# Production Hardening Guide

Below table lists various checks that must be performed before actual roll out of a deployment. This list is **not** exhaustive and it is expected that SIs use this as a reference and augment their own hardening procedures.

| Topic                                                                                                                     | Tasks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Module properties](https://github.com/mosip/documentation/blob/1.2.0/docs/deployment/production/module-configuration.md) | <ul><li>Change log level to INFO in application properties.</li><li>Disable registration processor External Stage if not required.</li><li>Reprocessor cronjob frequency and other settings</li><li>All cronjobs timings according to the country (check property files).</li><li>Disable '111111' default OTP.</li><li>Review idschema attribute names against names in Datashare policy and Auth policy for all partner (including IDA).</li><li>Review attributes specified in <code>ida-zero-knowledge-unencrypted-credential-attributes</code></li><li>Review id-authentication-mapping.json\` in config vis-a-vis attribute names in idschema</li><li>Kafka: disable option to delete a topic: <a href="https://github.com/mosip/mosip-infra/blob/1.2.0.1/deployment/v3/external/kafka/values.yaml"><code>deleteTopicEnable: false</code></a> (this is set while installing <a href="https://github.com/mosip/mosip-infra/blob/develop/deployment/v3/external/kafka/values.yaml">Kafka</a>).</li></ul> |
| Backup                                                                                                                    | <ul><li>Set up backup for Longhorn.</li><li>Backup of Postgres db.</li><li>Replication factor in Minio.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Cluster hardening                                                                                                         | <ul><li>On-prem K8s cluster production configuration as given <a href="https://github.com/mosip/k8s-infra/blob/main/docs/rke-cluster-hardening.md">here</a>.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Archival                                                                                                                  | <ul><li>Archival of logs: Since logs data grows at a rapid pace, the data needs to be achived frequently. Set up an archival process.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Keycloak                                                                                                                  | <ul><li>Keycloak Realm connection timeout settings - review all.</li><li>Valid urls redirect in Keycloak - set specific urls.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Postgres                                                                                                                  | <ul><li><a href="../../../modules/persistence/postgres-db#production-db-configuration">Postgres production configuration</a></li><li>Backup</li><li>Secure admin password</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Access control                                                                                                            | <ul><li>Multi-factor authentication for Rancher and Keycloak.</li><li>Review all Wireguard keys. Are all keys accounted for? Do the machines with Wireguard keys have sufficient protection - like firewalls, password/biometric login etc.</li><li>Are correct cluster roles assigned to users in Rancher? Is <a href="https://github.com/mosip/k8s-infra/blob/main/rancher/README.md#rbac">RBAC</a> set properly?</li><li>Do the users of Rancher have strong passwords only known to them?</li><li>Is Rancher and Keycloak accessible only on Wireguard and not on public net?</li><li>Who holds the Keycloak Admin credentials? Are the credentials secure?</li><li>Any stray passwords lying on the disks?</li></ul>                                                                                                                                                                                                                                                                                    |
| Cluster setup                                                                                                             | <ul><li>Increase the number of nodes in the cluster according to expected load.</li><li>Set rate control (throttling) parameters for PreReg.</li><li>Scripts to clean up processed packets in landing zone.</li><li>Review pod replication factors for all modules. E.g ClamAV.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Persistence                                                                                                               | <ul><li>Enable persistence in all modules. On cloud change the storage class from 'Delete' to 'Retain'. If you already have PV as 'Delete', you can edit the PV config and change it to 'Retain' (without having to change storage class).</li><li>Make sure storage class allows expansion of storage.</li></ul><p><code>allowVolumeExpansion: true</code></p><ul><li>Review size of persistent volumes and update.</li><li>Increase MinIO persistent volume size based on your estimations.</li><li>Review production settings of <a href="https://github.com/mosip/k8s-infra/blob/main/mosip/longhorn/README.md#longhorn">Longhorn</a>.</li></ul>                                                                                                                                                                                                                                                                                                                                                         |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.mosip.io/1.2.0/~/changes/EDXkAXJ2BnUpKbwo76Y3/deploymentnew/production/production-hardening-guide.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.