@ebowwa/hetzner 0.2.1 → 0.3.0

package/dist/bootstrap/index.js

@@ -0,0 +1,1126 @@
+// src/bootstrap/ssh-hardening.ts
+function sshdHardeningPackages() {
+  return [
+    "  - fail2ban"
+  ];
+}
+function sshdHardeningWriteFiles() {
+  const lines = [];
+  lines.push("  # Hardened SSH configuration");
+  lines.push("  - path: /etc/ssh/sshd_config.d/hardened.conf");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      # Hardened SSH config - applied via cloud-init");
+  lines.push("      PasswordAuthentication no");
+  lines.push("      PermitEmptyPasswords no");
+  lines.push("      KbdInteractiveAuthentication no");
+  lines.push("      PermitRootLogin prohibit-password");
+  lines.push("      LoginGraceTime 30");
+  lines.push("      MaxStartups 20:50:60");
+  lines.push("      ClientAliveInterval 30");
+  lines.push("      ClientAliveCountMax 3");
+  lines.push("      MaxAuthTries 3");
+  lines.push("");
+  lines.push("  # fail2ban SSH jail configuration");
+  lines.push("  - path: /etc/fail2ban/jail.local");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      [sshd]");
+  lines.push("      enabled = true");
+  lines.push("      port = ssh");
+  lines.push("      backend = systemd");
+  lines.push("      maxretry = 3");
+  lines.push("      findtime = 600");
+  lines.push("      bantime = 3600");
+  lines.push("      banaction = nftables-multiport");
+  lines.push("");
+  lines.push("  # sshd health monitoring script");
+  lines.push("  - path: /opt/monitoring/sshd-health.sh");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0755'");
+  lines.push("    content: |");
+  lines.push("      #!/bin/bash");
+  lines.push("      set -euo pipefail");
+  lines.push('      LOGFILE="/var/log/sshd-health.json"');
+  lines.push('      sshd_active=$(systemctl is-active ssh 2>/dev/null || echo "inactive")');
+  lines.push('      sshd_pid=$(pgrep -x sshd | head -1 || echo "0")');
+  lines.push('      f2b_active=$(systemctl is-active fail2ban 2>/dev/null || echo "inactive")');
+  lines.push(`      f2b_banned=$(fail2ban-client status sshd 2>/dev/null | grep "Currently banned" | awk '{print $NF}' || echo "0")`);
+  lines.push(`      f2b_total=$(fail2ban-client status sshd 2>/dev/null | grep "Total banned" | awk '{print $NF}' || echo "0")`);
+  lines.push('      failed_1h=$(journalctl -u ssh --since "1 hour ago" --no-pager 2>/dev/null | grep -c "Failed" || true)');
+  lines.push('      failed_24h=$(journalctl -u ssh --since "24 hours ago" --no-pager 2>/dev/null | grep -c "Failed" || true)');
+  lines.push('      active_connections=$(ss -tnp | grep -c ":22 " || echo "0")');
+  lines.push("      uptime_seconds=$(awk '{print int($1)}' /proc/uptime)");
+  lines.push("      load=$(awk '{print $1}' /proc/loadavg)");
+  lines.push(`      mem_used_pct=$(free | awk '/Mem:/{printf "%.1f", $3/$2*100}')`);
+  lines.push("      timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)");
+  lines.push('      cat > "$LOGFILE" <<HEALTHEOF');
+  lines.push("      {");
+  lines.push('        "timestamp": "$timestamp",');
+  lines.push('        "sshd": { "active": "$sshd_active", "pid": $sshd_pid },');
+  lines.push('        "fail2ban": { "active": "$f2b_active", "currently_banned": $f2b_banned, "total_banned": $f2b_total },');
+  lines.push('        "connections": { "active": $active_connections, "failed_1h": $failed_1h, "failed_24h": $failed_24h },');
+  lines.push('        "system": { "uptime_seconds": $uptime_seconds, "load": $load, "memory_used_pct": $mem_used_pct }');
+  lines.push("      }");
+  lines.push("      HEALTHEOF");
+  lines.push('      if [ "$sshd_active" != "active" ]; then');
+  lines.push('        logger -t sshd-health -p auth.crit "ALERT: sshd is $sshd_active"');
+  lines.push('        systemctl start ssh 2>/dev/null || logger -t sshd-health -p auth.crit "FAILED to restart sshd"');
+  lines.push("      fi");
+  lines.push("");
+  lines.push("  # sshd health check systemd service");
+  lines.push("  - path: /etc/systemd/system/sshd-health.service");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      [Unit]");
+  lines.push("      Description=sshd health check");
+  lines.push("      After=ssh.service");
+  lines.push("      [Service]");
+  lines.push("      Type=oneshot");
+  lines.push("      ExecStart=/opt/monitoring/sshd-health.sh");
+  lines.push("");
+  lines.push("  # sshd health check timer (every 60s)");
+  lines.push("  - path: /etc/systemd/system/sshd-health.timer");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      [Unit]");
+  lines.push("      Description=Run sshd health check every minute");
+  lines.push("      [Timer]");
+  lines.push("      OnBootSec=30");
+  lines.push("      OnUnitActiveSec=60");
+  lines.push("      [Install]");
+  lines.push("      WantedBy=timers.target");
+  lines.push("");
+  return lines;
+}
+function sshdHardeningRunCmd() {
+  const lines = [];
+  lines.push("  # SSH hardening: reload sshd, enable fail2ban and health monitoring");
+  lines.push("  - mkdir -p /opt/monitoring");
+  lines.push("  - systemctl reload ssh || systemctl restart ssh");
+  lines.push("  - systemctl enable --now fail2ban");
+  lines.push("  - systemctl daemon-reload");
+  lines.push("  - systemctl enable --now sshd-health.timer");
+  lines.push("");
+  return lines;
+}
+
+// src/bootstrap/firewall.ts
+var DEFAULT_UFW_GENESIS_OPTIONS = {
+  allowSSHFrom: [],
+  allowHTTP: true,
+  allowHTTPS: true,
+  allowNodeAgent: false,
+  verboseLogging: false
+};
+var DEFAULT_UFW_WORKER_OPTIONS = {
+  allowSSHFrom: [],
+  allowHTTP: false,
+  allowHTTPS: false,
+  allowNodeAgent: true,
+  verboseLogging: false
+};
+function ufwFirewallPackages() {
+  return [
+    "  - ufw"
+  ];
+}
+function ufwFirewallWriteFiles(options = {}) {
+  const lines = [];
+  lines.push("  # UFW before.rules - stateful firewall and network security");
+  lines.push("  - path: /etc/ufw/before.rules");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      #");
+  lines.push("      # UFW before.rules - applied before UFW rules");
+  lines.push("      #");
+  lines.push("      # Start with the standard configuration");
+  lines.push("      *filter");
+  lines.push("      :ufw-before-input - [0:0]");
+  lines.push("      :ufw-before-output - [0:0]");
+  lines.push("      :ufw-before-forward - [0:0]");
+  lines.push("      :ufw-not-local - [0:0]");
+  lines.push("      # End of lines to adjust");
+  lines.push("");
+  lines.push("      # Allow all on loopback");
+  lines.push("      -A ufw-before-input -i lo -j ACCEPT");
+  lines.push("      -A ufw-before-output -o lo -j ACCEPT");
+  lines.push("");
+  lines.push("      # Drop invalid packets");
+  lines.push("      -A ufw-before-input -m conntrack --ctstate INVALID -j DROP");
+  lines.push("");
+  lines.push("      # Allow established and related connections");
+  lines.push("      -A ufw-before-input -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT");
+  lines.push("      -A ufw-before-output -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT");
+  lines.push("");
+  lines.push("      # Allow ICMP messages (required for PMTU discovery)");
+  lines.push("      -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT");
+  lines.push("      -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT");
+  lines.push("      -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT");
+  lines.push("      -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT");
+  lines.push("");
+  lines.push("      # Drop packets with bogus TCP flags (potential scan)");
+  lines.push("      -A ufw-before-input -p tcp --tcp-flags ALL NONE -j DROP");
+  lines.push("      -A ufw-before-input -p tcp --tcp-flags ALL ALL -j DROP");
+  lines.push("");
+  lines.push("      # Commit changes");
+  lines.push("      COMMIT");
+  lines.push("");
+  lines.push("  # UFW sysctl.conf - kernel network hardening");
+  lines.push("  - path: /etc/ufw/sysctl.conf");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      #");
+  lines.push("      # UFW sysctl.conf - kernel network security parameters");
+  lines.push("      #");
+  lines.push("");
+  lines.push("      # IP spoofing protection");
+  lines.push("      net/ipv4/conf/all/rp_filter=1");
+  lines.push("      net/ipv4/conf/default/rp_filter=1");
+  lines.push("");
+  lines.push("      # Ignore ICMP redirect messages");
+  lines.push("      net/ipv4/conf/all/accept_redirects=0");
+  lines.push("      net/ipv6/conf/all/accept_redirects=0");
+  lines.push("      net/ipv4/conf/default/accept_redirects=0");
+  lines.push("      net/ipv6/conf/default/accept_redirects=0");
+  lines.push("");
+  lines.push("      # Ignore send redirects");
+  lines.push("      net/ipv4/conf/all/send_redirects=0");
+  lines.push("      net/ipv4/conf/default/send_redirects=0");
+  lines.push("");
+  lines.push("      # Log martian packets (packets with impossible addresses)");
+  lines.push("      net/ipv4/conf/all/log_martians=1");
+  lines.push("      net/ipv4/conf/default/log_martians=1");
+  lines.push("");
+  lines.push("      # SYN cookies protection (SYN flood mitigation)");
+  lines.push("      net/ipv4/tcp_syncookies=1");
+  lines.push("");
+  lines.push("      # Source address verification (spoofing protection)");
+  lines.push("      net/ipv4/conf/all/secure_redirects=1");
+  lines.push("      net/ipv4/conf/default/secure_redirects=1");
+  lines.push("");
+  return lines;
+}
+function ufwFirewallRunCmd(options = {}) {
+  const {
+    allowSSHFrom = [],
+    allowHTTP = true,
+    allowHTTPS = true,
+    allowNodeAgent = false,
+    additionalPorts = [],
+    verboseLogging = false
+  } = options;
+  const lines = [];
+  lines.push("  # UFW Firewall: Configure and enable secure firewall");
+  lines.push("");
+  lines.push("  # Set default policies: deny incoming, allow outgoing");
+  lines.push("  - ufw --force reset");
+  lines.push("  - ufw default deny incoming");
+  lines.push("  - ufw default allow outgoing");
+  lines.push("  - ufw default deny forwarded");
+  lines.push("");
+  lines.push("  # Allow loopback interface");
+  lines.push("  - ufw allow in on lo");
+  lines.push("");
+  if (allowSSHFrom.length === 0) {
+    lines.push("  # Allow SSH with rate limiting (6 connections in 30 seconds)");
+    lines.push("  - ufw limit 22/tcp comment 'Rate-limited SSH'");
+  } else {
+    for (const source of allowSSHFrom) {
+      lines.push(`  - ufw allow from ${source} to any port 22 proto tcp comment 'SSH from ${source}'`);
+    }
+  }
+  lines.push("");
+  if (allowHTTP) {
+    lines.push("  # Allow HTTP");
+    lines.push("  - ufw allow 80/tcp comment 'HTTP'");
+  }
+  if (allowHTTPS) {
+    lines.push("  # Allow HTTPS");
+    lines.push("  - ufw allow 443/tcp comment 'HTTPS'");
+  }
+  lines.push("");
+  if (allowNodeAgent) {
+    lines.push("  # Allow Node Agent (internal communication)");
+    lines.push("  - ufw allow 8911/tcp comment 'Node Agent'");
+    lines.push("");
+  }
+  lines.push("  # Allow Tailscale VPN");
+  lines.push("  - ufw allow 41641/udp comment 'Tailscale'");
+  lines.push("");
+  if (additionalPorts.length > 0) {
+    lines.push("  # Additional custom ports");
+    for (const portConfig of additionalPorts) {
+      const protocol = portConfig.protocol || "tcp";
+      const comment = portConfig.comment || `Custom port ${portConfig.port}`;
+      lines.push(`  - ufw allow ${portConfig.port}/${protocol} comment '${comment}'`);
+    }
+    lines.push("");
+  }
+  if (verboseLogging) {
+    lines.push("  # Enable verbose logging");
+    lines.push("  - ufw logging on");
+    lines.push("  - ufw logging high");
+  } else {
+    lines.push("  # Enable rate-limited logging (prevent log flooding)");
+    lines.push("  - ufw logging on");
+    lines.push("  - ufw logging low");
+  }
+  lines.push("");
+  lines.push("  # Enable and reload UFW");
+  lines.push("  - ufw --force enable");
+  lines.push("  - ufw reload");
+  lines.push("");
+  lines.push("  # Display firewall status");
+  lines.push("  - ufw status verbose > /var/log/ufw-bootstrap-status.log");
+  lines.push("");
+  return lines;
+}
+function generateUFWFirewallForGenesis(options = DEFAULT_UFW_GENESIS_OPTIONS) {
+  return {
+    packages: ufwFirewallPackages(),
+    writeFiles: ufwFirewallWriteFiles(options),
+    runCmd: ufwFirewallRunCmd(options)
+  };
+}
+function generateUFWFirewallForWorker(options = DEFAULT_UFW_WORKER_OPTIONS) {
+  return {
+    packages: ufwFirewallPackages(),
+    writeFiles: ufwFirewallWriteFiles(options),
+    runCmd: ufwFirewallRunCmd(options)
+  };
+}
+
+// src/bootstrap/kernel-hardening.ts
+function kernelHardeningPackages() {
+  return [];
+}
+function kernelHardeningWriteFiles() {
+  const lines = [];
+  lines.push("  # Kernel hardening: sysctl.d configuration for 2026 best practices");
+  lines.push("  # This file persists across reboots and overrides /etc/sysctl.conf");
+  lines.push("  - path: /etc/sysctl.d/99-security-hardening.conf");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      # =================================================================");
+  lines.push("      # Kernel Security Hardening Configuration");
+  lines.push("      # =================================================================");
+  lines.push("      # Applied via cloud-init for com.hetzner.codespaces");
+  lines.push("      # Version: 1.0.0 (2026 best practices)");
+  lines.push("      #");
+  lines.push("      # This configuration follows CIS Benchmark and NIST guidelines");
+  lines.push("      # See: /usr/share/doc/linux-doc/sysctl/ for parameter documentation");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 1. IP SPOOFING PROTECTION");
+  lines.push("      # =================================================================");
+  lines.push("      # Enable reverse path filtering (validates source addresses)");
+  lines.push("      # Prevents IP spoofing attacks by dropping packets with invalid sources");
+  lines.push("      net.ipv4.conf.all.rp_filter = 1");
+  lines.push("      net.ipv4.conf.default.rp_filter = 1");
+  lines.push("");
+  lines.push("      # Log martian packets (packets with impossible addresses)");
+  lines.push("      # Helps detect spoofing attempts and network misconfigurations");
+  lines.push("      net.ipv4.conf.all.log_martians = 1");
+  lines.push("");
+  lines.push("      # Disable ICMP redirect acceptance (prevent MITM attacks)");
+  lines.push("      net.ipv4.conf.all.accept_redirects = 0");
+  lines.push("      net.ipv4.conf.default.accept_redirects = 0");
+  lines.push("      net.ipv4.conf.all.secure_redirects = 0");
+  lines.push("      net.ipv4.conf.default.secure_redirects = 0");
+  lines.push("");
+  lines.push("      # Disable sending ICMP redirects");
+  lines.push("      net.ipv4.conf.all.send_redirects = 0");
+  lines.push("      net.ipv4.conf.default.send_redirects = 0");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 2. SYN FLOOD PROTECTION");
+  lines.push("      # =================================================================");
+  lines.push("      # Enable SYN cookies (protects against SYN flood attacks)");
+  lines.push("      # Allows server to continue accepting connections under SYN flood");
+  lines.push("      net.ipv4.tcp_syncookies = 1");
+  lines.push("");
+  lines.push("      # Reuse TIME_WAIT sockets for new connections (safer, faster)");
+  lines.push("      # Reduces connection table exhaustion under high load");
+  lines.push("      net.ipv4.tcp_tw_reuse = 1");
+  lines.push("");
+  lines.push("      # Reduce SYN backlog and timeouts for faster detection");
+  lines.push("      net.ipv4.tcp_max_syn_backlog = 2048");
+  lines.push("      net.ipv4.tcp_synack_retries = 2");
+  lines.push("      net.ipv4.tcp_syn_retries = 5");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 3. NETWORK STACK HARDENING");
+  lines.push("      # =================================================================");
+  lines.push("      # Disable ICMP redirect acceptance (IPv6)");
+  lines.push("      net.ipv6.conf.all.accept_redirects = 0");
+  lines.push("      net.ipv6.conf.default.accept_redirects = 0");
+  lines.push("");
+  lines.push("      # Ignore ICMP broadcasts (prevent smurf attacks)");
+  lines.push("      net.ipv4.icmp_echo_ignore_broadcasts = 1");
+  lines.push("");
+  lines.push("      # Ignore bogus ICMP error responses (prevent ICMP attacks)");
+  lines.push("      net.ipv4.icmp_ignore_bogus_error_responses = 1");
+  lines.push("");
+  lines.push("      # Enable TCP timestamps (RFC 1323) for better sequence handling");
+  lines.push("      # Also protects against wrapped sequence number attacks");
+  lines.push("      net.ipv4.tcp_timestamps = 1");
+  lines.push("");
+  lines.push("      # Enable TCP selective acknowledgments (better performance)");
+  lines.push("      net.ipv4.tcp_sack = 1");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 4. CORE DUMP RESTRICTIONS");
+  lines.push("      # =================================================================");
+  lines.push("      # Disable core dumps for setuid programs (prevent privilege escalation)");
+  lines.push("      fs.suid_dumpable = 0");
+  lines.push("");
+  lines.push("      # Limit core dump size to 0 (disable core dumps)");
+  lines.push("      # Override in /etc/security/limits.conf if needed for debugging");
+  lines.push("      kernel.core_pattern = |/bin/false");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 5. MEMORY PROTECTION (ASLR)");
+  lines.push("      # =================================================================");
+  lines.push("      # Enable Address Space Layout Randomization (full)");
+  lines.push("      # Makes exploitation of memory corruption vulnerabilities harder");
+  lines.push("      # 0: Disabled, 1: Conservative, 2: Full (default)");
+  lines.push("      kernel.randomize_va_space = 2");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 6. FILESYSTEM PROTECTION");
+  lines.push("      # =================================================================");
+  lines.push("      # Hard link/symlink protection (prevent time-of-check time-of-use)");
+  lines.push("      fs.protected_hardlinks = 1");
+  lines.push("      fs.protected_symlinks = 1");
+  lines.push("");
+  lines.push("      # FIFO protection (prevent FIFO attacks on world-writable directories)");
+  lines.push("      fs.protected_fifos = 2");
+  lines.push("");
+  lines.push("      # Regular file protection (prevent file overwrite attacks)");
+  lines.push("      fs.protected_regular = 2");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 7. NETWORK BEHAVIOR TUNING");
+  lines.push("      # =================================================================");
+  lines.push("      # Enable TCP Fast Open (TFO) for reduced latency");
+  lines.push("      net.ipv4.tcp_fastopen = 3");
+  lines.push("");
+  lines.push("      # Disable source routing (prevent packet routing manipulation)");
+  lines.push("      net.ipv4.conf.all.accept_source_route = 0");
+  lines.push("      net.ipv4.conf.default.accept_source_route = 0");
+  lines.push("      net.ipv6.conf.all.accept_source_route = 0");
+  lines.push("      net.ipv6.conf.default.accept_source_route = 0");
+  lines.push("");
+  lines.push("      # Enable TCP window scaling (RFC 7323) for high-bandwidth links");
+  lines.push("      net.ipv4.tcp_window_scaling = 1");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 8. SECURITY-RELATED KERNEL PARAMETERS");
+  lines.push("      # =================================================================");
+  lines.push("      # Disable magic sysrq key (prevent console-based attacks)");
+  lines.push("      # 0: Disabled, 1: Enable (for debugging only)");
+  lines.push("      kernel.sysrq = 0");
+  lines.push("");
+  lines.push("      # Disable kexec system call (prevent kernel replacement)");
+  lines.push("      # 0: Disabled, 1: Enabled");
+  lines.push("      kernel.kexec_load = 0");
+  lines.push("");
+  lines.push("      # Disable user namespaces (prevent container breakouts)");
+  lines.push("      # 0: Disabled, 1: Enabled");
+  lines.push("      user.max_user_namespaces = 0");
+  lines.push("");
+  lines.push("      # Enable unprivileged bpf disabled (prevent eBPF-based exploits)");
+  lines.push("      # 0: Disabled, 1: Enabled");
+  lines.push("      kernel.unprivileged_bpf_disabled = 1");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 9. ADDITIONAL HARDENING (2026)");
+  lines.push("      # =================================================================");
+  lines.push("      # Disable IPv6 if not needed (uncomment if IPv6 is disabled)");
+  lines.push("      # net.ipv6.conf.all.disable_ipv6 = 1");
+  lines.push("      # net.ipv6.conf.default.disable_ipv6 = 1");
+  lines.push("");
+  lines.push("      # Enable dmesg restriction (prevent kernel info leaks)");
+  lines.push("      kernel.dmesg_restrict = 1");
+  lines.push("");
+  lines.push("      # Restrict ptrace scope (prevent process tracing by non-parent)");
+  lines.push("      # 0: Traditional, 1: Restricted, 2: Admin-only, 3: No attach");
+  lines.push("      kernel.yama.ptrace_scope = 2");
+  lines.push("");
+  lines.push("      # =================================================================");
+  lines.push("      # 10. PERFORMANCE TUNING (safe defaults)");
+  lines.push("      # =================================================================");
+  lines.push("      # Increase connection tracking table size (for stateful firewalls)");
+  lines.push("      net.netfilter.nf_conntrack_max = 262144");
+  lines.push("");
+  lines.push("      # Reduce TCP keepalive timeouts for faster dead peer detection");
+  lines.push("      net.ipv4.tcp_keepalive_time = 600");
+  lines.push("      net.ipv4.tcp_keepalive_intvl = 30");
+  lines.push("      net.ipv4.tcp_keepalive_probes = 3");
+  lines.push("");
+  return lines;
+}
+function kernelHardeningRunCmd() {
+  const lines = [];
+  lines.push("  # Kernel hardening: apply sysctl settings immediately");
+  lines.push("  # Settings are already in /etc/sysctl.d/99-security-hardening.conf");
+  lines.push("");
+  lines.push("  # Apply all sysctl settings (overrides defaults immediately)");
+  lines.push("  - sysctl --system");
+  lines.push("");
+  lines.push("  # Log applied settings for audit trail");
+  lines.push("  - sysctl -a | grep -E '(rp_filter|syncookies|randomize_va|suid_dump)' > /var/log/kernel-hardening.log 2>&1 || true");
+  lines.push("");
+  lines.push("  # Display summary of critical hardening settings");
+  lines.push("  - |");
+  lines.push("    echo '========================================'");
+  lines.push("    echo 'Kernel Hardening Applied (2026)'");
+  lines.push("    echo '========================================'");
+  lines.push("    echo 'IP Spoof Protection:    '$(sysctl -n net.ipv4.conf.all.rp_filter)");
+  lines.push("    echo 'SYN Cookies:            '$(sysctl -n net.ipv4.tcp_syncookies)");
+  lines.push("    echo 'ASLR Level:             '$(sysctl -n kernel.randomize_va_space)");
+  lines.push("    echo 'SUID Core Dumps:        '$(sysctl -n fs.suid_dumpable)");
+  lines.push("    echo 'Hard Links Protected:   '$(sysctl -n fs.protected_hardlinks)");
+  lines.push("    echo 'Ptrace Scope:           '$(sysctl -n kernel.yama.ptrace_scope)");
+  lines.push("    echo '========================================'");
+  lines.push("");
+  return lines;
+}
+
+// src/bootstrap/security-audit.ts
+function securityAuditPackages() {
+  return [
+    "  - lynis"
+  ];
+}
+function securityAuditWriteFiles() {
+  const lines = [];
+  lines.push("  # Security audit script - runs after all hardening");
+  lines.push("  - path: /opt/monitoring/security-audit.sh");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0755'");
+  lines.push("    content: |");
+  lines.push("      #!/bin/bash");
+  lines.push("      set -euo pipefail");
+  lines.push('      LOGFILE="/var/log/security-audit.log"');
+  lines.push('      REPORTFILE="/var/log/security-audit.json"');
+  lines.push('      echo "Security Audit started at $(date -Iseconds)" | tee "$LOGFILE"');
+  lines.push("");
+  lines.push("      # Firewall status");
+  lines.push('      echo "" | tee -a "$LOGFILE"');
+  lines.push('      echo "=== UFW Firewall Status ===" | tee -a "$LOGFILE"');
+  lines.push('      ufw status verbose | tee -a "$LOGFILE" || true');
+  lines.push("");
+  lines.push("      # Fail2ban status");
+  lines.push('      echo "" | tee -a "$LOGFILE"');
+  lines.push('      echo "=== Fail2ban Status ===" | tee -a "$LOGFILE"');
+  lines.push('      systemctl status fail2ban --no-pager | tee -a "$LOGFILE" || true');
+  lines.push('      fail2ban-client status sshd | tee -a "$LOGFILE" || true');
+  lines.push("");
+  lines.push("      # SSHd status");
+  lines.push('      echo "" | tee -a "$LOGFILE"');
+  lines.push('      echo "=== SSHd Status ===" | tee -a "$LOGFILE"');
+  lines.push('      systemctl status ssh --no-pager | tee -a "$LOGFILE" || true');
+  lines.push(`      sshd -T | grep -E '(PasswordAuthentication|PermitRootLogin|MaxStartups)' | tee -a "$LOGFILE" || true`);
+  lines.push("");
+  lines.push("      # Kernel hardening status");
+  lines.push('      echo "" | tee -a "$LOGFILE"');
+  lines.push('      echo "=== Kernel Hardening Status ===" | tee -a "$LOGFILE"');
+  lines.push('      sysctl randomize_va_space kptr_restrict tcp_syncookies | tee -a "$LOGFILE" || true');
+  lines.push("");
+  lines.push("      # Lynis audit (warnings only, non-interactive)");
+  lines.push('      echo "" | tee -a "$LOGFILE"');
+  lines.push('      echo "=== Lynis Security Audit ===" | tee -a "$LOGFILE"');
+  lines.push('      lynis audit system --warnings-only --quiet 2>&1 | tee -a "$LOGFILE" || true');
+  lines.push("");
+  lines.push("      # Generate JSON report");
+  lines.push("      timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)");
+  lines.push('      ufw_active=$(ufw status | grep -c "Status: active" || echo "0")');
+  lines.push('      fail2ban_active=$(systemctl is-active fail2ban 2>/dev/null || echo "inactive")');
+  lines.push('      sshd_active=$(systemctl is-active ssh 2>/dev/null || echo "inactive")');
+  lines.push('      aslr_enabled=$(cat /proc/sys/kernel/randomize_va_space 2>/dev/null || echo "0")');
+  lines.push('      cat > "$REPORTFILE" <<AUDEOF');
+  lines.push("      {");
+  lines.push('        "timestamp": "$timestamp",');
+  lines.push('        "firewall": { "active": $ufw_active },');
+  lines.push('        "fail2ban": { "active": "$fail2ban_active" },');
+  lines.push('        "sshd": { "active": "$sshd_active" },');
+  lines.push('        "kernel_hardening": { "aslr_enabled": $aslr_enabled }');
+  lines.push("      }");
+  lines.push("      AUDEOF");
+  lines.push('      echo "Security Audit completed at $(date -Iseconds)" | tee -a "$LOGFILE"');
+  lines.push('      echo "Report saved to $REPORTFILE" | tee -a "$LOGFILE"');
+  lines.push("");
+  return lines;
+}
+function securityAuditRunCmd() {
+  const lines = [];
+  lines.push("  # Security audit: run comprehensive security check");
+  lines.push("  - mkdir -p /opt/monitoring");
+  lines.push("  - /opt/monitoring/security-audit.sh");
+  lines.push('  - echo "Security audit completed at $(date -Iseconds)" | tee -a /root/.bootstrap-status');
+  lines.push("");
+  return lines;
+}
+
+// src/bootstrap/genesis.ts
+function generateGenesisBootstrap(options) {
+  const {
+    adminSSHKey,
+    genesisRepo = "https://github.com/ebowwa/com.hetzner.codespaces",
+    genesisBranch = "main",
+    hostname = "genesis",
+    defaultServerType = "cpx11",
+    defaultLocation = "fsn1",
+    maxWorkers = "10",
+    packages = [],
+    additionalCommands = [],
+    enableSecurity = true
+  } = options;
+  if (!adminSSHKey) {
+    throw new Error("adminSSHKey is required for Genesis bootstrap");
+  }
+  const lines = [];
+  lines.push("#cloud-config");
+  lines.push("# Genesis Server Bootstrap Configuration");
+  lines.push("# Version: 1.0.0");
+  lines.push("");
+  lines.push("# This cloud-init config bootstraps a Genesis server that:");
+  lines.push("# - Runs com.hetzner.codespaces web application");
+  lines.push("# - Uses the existing Hetzner API to create any server");
+  lines.push("# - Can be ephemeral and recreated at any time");
+  lines.push("");
+  lines.push("# IMPORTANT: Never store secrets in cloud-init! Use Vault/SOPS/external sources.");
+  lines.push("");
+  lines.push("# =====================================================");
+  lines.push("# STAGE 1: Network & Early Setup (Network stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push(`hostname: ${hostname}`);
+  lines.push("manage_etc_hosts: true");
+  lines.push("timezone: UTC");
+  lines.push("");
+  lines.push("# =====================================================");
+  lines.push("# STAGE 2: SSH & Security (Network stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push("ssh_pwauth: false");
+  lines.push("");
+  lines.push("# Create genesis service user");
+  lines.push("users:");
+  lines.push("  - name: genesis");
+  lines.push("    gecos: Genesis Service Account");
+  lines.push("    primary_group: genesis");
+  lines.push("    groups: docker,wheel");
+  lines.push("    sudo: ALL=(ALL) NOPASSWD:ALL");
+  lines.push("    shell: /bin/bash");
+  lines.push("    lock_passwd: true");
+  lines.push("    ssh_authorized_keys:");
+  lines.push(`      - ${adminSSHKey}`);
+  lines.push("");
+  lines.push("# =====================================================");
+  lines.push("# STAGE 3: Package Management (Config stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push("package_update: true");
+  lines.push("package_upgrade: false");
+  lines.push("package_reboot_if_required: true");
+  lines.push("");
+  lines.push("packages:");
+  lines.push("  - curl");
+  lines.push("  - wget");
+  lines.push("  - git");
+  lines.push("  - unzip");
+  lines.push("  - jq");
+  lines.push("  - build-essential");
+  if (enableSecurity) {
+    lines.push("  # Security: UFW Firewall");
+    lines.push(...ufwFirewallPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: Kernel hardening");
+    lines.push(...kernelHardeningPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: SSH hardening");
+    lines.push(...sshdHardeningPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: Security audit");
+    lines.push(...securityAuditPackages());
+  }
+  for (const pkg of packages) {
+    lines.push(`  - ${pkg}`);
+  }
+  lines.push("");
+  lines.push("# =====================================================");
+  lines.push("# STAGE 4: Application Setup (Config stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push("write_files:");
+  lines.push("  # Genesis application directories");
+  lines.push("  - path: /opt/genesis");
+  lines.push("    owner: genesis:genesis");
+  lines.push("    permissions: '0755'");
+  lines.push("");
+  lines.push("  - path: /opt/genesis/data");
+  lines.push("    owner: genesis:genesis");
+  lines.push("    permissions: '0755'");
+  lines.push("");
+  lines.push("  - path: /var/log/genesis");
+  lines.push("    owner: genesis:genesis");
+  lines.push("    permissions: '0755'");
+  lines.push("");
+  lines.push("  # Environment file template (do NOT include actual secrets)");
+  lines.push("  - path: /etc/default/genesis.template");
+  lines.push("    owner: genesis:genesis");
+  lines.push("    permissions: '0640'");
+  lines.push("    content: |");
+  lines.push("      # Genesis Server Environment Configuration");
+  lines.push("      # Copy this to /etc/default/genesis and fill in required values");
+  lines.push("      #");
+  lines.push("      # DO NOT commit actual secrets to version control!");
+  lines.push("");
+  lines.push("      # Application Settings");
+  lines.push("      NODE_ENV=production");
+  lines.push(`      PORT=3000`);
+  lines.push(`      HOST=0.0.0.0`);
+  lines.push("");
+  lines.push("      # Hetzner API (REQUIRED - use Vault or Secrets Manager in production)");
+  lines.push("      # HETZNER_API_TOKEN should be set securely after bootstrap");
+  lines.push("      HETZNER_DEFAULT_TYPE=" + defaultServerType);
+  lines.push("      HETZNER_DEFAULT_LOCATION=" + defaultLocation);
+  lines.push("      MAX_WORKER_NODES=" + maxWorkers);
+  lines.push("");
+  lines.push("  # Genesis systemd service unit");
+  lines.push("  - path: /etc/systemd/system/genesis.service");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      [Unit]");
+  lines.push("      Description=Genesis Application Server (com.hetzner.codespaces)");
+  lines.push("      Documentation=https://github.com/ebowwa/com.hetzner.codespaces");
+  lines.push("      After=network-online.target");
+  lines.push("      Wants=network-online.target");
+  lines.push("");
+  lines.push("      [Service]");
+  lines.push("      Type=simple");
+  lines.push("      User=genesis");
+  lines.push("      Group=genesis");
+  lines.push("      WorkingDirectory=/opt/genesis");
+  lines.push("");
+  lines.push("      # Execution");
+  lines.push("      ExecStart=/usr/bin/bun start");
+  lines.push("      ExecReload=/bin/kill -HUP $MAINPID");
+  lines.push("");
+  lines.push("      # Restart Policy (with rate limiting)");
+  lines.push("      Restart=on-failure");
+  lines.push("      RestartSec=5s");
+  lines.push("      StartLimitIntervalSec=300");
+  lines.push("      StartLimitBurst=5");
+  lines.push("");
+  lines.push("      # Logging");
+  lines.push("      StandardOutput=journal");
+  lines.push("      StandardError=journal");
+  lines.push("      SyslogIdentifier=genesis");
+  lines.push("");
+  lines.push("      # Environment");
+  lines.push('      Environment="NODE_ENV=production"');
+  lines.push("      EnvironmentFile=/etc/default/genesis");
+  lines.push("      EnvironmentFile=-/etc/default/genesis.local");
+  lines.push("");
+  lines.push("      # Resource Limits");
+  lines.push("      LimitNOFILE=65536");
+  lines.push("");
+  if (enableSecurity) {
+    lines.push("      # Security Hardening");
+    lines.push("      NoNewPrivileges=true");
+    lines.push("      PrivateTmp=true");
+    lines.push("      ProtectSystem=strict");
+    lines.push("      ProtectHome=true");
+    lines.push("      ReadWritePaths=/opt/genesis/data /var/log/genesis");
+  } else {
+    lines.push("      # Security Hardening (minimal)");
+    lines.push("      NoNewPrivileges=false");
+    lines.push("      PrivateTmp=false");
+  }
+  lines.push("");
+  lines.push("      [Install]");
+  lines.push("      WantedBy=multi-user.target");
+  lines.push("");
+  lines.push("  # Bootstrap status tracking");
+  lines.push("  - path: /root/.genesis-bootstrap-status");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      status=started");
+  lines.push("      started_at=$(date -Iseconds)");
+  lines.push("      source=cloud-init");
+  lines.push("      version=1.0.0");
+  if (enableSecurity) {
+    lines.push("      security=enabled");
+  }
+  lines.push("");
+  lines.push("  # Add bun to /etc/environment for all users/shells");
+  lines.push('  # Format: Simple KEY="value" pairs, no variable expansion');
+  lines.push("  - path: /etc/environment");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push('      PATH="/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"');
+  lines.push("");
+  if (enableSecurity) {
+    lines.push("  # Security Module 1: UFW Firewall configuration");
+    lines.push(...ufwFirewallWriteFiles(DEFAULT_UFW_GENESIS_OPTIONS));
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 2: Kernel hardening");
+    lines.push(...kernelHardeningWriteFiles());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 3: SSH hardening");
+    lines.push(...sshdHardeningWriteFiles());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 4: Security audit");
+    lines.push(...securityAuditWriteFiles());
+  }
+  lines.push("# =====================================================");
+  lines.push("# STAGE 5: Run Commands (Config stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push("runcmd:");
+  lines.push("  # Install Bun runtime");
+  lines.push("  - curl -fsSL https://bun.sh/install | bash");
+  lines.push("");
+  lines.push("  # Clone/pull genesis application");
+  const cloneCmd = genesisBranch ? `git clone --depth 1 --branch ${genesisBranch} ${genesisRepo} /opt/genesis` : `git clone --depth 1 ${genesisRepo} /opt/genesis`;
+  lines.push(`  - |`);
+  lines.push(`    if [ ! -d /opt/genesis/.git ]; then`);
+  lines.push(`      ${cloneCmd}`);
+  lines.push(`    else`);
+  lines.push(`      cd /opt/genesis && git pull`);
+  lines.push(`    fi`);
+  lines.push("");
+  lines.push("  # Install dependencies");
+  lines.push("  - cd /opt/genesis && bun install");
+  lines.push("");
+  lines.push("  # Build application (if needed)");
+  lines.push("  - cd /opt/genesis && bun run build");
+  lines.push("");
+  lines.push("  # Configure environment (prompt for secrets or use external source)");
+  lines.push("  - |");
+  lines.push(`    echo "WARNING: HETZNER_API_TOKEN must be configured in /etc/default/genesis"`);
+  lines.push("");
+  lines.push("  # Enable and start genesis service");
+  lines.push("  - systemctl daemon-reload");
+  lines.push("  - systemctl enable genesis.service");
+  lines.push("  - systemctl start genesis.service");
+  lines.push("");
+  if (enableSecurity) {
+    lines.push("  # Security Module 1: Activate UFW Firewall");
+    lines.push(...ufwFirewallRunCmd(DEFAULT_UFW_GENESIS_OPTIONS));
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 2: Apply kernel hardening");
+    lines.push(...kernelHardeningRunCmd());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 3: Activate SSH hardening");
+    lines.push(...sshdHardeningRunCmd());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 4: Run security audit");
+    lines.push(...securityAuditRunCmd());
+  }
+  lines.push("  # Mark bootstrap complete");
+  lines.push('  - echo "status=complete" >> /root/.genesis-bootstrap-status');
+  lines.push('  - echo "completed_at=$(date -Iseconds)" >> /root/.genesis-bootstrap-status');
+  if (enableSecurity) {
+    lines.push('  - echo "security_hardening=applied" >> /root/.genesis-bootstrap-status');
+  }
+  lines.push("");
+  if (additionalCommands.length > 0) {
+    lines.push("  # Additional custom commands");
+    for (const cmd of additionalCommands) {
+      lines.push(`  - ${cmd}`);
+    }
+    lines.push("");
+  }
+  lines.push("# =====================================================");
+  lines.push("# STAGE 6: Final (Final stage)");
+  lines.push("# =====================================================");
+  lines.push("");
+  lines.push('final_message: "Genesis server bootstrap completed after $UPTIME seconds"');
+  return lines.join(`
+`);
+}
+function generateRemoteGenesisBootstrap(url) {
+  return `#include
+${url}`;
+}
+var GenesisBootstrapPresets = {
+  default: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey
+  }),
+  arm: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey,
+    defaultServerType: "cax21"
+  }),
+  performance: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey,
+    defaultServerType: "cpx21"
+  }),
+  dedicated: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey,
+    defaultServerType: "ccx13"
+  }),
+  development: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey,
+    enableSecurity: false,
+    packages: ["htop", "vim", "tmux", "strace"],
+    additionalCommands: [
+      "echo 'Genesis development server ready' | wall"
+    ]
+  }),
+  secure: (adminSSHKey) => generateGenesisBootstrap({
+    adminSSHKey,
+    packages: ["lynis"],
+    additionalCommands: [
+      "echo 'Genesis secure server ready - security audit completed' | wall"
+    ]
+  })
+};
+
+// src/bootstrap/cloud-init.ts
+function generateSeedBootstrap(options = {}) {
+  const {
+    seedRepo = "https://github.com/ebowwa/seed",
+    seedBranch = "dev",
+    seedPath = "/root/seed",
+    runSetup = true,
+    setupEnv = {},
+    packages = [],
+    additionalCommands = [],
+    enableSecurity = true
+  } = options;
+  const lines = [];
+  lines.push("#cloud-config");
+  lines.push("");
+  lines.push("# Update system packages");
+  lines.push("package_update: true");
+  lines.push("package_upgrade: true");
+  lines.push("");
+  lines.push("# Install required packages");
+  lines.push("packages:");
+  lines.push("  - git");
+  lines.push("  - curl");
+  lines.push("  - jq");
+  lines.push("  - unzip");
+  lines.push("  - tmux");
+  if (enableSecurity) {
+    lines.push("  # Security: UFW Firewall");
+    lines.push(...ufwFirewallPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: Kernel hardening");
+    lines.push(...kernelHardeningPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: SSH hardening");
+    lines.push(...sshdHardeningPackages());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security: Security audit");
+    lines.push(...securityAuditPackages());
+  }
+  for (const pkg of packages) {
+    lines.push(`  - ${pkg}`);
+  }
+  lines.push("");
+  lines.push("# Write bootstrap status file");
+  lines.push("write_files:");
+  lines.push("  - path: /root/.bootstrap-status");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      status=started");
+  lines.push("      started_at=$(date -Iseconds)");
+  lines.push("      source=cloud-init");
+  if (enableSecurity) {
+    lines.push("      security=enabled");
+  }
+  lines.push("");
+  lines.push("  # Add bun to /etc/environment for all users/shells");
+  lines.push('  # Format: Simple KEY="value" pairs, no variable expansion');
+  lines.push("  - path: /etc/environment");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push('      PATH="/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"');
+  lines.push("");
+  if (enableSecurity) {
+    lines.push("  # Security Module 1: UFW Firewall configuration");
+    lines.push(...ufwFirewallWriteFiles(DEFAULT_UFW_WORKER_OPTIONS));
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 2: Kernel hardening");
+    lines.push(...kernelHardeningWriteFiles());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 3: SSH hardening");
+    lines.push(...sshdHardeningWriteFiles());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 4: Security audit");
+    lines.push(...securityAuditWriteFiles());
+  }
+  lines.push("  # Node-agent systemd service for Ralph Loop orchestration");
+  lines.push("  - path: /etc/systemd/system/node-agent.service");
+  lines.push("    owner: root:root");
+  lines.push("    permissions: '0644'");
+  lines.push("    content: |");
+  lines.push("      [Unit]");
+  lines.push("      Description=Node Agent for Ralph Loop Orchestration");
+  lines.push("      Documentation=https://github.com/ebowwa/seed");
+  lines.push("      After=network-online.target");
+  lines.push("      Wants=network-online.target");
+  lines.push("");
+  lines.push("      [Service]");
+  lines.push("      Type=simple");
+  lines.push("      User=root");
+  lines.push(`      WorkingDirectory=${seedPath}/node-agent`);
+  lines.push("      ExecStart=/root/.bun/bin/bun run src/index.ts");
+  lines.push(`      EnvironmentFile=-${seedPath}/node-agent/.env`);
+  lines.push("      Environment=PORT=8911");
+  lines.push("      Restart=always");
+  lines.push("      RestartSec=10");
+  lines.push("      StandardOutput=journal");
+  lines.push("      StandardError=journal");
+  lines.push("      SyslogIdentifier=node-agent");
+  lines.push("");
+  if (enableSecurity) {
+    lines.push("      # Security hardening");
+    lines.push("      NoNewPrivileges=true");
+    lines.push("      PrivateTmp=true");
+    lines.push("      ProtectSystem=strict");
+    lines.push("      ProtectHome=true");
+    lines.push("      ReadOnlyPaths=/");
+    lines.push("      ReadWritePaths=/var/log " + seedPath + "/node-agent");
+  }
+  lines.push("");
+  lines.push("      [Install]");
+  lines.push("      WantedBy=multi-user.target");
+  lines.push("");
+  lines.push("# Bootstrap commands");
+  lines.push("runcmd:");
+  lines.push("  # Install Bun");
+  lines.push("  - curl -fsSL https://bun.sh/install | bash");
+  lines.push("  - ln -sf /root/.bun/bin/bun /root/.bun/bin/node  # Create 'node' symlink to bun");
+  lines.push("");
+  lines.push(`  # Clone seed repository`);
+  lines.push(`  - git clone --depth 1 --branch ${seedBranch} ${seedRepo} ${seedPath}`);
+  lines.push("");
+  if (runSetup) {
+    const envVars = ["NONINTERACTIVE=1", ...Object.entries(setupEnv).map(([k, v]) => `${k}=${v}`)];
+    const envString = envVars.join(" ");
+    lines.push(`  # Run seed setup non-interactively`);
+    lines.push(`  - cd ${seedPath} && ${envString} bash ./setup.sh 2>&1 | tee /var/log/seed-setup.log`);
+    lines.push("");
+    lines.push(`  # Mark setup complete`);
+    lines.push(`  - touch ${seedPath}/.seed-setup-complete`);
+    lines.push("");
+  }
+  if (additionalCommands.length > 0) {
+    lines.push(`  # Additional custom commands`);
+    for (const cmd of additionalCommands) {
+      lines.push(`  - ${cmd}`);
+    }
+    lines.push("");
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 1: Activate UFW Firewall");
+    lines.push(...ufwFirewallRunCmd(DEFAULT_UFW_WORKER_OPTIONS));
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 2: Apply kernel hardening");
+    lines.push(...kernelHardeningRunCmd());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 3: Activate SSH hardening");
+    lines.push(...sshdHardeningRunCmd());
+  }
+  if (enableSecurity) {
+    lines.push("  # Security Module 4: Run security audit");
+    lines.push(...securityAuditRunCmd());
+  }
+  lines.push(`  # Mark bootstrap complete`);
+  lines.push(`  - echo "status=complete" >> /root/.bootstrap-status`);
+  lines.push(`  - echo "completed_at=$(date -Iseconds)" >> /root/.bootstrap-status`);
+  if (enableSecurity) {
+    lines.push(`  - echo "security_hardening=applied" >> /root/.bootstrap-status`);
+  }
+  lines.push("");
+  lines.push("  # Start node-agent service");
+  lines.push("  - systemctl daemon-reload");
+  lines.push("  - systemctl enable node-agent");
+  lines.push("  - systemctl start node-agent");
+  return lines.join(`
+`);
+}
+function generateRemoteBootstrap(url) {
+  return `#include
+${url}`;
+}
+var BootstrapPresets = {
+  default: () => generateSeedBootstrap(),
+  secure: () => generateSeedBootstrap({
+    setupEnv: {
+      DEBUG: "1",
+      VERBOSE: "1"
+    }
+  }),
+  cloneOnly: () => generateSeedBootstrap({ runSetup: false }),
+  development: () => generateSeedBootstrap({
+    enableSecurity: false,
+    packages: ["htop", "vim", "strace"]
+  }),
+  verbose: () => generateSeedBootstrap({
+    setupEnv: {
+      DEBUG: "1",
+      VERBOSE: "1"
+    }
+  })
+};
+export {
+  ufwFirewallWriteFiles,
+  ufwFirewallRunCmd,
+  ufwFirewallPackages,
+  sshdHardeningWriteFiles,
+  sshdHardeningRunCmd,
+  sshdHardeningPackages,
+  securityAuditWriteFiles,
+  securityAuditRunCmd,
+  securityAuditPackages,
+  kernelHardeningWriteFiles,
+  kernelHardeningRunCmd,
+  kernelHardeningPackages,
+  generateUFWFirewallForWorker,
+  generateUFWFirewallForGenesis,
+  generateSeedBootstrap,
+  generateRemoteGenesisBootstrap,
+  generateRemoteBootstrap,
+  generateGenesisBootstrap,
+  GenesisBootstrapPresets,
+  DEFAULT_UFW_WORKER_OPTIONS,
+  DEFAULT_UFW_GENESIS_OPTIONS,
+  BootstrapPresets
+};