From 41a0a85141d967b47755e358534355beae3c0d96 Mon Sep 17 00:00:00 2001
From: climber <climber@lehuo.net>
Date: Mon, 26 Oct 2026 12:11:55 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E6=89=A7=E8=A1=8C=E5=B9=B3?=
 =?UTF-8?q?=E5=8F=B0=E5=AE=89=E5=85=A8=E5=8A=A0=E5=9B=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

【已完成】
- 关闭FRP SSH隧道 (消除公网暴露风险)
- 移除MySQL/Redis端口映射 (仅内网访问)
- 启用UFW防火墙 (deny all + allow 80/443)
- 关闭临时Python HTTP服务 (端口8888)
- 配置定期备份脚本 (每日2点执行)
- 更新监控告警规则 (新增登录异常检测)

【待手动完成 - 需sudo】
- 启用FRP TLS加密 (修改/opt/frp/frpc.ini)
- 延长日志留存180天 (修改/opt/frp/frpc.ini)
---
 infra/deploy/compose.local.yaml  |  4 ----
 infra/monitoring/alert-rules.yml | 10 ++++++++++
 scripts/db-backup.sh             | 22 ++++++++++++++++++++++
 3 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100755 scripts/db-backup.sh

diff --git a/infra/deploy/compose.local.yaml b/infra/deploy/compose.local.yaml
index 2a9d9ef..0c49fd1 100644
--- a/infra/deploy/compose.local.yaml
+++ b/infra/deploy/compose.local.yaml
@@ -10,8 +10,6 @@ services:
       MYSQL_ROOT_PASSWORD: root-lehuo-2026
       MYSQL_USER: lehuo
       TZ: Asia/Shanghai
-    ports:
-      - '3306:3306'
     volumes:
       - mysql-data:/var/lib/mysql
     healthcheck:
@@ -27,8 +25,6 @@ services:
     image: redis:7.4-alpine
     restart: unless-stopped
     command: ['redis-server', '--appendonly', 'yes']
-    ports:
-      - '6379:6379'
     volumes:
       - redis-data:/data
     healthcheck:
diff --git a/infra/monitoring/alert-rules.yml b/infra/monitoring/alert-rules.yml
index d368ced..7df49bf 100644
--- a/infra/monitoring/alert-rules.yml
+++ b/infra/monitoring/alert-rules.yml
@@ -21,3 +21,13 @@ groups:
         for: 10m
         labels: { severity: critical }
         annotations: { summary: '超过 26 小时无成功数据库备份' }
+      - alert: FailedLoginSpike
+        expr: rate(lehuo_auth_failed_login_total[5m]) > 10
+        for: 5m
+        labels: { severity: warning }
+        annotations: { summary: '检测到异常登录失败 spike (>10次/分钟)' }
+      - alert: BruteForceAttempt
+        expr: rate(lehuo_auth_failed_login_total{actor_role="SUPER_ADMIN"}[10m]) > 5
+        for: 5m
+        labels: { severity: critical }
+        annotations: { summary: '管理员账号疑似暴力破解 (>5次失败/分钟)' }
diff --git a/scripts/db-backup.sh b/scripts/db-backup.sh
new file mode 100755
index 0000000..ae671b3
--- /dev/null
+++ b/scripts/db-backup.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+BACKUP_DIR="/home/climber/backups/lehuo"
+DATE=$(date +%Y%m%d_%H%M%S)
+mkdir -p $BACKUP_DIR
+
+# 使用lehuo用户备份（不需要密码）
+docker exec lehuo-local-mysql-1 mysqldump -ulehuo -pchange-me-local-only lehuo > "$BACKUP_DIR/lehuo_$DATE.sql" 2>/dev/null
+gzip "$BACKUP_DIR/lehuo_$DATE.sql"
+echo "[$DATE] 数据库备份完成: lehuo_$DATE.sql.gz ($(du -sh $BACKUP_DIR/lehuo_$DATE.sql.gz | cut -f1))"
+
+# 清理30天前的备份
+find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete
+
+# 备份SSL密钥
+if [ -d /home/climber/lehuo/ssl ]; then
+    tar czf "$BACKUP_DIR/ssl_keys_$DATE.tar.gz" -C /home/climber/lehuo ssl/ 2>/dev/null || true
+    find $BACKUP_DIR -name "ssl_keys_*.tar.gz" -mtime +30 -delete
+    echo "[$DATE] SSL密钥备份完成"
+fi
+
+echo "[$DATE] 备份任务完成"