<?php

/**
 * Infrastructure Hardening Report — KiyoHR (operator checklist)
 * Extends docs/PRODUCTION.md — no live host access assumed.
 */

return [
    'ubuntu' => [
        'Keep packages patched: unattended-upgrades',
        'Disable root SSH password login; use keys only',
        'UFW: allow 22/80/443 only (or VPN for SSH)',
        'Fail2ban on sshd and nginx/apache auth',
    ],
    'web_server' => [
        'Document root MUST be public/ only',
        'Deny access to .env, storage/, vendor/, bootstrap/cache',
        'TLS 1.2+; HSTS at reverse proxy if preferred',
        'Disable directory listing',
    ],
    'php' => [
        'expose_php=Off',
        'display_errors=Off',
        'disable_functions: exec,passthru,shell_exec,system,proc_open,popen (if no required use)',
        'open_basedir optional for shared hosts',
    ],
    'mysql' => [
        'App DB user: least privilege (SELECT/INSERT/UPDATE/DELETE on app schema only)',
        'No FILE privilege; bind-address private',
        'Encrypted backups; test restore monthly',
    ],
    'redis' => [
        'Require password; bind localhost or private VPC',
        'Disable dangerous commands (FLUSHALL) if shared',
    ],
    'supervisor_queues' => [
        'Run workers as non-root deploy user',
        'Restart on failure; logrotate worker logs',
    ],
    'laravel_prod' => [
        'APP_ENV=production',
        'APP_DEBUG=false',
        'SESSION_SECURE_COOKIE=true',
        'SESSION_ENCRYPT=true',
        'CORS_ALLOWED_ORIGINS=https://your-app-domain',
        'php artisan config:cache && route:cache && view:cache',
        'storage and bootstrap/cache writable by web user only',
    ],
    'cron' => [
        '* * * * * php /var/www/hrms-saas-laravel/artisan schedule:run',
        'Ensure subscription suspend/expiry reminder commands scheduled',
    ],
    'backups' => [
        'Daily DB dump + weekly storage/app/private archive',
        'Offsite copy; encryption at rest',
    ],
];