Linux: مشروع التخرج — بناء خادم تطوير ويب من الصفر

1. دخول SSH           → 6. نشر تطبيق Node.js
2. إنشاء مستخدم + تعزيز SSH → 7. إعداد شهادة HTTPS
3. إعداد جدار الحماية     → 8. إعداد مدير العمليات PM2
4. تثبيت Nginx       → 9. نسخ احتياطي آلي
5. إعداد الوكيل العكسي → 10. فحص الصحة + التنبيه

□ دخول SSH (كلمة مرور root)
□ تحديث النظام (apt update && apt upgrade)
□ إنشاء مستخدم عادي (useradd -m -s /bin/bash)
□ إعداد sudo (usermod -aG sudo)
□ مصادقة مفاتيح SSH
□ تعطيل الجذر + الدخول بكلمة المرور
□ جدار الحماية (ufw: 22/80/443)
□ حماية fail2ban
□ تحديثات أمان تلقائية

# Nginx
sudo apt install nginx
sudo systemctl enable --now nginx

# إذا كنت تستخدم MySQL
sudo apt install mysql-server
sudo mysql_secure_installation

# مقارنة نشر التطبيقات

#!/bin/bash
# Deploy a Node.js app to production

# 1. إنشاء دليل التطبيق
sudo mkdir -p /opt/webapp
sudo chown -R alice:alice /opt/webapp

# 2. استنساخ ملفات التطبيق (بافتراض أنه مطوّر فعلًا)
git clone https://github.com/example/webapp.git /opt/webapp

# 3. تثبيت الاعتماديات والبناء
cd /opt/webapp
npm install
npm run build

# 4. إعداد PM2
npm install -g pm2
pm2 start server.js --name webapp -i max
pm2 save
pm2 startup

# 5. إعداد وكيل Nginx العكسي
sudo tee /etc/nginx/sites-available/webapp << 'EOF'
server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static/ {
        alias /opt/webapp/public/;
        expires 30d;
    }
}
EOF

sudo ln -sf /etc/nginx/sites-available/webapp /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

# تثبيت certbot
sudo apt install certbot python3-certbot-nginx -y

# الحصول على شهادة (تعدّل إعدادات Nginx تلقائيًا)
sudo certbot --nginx -d example.com -d www.example.com

# عرض الشهادات
sudo certbot certificates

# التحقق من التجديد التلقائي
sudo certbot renew --dry-run

# الشهادة تتجدد تلقائيًا (certbot يضيف مؤقت systemd)
sudo systemctl list-timers | grep certbot

#!/bin/bash
# health-check.sh - فحص صحة متعدد الخدمات

check_service() {
    local name="$1"
    local url="$2"
    local expect="${3:-200}"

    local status=$(curl -s -o /dev/null -w "%{http_code}" "$url" 2>/dev/null)

    if [ "$status" = "$expect" ]; then
        echo "[OK] $name: $status (healthy)"
        return 0
    else
        echo "[FAIL] $name: $status (unhealthy)"
        return 1
    fi
}

echo "=== System Health Check ==="
echo "Time: $(date)"
echo ""

# موارد النظام
echo "CPU: $(top -bn1 | grep "Cpu(s)" | awk '{print $2}')%"
echo "Memory: $(free -h | grep Mem | awk '{print $3 "/" $2}')"
echo "Disk: $(df -h / | tail -1 | awk '{print $3 "/" $2 " (" $5 ")"}')"
echo ""

# خدمات الويب
check_service "Nginx" "http://localhost/nginx_status" 200
check_service "WebApp" "http://localhost:3000/health" 200
check_service "HTTPS" "https://example.com/" 200

echo ""
echo "=== Check Complete ==="

#!/bin/bash
# setup-server.sh - بناء خادم تطوير ويب من الصفر
# الاستخدام: sudo ./setup-server.sh example.com

set -euo pipefail

DOMAIN="${1:-example.com}"
APP_DIR="/opt/webapp"
APP_PORT=3000
ADMIN_USER="admin"

echo "========================================"
echo "    Build Web Dev Server from Scratch"
echo "    Domain: $DOMAIN"
echo "========================================"

# 1. تحديث النظام
echo ""
echo ">>> 1/10 Updating system..."
apt update && apt upgrade -y

# 2. إنشاء مستخدم عادي
echo ""
echo ">>> 2/10 Creating admin user..."
if ! id "$ADMIN_USER" &>/dev/null; then
    useradd -m -s /bin/bash "$ADMIN_USER"
    usermod -aG sudo "$ADMIN_USER"
    echo "Set password for $ADMIN_USER:"
    passwd "$ADMIN_USER"

    # ملاحظة: أضف مفتاح SSH العام يدويًا إلى /home/$ADMIN_USER/.ssh/authorized_keys
    mkdir -p /home/$ADMIN_USER/.ssh
    cp /root/.ssh/authorized_keys /home/$ADMIN_USER/.ssh/ 2>/dev/null || true
    chown -R $ADMIN_USER:$ADMIN_USER /home/$ADMIN_USER/.ssh
    chmod 700 /home/$ADMIN_USER/.ssh
    chmod 600 /home/$ADMIN_USER/.ssh/authorized_keys
fi

# 3. تعزيز SSH
echo ""
echo ">>> 3/10 Hardening SSH..."
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
systemctl restart sshd

# 4. جدار الحماية
echo ""
echo ">>> 4/10 Configuring firewall..."
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

# 5. fail2ban
echo ""
echo ">>> 5/10 Installing fail2ban..."
apt install -y fail2ban
cat > /etc/fail2ban/jail.d/sshd.conf << EOF
[sshd]
enabled = true
maxretry = 3
bantime = 86400
findtime = 600
EOF
systemctl enable --now fail2ban

# 6. تثبيت Nginx
echo ""
echo ">>> 6/10 Installing Nginx..."
apt install -y nginx
systemctl enable --now nginx

# 7. تثبيت Node.js
echo ""
echo ">>> 7/10 Installing Node.js..."
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt install -y nodejs
npm install -g pm2

# 8. إعداد وكيل Nginx العكسي
echo ""
echo ">>> 8/10 Configuring Nginx..."
cat > /etc/nginx/sites-available/$DOMAIN << EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;

    location / {
        proxy_pass http://127.0.0.1:$APP_PORT;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host \$host;
        proxy_cache_bypass \$http_upgrade;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
EOF

ln -sf /etc/nginx/sites-available/$DOMAIN /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

# 9. شهادة HTTPS
echo ""
echo ">>> 9/10 Configuring HTTPS..."
apt install -y certbot python3-certbot-nginx
certbot --nginx --non-interactive --agree-tos \
    --email admin@$DOMAIN \
    -d $DOMAIN -d www.$DOMAIN \
    || echo "Warning: certbot failed, run manually: sudo certbot --nginx -d $DOMAIN"

# 10. سكريبت فحص الصحة
echo ""
echo ">>> 10/10 Setting up health check..."
mkdir -p /opt/scripts

cat > /opt/scripts/health-check.sh << 'EOF'
#!/bin/bash
WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK"

for svc in nginx sshd fail2ban; do
    if ! systemctl is-active --quiet "$svc"; then
        echo "[$(date)] FAIL: $svc is down" >> /var/log/health.log
    fi
done

DISK=$(df / | tail -1 | awk '{print $5}' | tr -d '%')
[ "$DISK" -gt 85 ] && echo "[$(date)] WARNING: Disk usage ${DISK}%" >> /var/log/health.log
EOF

chmod +x /opt/scripts/health-check.sh

# إضافة إلى cron
(crontab -l 2>/dev/null; echo "*/10 * * * * /opt/scripts/health-check.sh > /dev/null 2>&1") | crontab -

echo ""
echo "========================================"
echo "Server setup complete!"
echo ""
echo "Deployment info:"
echo "  Admin user: $ADMIN_USER"
echo "  Nginx: http://$DOMAIN"
echo "  HTTPS: https://$DOMAIN (if certbot succeeded)"
echo "  Node.js: $(node --version)"
echo "  PM2: $(pm2 --version)"
echo ""
echo "Next steps:"
echo "  1. Deploy your app code to $APP_DIR"
echo "  2. Start the app: pm2 start $APP_DIR/server.js --name webapp"
echo "  3. Log in as $ADMIN_USER (root login is disabled)"
echo "========================================"

#!/bin/bash
# verify-deploy.sh - التحقق من النشر

echo "========================================"
echo "    Deployment Verification"
echo "    Time: $(date)"
echo "========================================"
echo ""

errors=0

check() {
    local desc="$1"
    shift
    if "$@" &>/dev/null; then
        echo "  [OK] $desc"
    else
        echo "  [FAIL] $desc"
        errors=$((errors + 1))
    fi
}

echo "1. System Services"
echo "-----------"
check "Nginx running" systemctl is-active nginx
check "SSH running" systemctl is-active sshd
check "fail2ban running" systemctl is-active fail2ban
echo ""

echo "2. Network"
echo "--------"
check "Port 80 listening" bash -c "ss -tlnp | grep -q ':80 '"
check "Port 443 listening" bash -c "ss -tlnp | grep -q ':443 '"
check "ufw enabled" bash -c "ufw status | grep -q active"
echo ""

echo "3. HTTP Service"
echo "-------------"
check "Local Nginx responding" bash -c "curl -s -o /dev/null -w '%{http_code}' http://localhost | grep -q 200"
check "App process running" bash -c "pm2 list 2>/dev/null | grep -q 'online' || pgrep -f 'node server' > /dev/null"
echo ""

echo "4. Security"
echo "--------"
check "Root SSH disabled" bash -c "grep '^PermitRootLogin' /etc/ssh/sshd_config | grep -q 'no'"
check "Password login disabled" bash -c "grep '^PasswordAuthentication' /etc/ssh/sshd_config | grep -q 'no'"
echo ""

echo "5. Resources"
echo "--------"
echo "  CPU: $(top -bn1 | grep 'Cpu(s)' | awk '{print $2"%"}')"
echo "  Memory: $(free -h | grep Mem | awk '{print $3"/"$2}')"
echo "  Disk: $(df -h / | tail -1 | awk '{print $3"/"$2"("$5")"}')"
echo ""

echo "========================================"
if [ $errors -eq 0 ]; then
    echo "All verifications passed!"
else
    echo "$errors check(s) failed — please investigate"
fi
echo "========================================"