Security - Authentication, ACL & TLS

# === Basit şifre (Redis 5 ve öncesi uyumlu) ===
# redis.conf
requirepass MyStr0ngP@ssw0rd!2026

# Runtime'da değiştir (restart'a kadar)
CONFIG SET requirepass "NewP@ssw0rd"

# Bağlantı
redis-cli -a MyStr0ngP@ssw0rd!2026
# veya bağlandıktan sonra:
AUTH MyStr0ngP@ssw0rd!2026

# === ACL (Redis 6+ — ÖNERİLEN) ===
# Varsayılan kullanıcıya şifre ata
ACL SETUSER default on >MyStr0ngP@ssw0rd!2026

# Uygulama için read-only kullanıcı
ACL SETUSER app-cache-reader on >CacheR3ad0nly! ~cache:* ~product:* &* +@read +ping +info

# Uygulama için yazma yetkili kullanıcı
ACL SETUSER app-writer on >Wr1t3rP@ss! ~* &* +@all -@dangerous -@admin

# Admin kullanıcı (ops team)
ACL SETUSER ops-admin on >0psAdm1n!Str0ng ~* &* +@all

# Sadece pub/sub yetkisi
ACL SETUSER event-publisher on >PubP@ss! resetchannels &events:* +publish +subscribe +ping

# Kullanıcı listesi
ACL LIST
ACL WHOAMI
ACL GETUSER app-writer
ACL CAT                    # tüm komut kategorileri
ACL CAT dangerous          # dangerous kategorisindeki komutlar

# ACL'i dosyaya kaydet (restart'ta korunur)
ACL SAVE
# /etc/redis/users.acl dosyası

# Dangerous komutları tamamen kapat
rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command CONFIG ""
rename-command KEYS ""
rename-command DEBUG ""
rename-command SHUTDOWN ""

# === TLS/SSL ===
# redis.conf
port 0                              # plaintext kapat
tls-port 6380
tls-cert-file /tls/redis.crt
tls-key-file /tls/redis.key
tls-ca-cert-file /tls/ca.crt
tls-auth-clients optional           # client cert opsiyonel
tls-protocols "TLSv1.2 TLSv1.3"

# Test
redis-cli --tls --cert /tls/client.crt --key /tls/client.key -p 6380 PING

// === Basit şifre ===
var config = ConfigurationOptions.Parse("redis:6379");
config.Password = builder.Configuration["Redis:Password"];

// Connection string formatı
// "redis:6379,password=MyStr0ngP@ssw0rd!2026,abortConnect=false"

// === ACL kullanıcı adı + şifre (Redis 6+) ===
var config = new ConfigurationOptions
{
    EndPoints = { "redis:6379" },
    User = "app-writer",           // ACL username
    Password = "Wr1t3rP@ss!",     // ACL password  
    AbortOnConnectFail = false,
    ClientName = "myapp-api-v2"
};

// === TLS bağlantı ===
var config = new ConfigurationOptions
{
    EndPoints = { "redis:6380" },
    User = "app-writer",
    Password = builder.Configuration["Redis:Password"],
    Ssl = true,
    SslProtocols = System.Security.Authentication.SslProtocols.Tls13,
    AbortOnConnectFail = false
};

// Client certificate (mTLS) — event subscription initializer dışında yapılır
config.CertificateSelection += (sender, targetHost, localCerts, remoteCert, acceptableIssuers) =>
    new X509Certificate2("/tls/client.pfx", "cert-password");

builder.Services.AddSingleton<IConnectionMultiplexer>(
    ConnectionMultiplexer.Connect(config));

// === Secret yönetimi (production) ===
// appsettings.Production.json — ASLA düz şifre koyma!
// Azure Key Vault / AWS Secrets Manager / HashiCorp Vault kullan
builder.Configuration.AddAzureKeyVault(
    new Uri("https://myvault.vault.azure.net/"),
    new DefaultAzureCredential());

var redisPassword = builder.Configuration["Redis:Password"]; // vault'tan gelir

// === Ortam bazlı güvenlik ===
public static ConfigurationOptions BuildRedisConfig(IConfiguration config, IHostEnvironment env)
{
    var options = new ConfigurationOptions
    {
        AbortOnConnectFail = false,
        ConnectRetry = 3,
        ConnectTimeout = 5000,
        SyncTimeout = 3000,
        AsyncTimeout = 3000
    };

    if (env.IsDevelopment())
    {
        options.EndPoints.Add("localhost:6379");
        // Dev'de şifre opsiyonel
    }
    else
    {
        options.EndPoints.Add(config["Redis:Host"] ?? "redis:6380");
        options.User = config["Redis:User"] ?? "app-writer";
        options.Password = config["Redis:Password"];
        options.Ssl = true;
        options.SslProtocols = SslProtocols.Tls13;
        options.ClientName = $"myapp-{Environment.MachineName}";
    }

    return options;
}

# redis.conf — production template
bind 10.0.1.50                    # sadece private IP
protected-mode yes
port 0
tls-port 6380
requirepass ""                     # ACL kullanıyorsan boş bırak
maxmemory 4gb
maxmemory-policy allkeys-lru
timeout 300
tcp-keepalive 60
maxclients 10000

# Persistence
appendonly yes
aof-use-rdb-preamble yes
save 3600 1 300 100

# Logging
loglevel notice
logfile /var/log/redis/redis.log

# Slow query log
slowlog-log-slower-than 10000      # 10ms
slowlog-max-len 128

// Production-ready connection
var config = new ConfigurationOptions
{
    EndPoints = { "redis-primary:6380" },
    User = "app-writer",
    Password = builder.Configuration["Redis:Password"],
    Ssl = true,
    SslProtocols = SslProtocols.Tls13,
    AbortOnConnectFail = false,
    ConnectRetry = 3,
    ConnectTimeout = 5000,
    SyncTimeout = 3000,
    AsyncTimeout = 3000,
    ReconnectRetryPolicy = new ExponentialRetry(5000),
    DefaultDatabase = 0,
    ClientName = $"myapp-{Environment.MachineName}",
    // Sentinel
    // ServiceName = "mymaster",
    // EndPoints = { "sentinel1:26379", "sentinel2:26379", "sentinel3:26379" }
};

builder.Services.AddSingleton<IConnectionMultiplexer>(
    ConnectionMultiplexer.Connect(config));

// appsettings.Production.json
{
  "Redis": {
    "Host": "redis-primary:6380",
    "User": "app-writer",
    "Password": "— Azure Key Vault / AWS Secrets Manager —"
  },
  "ConnectionStrings": {
    "Redis": "redis-primary:6380,user=app-writer,password=***,ssl=true,abortConnect=false"
  }
}