.com/health', name: 'API' },
];

const WEBHOOK = process.env.ALERT_WEBHOOK; // Discord/Slack webhook

async function check(site) {
  return new Promise((resolve) => {
    const mod = site.url.startsWith('https') ? https : http;
    const start = Date.now();
    const req = mod.get(site.url, (res) => {
      resolve({ 
        up: res.statusCode < 400, 
        status: res.statusCode, 
        ms: Date.now() - start 
      });
    });
    req.on('error', () => resolve({ up: false, status: 0, ms: 0 }));
    req.setTimeout(10000, () => { req.destroy(); resolve({ up: false, status: 0, ms: 0 }); });
  });
}

async function checkAll() {
  for (const site of SITES) {
    const result = await check(site);
    if (!result.up) {
      console.log(`🔴 DOWN: ${site.name} (${result.status})`);
      if (WEBHOOK) {
        // Send alert to Discord/Slack
        const payload = JSON.stringify({
          content: `🔴 **${site.name}** is DOWN! Status: ${result.status}`
        });
        // ... webhook POST
      }
    } else {
      console.log(`🟢 UP: ${site.name} (${result.ms}ms)`);
    }
  }
}

setInterval(checkAll, 60000);
checkAll();

#!/bin/bash
# ssl-check.sh — checks cert expiry, alerts if < 14 days
DOMAINS=("yoursite.com" "api.yoursite.com" "blog.yoursite.com")

for domain in "${DOMAINS[@]}"; do
  expiry=$(echo | openssl s_client -connect "$domain:443" 2>/dev/null | \
    openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  
  if [ -z "$expiry" ]; then
    echo "⚠️  $domain: Could not check SSL"
    continue
  fi
  
  expiry_epoch=$(date -d "$expiry" +%s)
  now_epoch=$(date +%s)
  days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
  
  if [ $days_left -lt 14 ]; then
    echo "🔴 $domain: SSL expires in $days_left days!"
  else
    echo "🟢 $domain: SSL OK ($days_left days left)"
  fi
done

// page-watcher.js — detects content changes on any webpage
const crypto = require('crypto');
const https = require('https');
const fs = require('fs');

const WATCHED = [
  { url: 'https://competitor.com/pricing', name: 'Competitor Pricing' },
  { url: 'https://jobs.company.com', name: 'Job Board' },
];

const STATE_FILE = './page-hashes.json';
const state = fs.existsSync(STATE_FILE) ? JSON.parse(fs.readFileSync(STATE_FILE)) : {};

async function fetchPage(url) {
  return new Promise((resolve, reject) => {
    https.get(url, (res) => {
      let data = '';
      res.on('data', chunk => data += chunk);
      res.on('end', () => resolve(data));
    }).on('error', reject);
  });
}

async function checkChanges() {
  for (const page of WATCHED) {
    try {
      const content = await fetchPage(page.url);
      const hash = crypto.createHash('md5').update(content).digest('hex');
      
      if (state[page.url] && state[page.url] !== hash) {
        console.log(`📝 CHANGED: ${page.name}`);
        // Alert via webhook, email, etc.
      }
      state[page.url] = hash;
    } catch (e) {
      console.log(`❌ Error checking ${page.name}: ${e.message}`);
    }
  }
  fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
}

setInterval(checkChanges, 3600000); // Every hour
checkChanges();

const dns = require('dns').promises;
const { exec } = require('child_process');

async function dnsLookup(domain) {
  const [a, aaaa, mx, ns, txt, cname] = await Promise.allSettled([
    dns.resolve(domain, 'A'),
    dns.resolve(domain, 'AAAA'),
    dns.resolve(domain, 'MX'),
    dns.resolve(domain, 'NS'),
    dns.resolve(domain, 'TXT'),
    dns.resolve(domain, 'CNAME'),
  ]);
  
  return {
    A: a.status === 'fulfilled' ? a.value : [],
    AAAA: aaaa.status === 'fulfilled' ? aaaa.value : [],
    MX: mx.status === 'fulfilled' ? mx.value : [],
    NS: ns.status === 'fulfilled' ? ns.value : [],
    TXT: txt.status === 'fulfilled' ? txt.value : [],
    CNAME: cname.status === 'fulfilled' ? cname.value : [],
  };
}

// Usage
dnsLookup('example.com').then(console.log);

const https = require('https');
const { JSDOM } = require('jsdom');

async function analyzeSEO(url) {
  const html = await fetchPage(url);
  const dom = new JSDOM(html);
  const doc = dom.window.document;
  
  const title = doc.querySelector('title')?.textContent || '';
  const meta_desc = doc.querySelector('meta[name="description"]')?.content || '';
  const h1s = [...doc.querySelectorAll('h1')].map(h => h.textContent);
  const images = [...doc.querySelectorAll('img')];
  const imgsWithoutAlt = images.filter(i => !i.alt);
  
  return {
    title: { text: title, length: title.length, good: title.length >= 30 && title.length <= 60 },
    description: { text: meta_desc, length: meta_desc.length, good: meta_desc.length >= 120 && meta_desc.length <= 160 },
    h1: { count: h1s.length, texts: h1s, good: h1s.length === 1 },
    images: { total: images.length, missingAlt: imgsWithoutAlt.length },
    score: calculateScore(title, meta_desc, h1s, images, imgsWithoutAlt),
  };
}

npm install -g pm2

# Start a service
pm2 start uptime-monitor.js --name uptime

# Auto-restart on crash
pm2 startup
pm2 save

# View status
pm2 status
pm2 logs uptime

# Quick system health check
#!/bin/bash
echo "=== CPU ==="
top -bn1 | head -5

echo "=== Memory ==="
free -h

echo "=== Disk ==="
df -h /

echo "=== Services ==="
pm2 jlist | python3 -c "
import json, sys
for p in json.load(sys.stdin):
    status = '🟢' if p['pm2_env']['status'] == 'online' else '🔴'
    print(f\"{status} {p['name']}: {p['pm2_env']['status']} (restarts: {p['pm2_env']['restart_time']})\")"

# 1. Fail2ban — blocks brute force SSH attempts
sudo apt install fail2ban
sudo systemctl enable fail2ban

# 2. Change SSH port (optional but effective)
sudo sed -i 's/#Port 22/Port 2222/' /etc/ssh/sshd_config
sudo ufw allow 2222/tcp
sudo systemctl restart sshd

# 3. Disable root login
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

# 4. Set up Let's Encrypt SSL
sudo certbot --nginx -d yourserver.com

#!/bin/bash
# backup.sh — daily backup to object storage
BACKUP_DIR="/tmp/backup-$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# Backup configs
cp -r /etc/nginx/sites-enabled "$BACKUP_DIR/"
cp -r /home/deploy/services "$BACKUP_DIR/"

# Backup databases (if any)
# pg_dump mydb > "$BACKUP_DIR/mydb.sql"

# Compress
tar czf "/tmp/backup-$(date +%Y%m%d).tar.gz" "$BACKUP_DIR"

# Upload to object storage (Backblaze B2 = $0.005/GB/mo)
# b2 upload-file mybucket "/tmp/backup-$(date +%Y%m%d).tar.gz" "backups/"

# Clean up local
rm -rf "$BACKUP_DIR" "/tmp/backup-$(date +%Y%m%d).tar.gz"