cue-ai 0.3.0

package/resources/skills/skills/hostinger/vps/firewall-patterns.md

@@ -0,0 +1,209 @@
+# Firewall Security Patterns for Hostinger VPS
+
+Deep dive into configuring VPS firewalls using the Hostinger API. Covers common configurations, security hardening, and multi-language SDK examples.
+
+## How Firewalls Work
+
+- **Default policy: DROP all** — all incoming traffic is blocked unless explicitly allowed
+- **One firewall per VM** — only one firewall can be active on a virtual machine at a time
+- **Manual sync required** — after adding/updating/deleting rules, you must sync the firewall to the VM for changes to take effect
+- **Account-level resource** — firewalls are created at the account level and activated on specific VMs
+
+## Firewall Lifecycle
+
+```
+Create Firewall → Add Rules → Activate on VM → (Modify Rules → Sync to VM)
+```
+
+## Common Configurations
+
+### Web Server (HTTP + HTTPS + SSH)
+
+**curl:**
+
+```bash
+# Create firewall
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "name": "web-server" }'
+
+# Allow SSH (port 22)
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "22", "source": "0.0.0.0/0", "action": "accept" }'
+
+# Allow HTTP (port 80)
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "80", "source": "0.0.0.0/0", "action": "accept" }'
+
+# Allow HTTPS (port 443)
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "443", "source": "0.0.0.0/0", "action": "accept" }'
+
+# Activate on VM
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/activate/12345" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN"
+```
+
+**TypeScript SDK:**
+
+```typescript
+import { Hostinger } from "hostinger-api-sdk";
+
+const client = new Hostinger({ apiToken: "YOUR_API_TOKEN" });
+
+// Create firewall
+const firewall = await client.vps.firewall.create({ name: "web-server" });
+
+// Add rules
+const rules = [
+  { protocol: "tcp", port: "22", source: "0.0.0.0/0", action: "accept" },
+  { protocol: "tcp", port: "80", source: "0.0.0.0/0", action: "accept" },
+  { protocol: "tcp", port: "443", source: "0.0.0.0/0", action: "accept" },
+];
+
+for (const rule of rules) {
+  await client.vps.firewall.createRule(firewall.id, rule);
+}
+
+// Activate on VM
+await client.vps.firewall.activate(firewall.id, 12345);
+```
+
+**PHP SDK:**
+
+```php
+use Hostinger\Api\HostingerApi;
+
+$client = new HostingerApi('YOUR_API_TOKEN');
+
+$firewall = $client->vps->firewall->create(['name' => 'web-server']);
+
+$rules = [
+    ['protocol' => 'tcp', 'port' => '22', 'source' => '0.0.0.0/0', 'action' => 'accept'],
+    ['protocol' => 'tcp', 'port' => '80', 'source' => '0.0.0.0/0', 'action' => 'accept'],
+    ['protocol' => 'tcp', 'port' => '443', 'source' => '0.0.0.0/0', 'action' => 'accept'],
+];
+
+foreach ($rules as $rule) {
+    $client->vps->firewall->createRule($firewall->id, $rule);
+}
+
+$client->vps->firewall->activate($firewall->id, 12345);
+```
+
+### Database Server (Restricted Access)
+
+Only allow SSH and database connections from specific IPs:
+
+```bash
+# Allow SSH from office IP only
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/2/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "22", "source": "203.0.113.50/32", "action": "accept" }'
+
+# Allow PostgreSQL from app server
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/2/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "5432", "source": "198.51.100.10/32", "action": "accept" }'
+
+# Allow MySQL from app server
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/2/rules" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "3306", "source": "198.51.100.10/32", "action": "accept" }'
+```
+
+### Docker Host
+
+Expose SSH + commonly used Docker ports:
+
+```bash
+# SSH
+curl -X POST ".../firewall/3/rules" -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "22", "source": "0.0.0.0/0", "action": "accept" }'
+
+# HTTP/HTTPS for web containers
+curl -X POST ".../firewall/3/rules" -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "80", "source": "0.0.0.0/0", "action": "accept" }'
+
+curl -X POST ".../firewall/3/rules" -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "443", "source": "0.0.0.0/0", "action": "accept" }'
+
+# Custom app port range (e.g., 3000-3999)
+curl -X POST ".../firewall/3/rules" -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "3000:3999", "source": "0.0.0.0/0", "action": "accept" }'
+```
+
+### Mail Server
+
+```bash
+# SSH
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "22", "source": "0.0.0.0/0", "action": "accept" }'
+# SMTP
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "25", "source": "0.0.0.0/0", "action": "accept" }'
+# SMTPS
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "465", "source": "0.0.0.0/0", "action": "accept" }'
+# Submission
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "587", "source": "0.0.0.0/0", "action": "accept" }'
+# IMAP
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "143", "source": "0.0.0.0/0", "action": "accept" }'
+# IMAPS
+curl -X POST ".../firewall/4/rules" -d '{ "protocol": "tcp", "port": "993", "source": "0.0.0.0/0", "action": "accept" }'
+```
+
+## Modifying Rules
+
+After modifying rules, **always sync** to apply changes:
+
+```bash
+# Update a rule
+curl -X PUT "https://developers.hostinger.com/api/vps/v1/firewall/1/rules/5" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{ "protocol": "tcp", "port": "2222", "source": "0.0.0.0/0", "action": "accept" }'
+
+# Delete a rule
+curl -X DELETE "https://developers.hostinger.com/api/vps/v1/firewall/1/rules/5" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN"
+
+# IMPORTANT: Sync after changes
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/sync/12345" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN"
+```
+
+## Switching Firewalls
+
+To switch from one firewall to another:
+
+```bash
+# Deactivate current firewall
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/1/deactivate/12345" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN"
+
+# Activate new firewall
+curl -X POST "https://developers.hostinger.com/api/vps/v1/firewall/2/activate/12345" \
+  -H "Authorization: Bearer $HOSTINGER_API_TOKEN"
+```
+
+## Security Hardening Checklist
+
+1. **Never expose all ports** — only open what you actively use
+2. **Restrict SSH access** to known IPs when possible (instead of `0.0.0.0/0`)
+3. **Use non-standard SSH port** — change from 22 to reduce automated scan noise
+4. **Restrict database ports** to application server IPs only
+5. **Always sync after changes** — unsynchronized rules leave the VM exposed
+6. **Review rules periodically** — remove rules for services no longer in use
+7. **Delete unused firewalls** — deleting a firewall auto-deactivates it on all VMs

package/resources/skills/skills/hostinger/vps/terraform-examples.md

@@ -0,0 +1,347 @@
+# Terraform Examples for Hostinger VPS
+
+Infrastructure as Code patterns using the [Hostinger Terraform Provider](https://github.com/hostinger/terraform-provider-hostinger) for VPS provisioning and management.
+
+## Provider Setup
+
+```hcl
+terraform {
+  required_providers {
+    hostinger = {
+      source  = "hostinger/hostinger"
+    }
+  }
+}
+
+provider "hostinger" {
+  # Set via HOSTINGER_API_TOKEN environment variable
+  # or directly: api_token = "your-token"
+}
+```
+
+```bash
+# Set token via environment
+export HOSTINGER_API_TOKEN="your-api-token"
+
+# Initialize Terraform
+terraform init
+```
+
+## Basic VPS Provisioning
+
+### Single Server
+
+```hcl
+# Look up available templates
+data "hostinger_vps_templates" "all" {}
+
+# Look up available data centers
+data "hostinger_vps_data_centers" "all" {}
+
+# Look up catalog for pricing
+data "hostinger_billing_catalog" "vps" {
+  category = "vps"
+}
+
+resource "hostinger_vps" "web" {
+  hostname    = "web-server"
+  template_id = data.hostinger_vps_templates.all.templates[0].id
+  data_center = data.hostinger_vps_data_centers.all.data_centers[0].id
+  item_id     = "hostingercom-vps-kvm2-usd-1m"
+  password    = var.root_password
+}
+
+variable "root_password" {
+  type      = string
+  sensitive = true
+}
+
+output "server_ip" {
+  value = hostinger_vps.web.ip_address
+}
+```
+
+### Multiple Servers
+
+```hcl
+variable "servers" {
+  default = {
+    web = { hostname = "web-prod" }
+    api = { hostname = "api-prod" }
+    db  = { hostname = "db-prod" }
+  }
+}
+
+resource "hostinger_vps" "cluster" {
+  for_each = var.servers
+
+  hostname    = each.value.hostname
+  template_id = data.hostinger_vps_templates.all.templates[0].id
+  data_center = data.hostinger_vps_data_centers.all.data_centers[0].id
+  item_id     = "hostingercom-vps-kvm2-usd-1m"
+  password    = var.root_password
+}
+
+output "server_ips" {
+  value = { for k, v in hostinger_vps.cluster : k => v.ip_address }
+}
+```
+
+## SSH Key Management
+
+```hcl
+resource "hostinger_vps_ssh_key" "deploy" {
+  name = "deploy-key"
+  key  = file("~/.ssh/id_ed25519.pub")
+}
+
+resource "hostinger_vps_ssh_key" "developer" {
+  name = "dev-key"
+  key  = var.developer_ssh_key
+}
+
+# Attach keys to server
+resource "hostinger_vps_ssh_key_attachment" "web_keys" {
+  virtual_machine_id = hostinger_vps.web.id
+  ssh_key_ids        = [
+    hostinger_vps_ssh_key.deploy.id,
+    hostinger_vps_ssh_key.developer.id,
+  ]
+}
+```
+
+## Firewall Configuration
+
+```hcl
+resource "hostinger_vps_firewall" "web" {
+  name = "web-server-fw"
+}
+
+# SSH access
+resource "hostinger_vps_firewall_rule" "ssh" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "22"
+  source      = var.office_ip
+  action      = "accept"
+}
+
+# HTTP
+resource "hostinger_vps_firewall_rule" "http" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "80"
+  source      = "0.0.0.0/0"
+  action      = "accept"
+}
+
+# HTTPS
+resource "hostinger_vps_firewall_rule" "https" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "443"
+  source      = "0.0.0.0/0"
+  action      = "accept"
+}
+
+# Activate firewall on VM
+resource "hostinger_vps_firewall_activation" "web" {
+  firewall_id        = hostinger_vps_firewall.web.id
+  virtual_machine_id = hostinger_vps.web.id
+}
+
+variable "office_ip" {
+  type        = string
+  description = "Office IP in CIDR notation (e.g., 203.0.113.50/32)"
+}
+```
+
+## Post-Install Scripts
+
+```hcl
+resource "hostinger_vps_post_install_script" "docker_setup" {
+  name    = "install-docker"
+  content = <<-SCRIPT
+    #!/bin/bash
+    apt-get update
+    apt-get install -y docker.io docker-compose-plugin
+    systemctl enable docker
+    systemctl start docker
+    echo "Docker installed" >> /post_install.log
+  SCRIPT
+}
+
+resource "hostinger_vps_post_install_script" "hardening" {
+  name    = "security-hardening"
+  content = <<-SCRIPT
+    #!/bin/bash
+    # Disable password auth for SSH
+    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+    systemctl restart sshd
+
+    # Enable automatic security updates
+    apt-get install -y unattended-upgrades
+    echo 'Unattended-Upgrade::Automatic-Reboot "false";' >> /etc/apt/apt.conf.d/50unattended-upgrades
+
+    echo "Hardening complete" >> /post_install.log
+  SCRIPT
+}
+```
+
+## Complete Infrastructure Example
+
+A full production setup with web server, database, firewall, and SSH keys:
+
+```hcl
+terraform {
+  required_providers {
+    hostinger = {
+      source = "hostinger/hostinger"
+    }
+  }
+}
+
+provider "hostinger" {}
+
+# Data sources
+data "hostinger_vps_templates" "all" {}
+data "hostinger_vps_data_centers" "all" {}
+
+# Variables
+variable "root_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "ssh_public_key" {
+  type = string
+}
+
+variable "admin_ip" {
+  type        = string
+  description = "Admin IP for SSH access (CIDR)"
+}
+
+# SSH Key
+resource "hostinger_vps_ssh_key" "admin" {
+  name = "admin-key"
+  key  = var.ssh_public_key
+}
+
+# Web Server
+resource "hostinger_vps" "web" {
+  hostname    = "web-prod"
+  template_id = data.hostinger_vps_templates.all.templates[0].id
+  data_center = data.hostinger_vps_data_centers.all.data_centers[0].id
+  item_id     = "hostingercom-vps-kvm4-usd-1m"
+  password    = var.root_password
+}
+
+# Database Server
+resource "hostinger_vps" "db" {
+  hostname    = "db-prod"
+  template_id = data.hostinger_vps_templates.all.templates[0].id
+  data_center = data.hostinger_vps_data_centers.all.data_centers[0].id
+  item_id     = "hostingercom-vps-kvm2-usd-1m"
+  password    = var.root_password
+}
+
+# Attach SSH keys
+resource "hostinger_vps_ssh_key_attachment" "web" {
+  virtual_machine_id = hostinger_vps.web.id
+  ssh_key_ids        = [hostinger_vps_ssh_key.admin.id]
+}
+
+resource "hostinger_vps_ssh_key_attachment" "db" {
+  virtual_machine_id = hostinger_vps.db.id
+  ssh_key_ids        = [hostinger_vps_ssh_key.admin.id]
+}
+
+# Web Server Firewall
+resource "hostinger_vps_firewall" "web" {
+  name = "web-fw"
+}
+
+resource "hostinger_vps_firewall_rule" "web_ssh" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "22"
+  source      = var.admin_ip
+  action      = "accept"
+}
+
+resource "hostinger_vps_firewall_rule" "web_http" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "80"
+  source      = "0.0.0.0/0"
+  action      = "accept"
+}
+
+resource "hostinger_vps_firewall_rule" "web_https" {
+  firewall_id = hostinger_vps_firewall.web.id
+  protocol    = "tcp"
+  port        = "443"
+  source      = "0.0.0.0/0"
+  action      = "accept"
+}
+
+resource "hostinger_vps_firewall_activation" "web" {
+  firewall_id        = hostinger_vps_firewall.web.id
+  virtual_machine_id = hostinger_vps.web.id
+}
+
+# Database Firewall
+resource "hostinger_vps_firewall" "db" {
+  name = "db-fw"
+}
+
+resource "hostinger_vps_firewall_rule" "db_ssh" {
+  firewall_id = hostinger_vps_firewall.db.id
+  protocol    = "tcp"
+  port        = "22"
+  source      = var.admin_ip
+  action      = "accept"
+}
+
+resource "hostinger_vps_firewall_rule" "db_postgres" {
+  firewall_id = hostinger_vps_firewall.db.id
+  protocol    = "tcp"
+  port        = "5432"
+  source      = "${hostinger_vps.web.ip_address}/32"
+  action      = "accept"
+}
+
+resource "hostinger_vps_firewall_activation" "db" {
+  firewall_id        = hostinger_vps_firewall.db.id
+  virtual_machine_id = hostinger_vps.db.id
+}
+
+# Outputs
+output "web_ip" {
+  value = hostinger_vps.web.ip_address
+}
+
+output "db_ip" {
+  value     = hostinger_vps.db.ip_address
+  sensitive = true
+}
+```
+
+### Apply
+
+```bash
+terraform plan -var="root_password=SecurePass123!" \
+  -var="ssh_public_key=$(cat ~/.ssh/id_ed25519.pub)" \
+  -var="admin_ip=203.0.113.50/32"
+
+terraform apply
+```
+
+## Tips
+
+- Use `terraform plan` to preview changes before applying
+- Store state remotely (S3, Terraform Cloud) for team collaboration
+- Use `sensitive = true` for passwords and private IPs
+- The Terraform provider wraps the same Hostinger API — resource names map to API endpoints
+- Refer to the [provider documentation](https://github.com/hostinger/terraform-provider-hostinger) for the latest resource schemas