This document outlines security configurations for the LocalStore Platform infrastructure.

┌─────────────────────────────────────────────────────────────┐
│                     Security Layers                         │
├─────────────────────────────────────────────────────────────┤
│  CloudFlare (DDoS protection, WAF)                          │
├─────────────────────────────────────────────────────────────┤
│  AWS Security Groups (Network firewall)                     │
├─────────────────────────────────────────────────────────────┤
│  Nginx (Rate limiting, SSL termination)                     │
├─────────────────────────────────────────────────────────────┤
│  Application (JWT auth, input validation)                   │
├─────────────────────────────────────────────────────────────┤
│  Database (RLS policies, encrypted connections)             │
└─────────────────────────────────────────────────────────────┘

Store sensitive values in AWS Secrets Manager:

# Create secret
aws secretsmanager create-secret \
    --name localstore/prod/database \
    --secret-string '{"username":"localstore","password":"SECURE_PASSWORD"}'

# Retrieve in application
aws secretsmanager get-secret-value --secret-id localstore/prod/database

For MVP, use environment variables with encrypted EBS:

# .env file on EC2 (never commit to git)
DB_PASSWORD=secure_password_here
JWT_SECRET=64_char_random_string_here
REDIS_PASSWORD=another_secure_password

SSL is handled automatically by CloudFlare proxy (orange cloud icon):

• Free SSL/TLS certificates (auto-provisioned)
• DDoS protection
• WAF (Web Application Firewall)
• Hidden origin IP

Set CloudFlare SSL mode to "Flexible" in the dashboard.

See docker/nginx/conf.d/api.conf for:

• CloudFlare IP allowlisting
• Real IP extraction from CF-Connecting-IP header
• Rate limiting

• Single VPC for all resources
• Public subnet for EC2 (with Internet Gateway)
• Private subnet for databases (future)
• VPC Flow Logs enabled

Nginx configuration (60 requests/minute):

limit_req_zone $binary_remote_addr zone=api:10m rate=60r/m;

location /api/ {
    limit_req zone=api burst=20 nodelay;
}

• OTP-based authentication (no passwords stored)
• JWT tokens with 24-hour expiry
• Refresh tokens with 30-day expiry
• Token rotation on refresh

PostgreSQL RLS ensures tenant isolation:

-- Set current tenant before queries
SELECT set_current_tenant('tenant-uuid');

-- RLS policy enforces tenant_id matching
CREATE POLICY tenant_isolation ON orders
    USING (tenant_id = get_current_tenant());

• All inputs validated at API layer
• Parameterized queries (TypeORM)
• XSS protection via response headers
• CORS restricted to allowed origins

Configure alerts for:

• Failed SSH login attempts
• Unusual API error rates (>5%)
• High network traffic spikes
• Unauthorized API access attempts

All logs retained for:

• VPC Flow Logs: 30 days
• Application logs: 90 days
• Audit logs: 1 year

• Change all default passwords
• Generate new JWT secret (64+ characters)
• Restrict SSH to specific IPs
• Enable EBS encryption
• Configure security groups
• Set up SSL certificates

• Verify SSL certificate valid
• Test rate limiting works
• Confirm RLS policies active
• Check VPC Flow Logs enabled
• Review CloudWatch alerts

• Rotate secrets quarterly
• Review security group rules monthly
• Audit user access monthly
• Apply security patches weekly
• Renew SSL certificates (auto)

1. Detect: CloudWatch alert or manual detection
2. Contain: Revoke compromised credentials immediately
3. Investigate: Review logs for scope of breach
4. Remediate: Patch vulnerability, rotate all secrets
5. Recover: Restore from backup if needed
6. Document: Post-incident report

• Security Lead: [security@localstore.ai]
• AWS Support: Via AWS Console
• CloudFlare: Via Dashboard

• No specific data residency requirements for MVP
• VNPay/MoMo integration requires secure webhooks
• Customer data encrypted at rest and in transit

• No credit card data stored
• Payment processing via VNPay/MoMo (PCI compliant)
• Webhook payloads logged without sensitive data

• DEPLOYMENT.md - Deployment guide
• MONITORING.md - Monitoring setup
• ../SPEC_LINKS.md - Specification references