6.3 Security Maintenance

# Traefik configuration handles renewal automatically
certificatesresolvers:
  cloudflare:
    acme:
      dnschallenge: true
      storage: /certificates/acme.json

# Check certificate status
docker exec traefik_container ls -la /certificates/

# Verify certificate expiration
openssl x509 -in /mnt/swarm-data/traefik/certificates/acme.json -text -noout

# Force certificate renewal
docker service update --force traefik_traefik

# Include in regular backups
cp /mnt/swarm-data/traefik/certificates/acme.json /backup/location/

   # Review Authentik users
   # Check for inactive accounts
   # Verify multi-factor authentication setup

   # Verify Traefik basic auth configuration
   # Check database access credentials
   # Review API tokens and secrets

   # Verify firewall rules
   sudo ufw status
   
   # Check exposed ports
   netstat -tlnp
   
   # Review Docker network configuration
   docker network ls

   # Check for security updates
   docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.CreatedAt}}"
   
   # Scan for vulnerabilities (if tools available)
   # Review container configurations for security best practices

# Ubuntu system updates
sudo apt update && sudo apt upgrade -y

# Docker updates
sudo apt update docker-ce docker-ce-cli containerd.io

# Reboot if kernel updates
sudo reboot

# Update all services to latest versions
docker service update --image postgres:17 postgresql17_postgres
docker service update --image traefik:v3.5 traefik_traefik
docker service update --image redis:alpine auth_authentik_redis

# Verify updates
docker service ls
docker service ps service-name

# Monitor failed authentication attempts
docker service logs auth_authentik_server | grep -i "failed\|error"

# Check Traefik access logs
docker service logs traefik_traefik | grep -E "40[134]|50[0235]"

# Review system logs for suspicious activity
journalctl -u ssh.service | grep -i "failed\|invalid"