🏆 Best Practices: Linux & Networking Mastery

# ansible-playbook: infrastructure-setup.yml
---
- name: Complete Infrastructure Setup
  hosts: all
  become: yes
  vars:
    # Environment-specific variables
    environment: "{{ env | default('production') }}"
    backup_retention_days: 30
    monitoring_enabled: true
    security_hardening: true

  pre_tasks:
    - name: Validate environment
      assert:
        that:
          - environment in ['development', 'staging', 'production']
          - ansible_distribution == 'Ubuntu'
          - ansible_distribution_major_version|int >= 20
        fail_msg: "Environment validation failed"

    - name: Create backup directory
      file:
        path: /backup/{{ inventory_hostname }}
        state: directory
        mode: "0750"
        owner: backup
        group: backup

  roles:
    - role: common
      tags: ["common", "base"]
    - role: security
      tags: ["security", "hardening"]
      when: security_hardening
    - role: monitoring
      tags: ["monitoring", "observability"]
      when: monitoring_enabled
    - role: backup
      tags: ["backup", "disaster-recovery"]

  post_tasks:
    - name: Verify system state
      include_tasks: verify-system.yml
      tags: ["verification", "testing"]

    - name: Generate system report
      template:
        src: system-report.j2
        dest: /var/log/system-setup-{{ ansible_date_time.epoch }}.log
      tags: ["documentation", "reporting"]

# roles/common/tasks/main.yml
---
- name: Update package cache
  apt:
    update_cache: yes
    cache_valid_time: 3600
  tags: ["packages"]

- name: Install essential packages
  apt:
    name:
      - curl
      - wget
      - vim
      - htop
      - iotop
      - nload
      - tree
      - git
      - unzip
      - software-properties-common
      - apt-transport-https
      - ca-certificates
      - gnupg
      - lsb-release
    state: present
  tags: ["packages"]

- name: Configure timezone
  timezone:
    name: "{{ system_timezone | default('UTC') }}"
  notify: restart rsyslog
  tags: ["system"]

- name: Configure NTP
  template:
    src: ntp.conf.j2
    dest: /etc/ntp.conf
    backup: yes
  notify: restart ntp
  tags: ["system", "time"]

- name: Create system users
  user:
    name: "{{ item.name }}"
    groups: "{{ item.groups | default([]) }}"
    shell: "{{ item.shell | default('/bin/bash') }}"
    create_home: yes
    state: present
  loop: "{{ system_users | default([]) }}"
  tags: ["users"]

- name: Configure SSH keys
  authorized_key:
    user: "{{ item.0.name }}"
    key: "{{ item.1 }}"
    state: present
  loop: "{{ system_users | subelements('ssh_keys', skip_missing=True) }}"
  tags: ["users", "ssh"]

- name: Configure system limits
  pam_limits:
    domain: "{{ item.domain }}"
    limit_type: "{{ item.type }}"
    limit_item: "{{ item.item }}"
    value: "{{ item.value }}"
  loop:
    - { domain: "*", type: "soft", item: "nofile", value: "65536" }
    - { domain: "*", type: "hard", item: "nofile", value: "65536" }
    - { domain: "*", type: "soft", item: "nproc", value: "32768" }
    - { domain: "*", type: "hard", item: "nproc", value: "32768" }
  tags: ["system", "limits"]

- name: Configure kernel parameters
  sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    reload: yes
  loop:
    - { name: "vm.swappiness", value: "10" }
    - { name: "vm.dirty_ratio", value: "15" }
    - { name: "vm.dirty_background_ratio", value: "5" }
    - { name: "net.core.rmem_max", value: "16777216" }
    - { name: "net.core.wmem_max", value: "16777216" }
    - { name: "net.ipv4.tcp_window_scaling", value: "1" }
    - { name: "net.ipv4.tcp_timestamps", value: "1" }
    - { name: "net.ipv4.tcp_sack", value: "1" }
  tags: ["system", "kernel", "performance"]

#!/bin/bash
# config-management-standards.sh

# Configuration file standards
CONFIG_DIR="/etc/myapp"
CONFIG_BACKUP_DIR="/etc/myapp/backups"
CONFIG_TEMPLATE_DIR="/etc/myapp/templates"

# Ensure proper directory structure
create_config_structure() {
    local dirs=(
        "$CONFIG_DIR"
        "$CONFIG_BACKUP_DIR"
        "$CONFIG_TEMPLATE_DIR"
        "$CONFIG_DIR/conf.d"
        "$CONFIG_DIR/ssl"
        "$CONFIG_DIR/scripts"
    )

    for dir in "${dirs[@]}"; do
        mkdir -p "$dir"
        chown root:root "$dir"
        chmod 755 "$dir"
    done

    # Secure SSL directory
    chmod 700 "$CONFIG_DIR/ssl"
}

# Configuration file management
manage_config_file() {
    local config_file="$1"
    local template_file="$2"
    local backup_suffix="$(date +%Y%m%d_%H%M%S)"

    # Validate inputs
    if [[ ! -f "$template_file" ]]; then
        echo "Error: Template file not found: $template_file"
        return 1
    fi

    # Backup existing configuration
    if [[ -f "$config_file" ]]; then
        cp "$config_file" "${CONFIG_BACKUP_DIR}/$(basename "$config_file").${backup_suffix}"
        echo "Backed up existing config: $config_file"
    fi

    # Validate new configuration
    if validate_config "$template_file"; then
        cp "$template_file" "$config_file"
        chown root:root "$config_file"
        chmod 644 "$config_file"
        echo "Configuration updated: $config_file"
        return 0
    else
        echo "Error: Configuration validation failed"
        return 1
    fi
}

# Configuration validation
validate_config() {
    local config_file="$1"

    # Syntax validation (example for nginx)
    if [[ "$config_file" =~ nginx ]]; then
        nginx -t -c "$config_file" 2>/dev/null
        return $?
    fi

    # Syntax validation (example for apache)
    if [[ "$config_file" =~ apache ]]; then
        apache2ctl -t -f "$config_file" 2>/dev/null
        return $?
    fi

    # Generic validation (check for basic syntax)
    if [[ -f "$config_file" ]]; then
        # Check for common syntax errors
        if grep -q "^[[:space:]]*$" "$config_file" && \
           ! grep -q "[{}].*[{}]" "$config_file"; then
            return 0
        fi
    fi

    return 1
}

# Configuration rollback
rollback_config() {
    local config_file="$1"
    local backup_file="$2"

    if [[ -f "$backup_file" ]]; then
        cp "$backup_file" "$config_file"
        echo "Configuration rolled back: $config_file"

        # Restart associated service
        local service_name=$(basename "$config_file" | cut -d'.' -f1)
        if systemctl is-enabled "$service_name" &>/dev/null; then
            systemctl restart "$service_name"
            echo "Service restarted: $service_name"
        fi
    else
        echo "Error: Backup file not found: $backup_file"
        return 1
    fi
}

# Configuration audit
audit_configurations() {
    local audit_log="/var/log/config-audit-$(date +%Y%m%d).log"

    echo "Configuration Audit Report - $(date)" > "$audit_log"
    echo "=========================================" >> "$audit_log"

    # Check file permissions
    echo "File Permissions:" >> "$audit_log"
    find "$CONFIG_DIR" -type f -exec ls -la {} \; >> "$audit_log"

    # Check for sensitive data
    echo "\nSensitive Data Check:" >> "$audit_log"
    grep -r "password\|secret\|key" "$CONFIG_DIR" --exclude-dir=ssl >> "$audit_log" 2>/dev/null || echo "No sensitive data found in configs" >> "$audit_log"

    # Check configuration syntax
    echo "\nConfiguration Validation:" >> "$audit_log"
    find "$CONFIG_DIR" -name "*.conf" -o -name "*.cfg" | while read config; do
        if validate_config "$config"; then
            echo "✓ Valid: $config" >> "$audit_log"
        else
            echo "✗ Invalid: $config" >> "$audit_log"
        fi
    done

    echo "Audit completed: $audit_log"
}

# Example usage
create_config_structure
# manage_config_file "/etc/nginx/nginx.conf" "/etc/myapp/templates/nginx.conf.template"
# audit_configurations

#!/bin/bash
# security-hardening.sh - Comprehensive security hardening script

SECURITY_LOG="/var/log/security-hardening.log"
BACKUP_DIR="/backup/security-$(date +%Y%m%d_%H%M%S)"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$SECURITY_LOG"
}

# Create backup directory
mkdir -p "$BACKUP_DIR"

log "Starting comprehensive security hardening"

# 1. System Updates
harden_system_updates() {
    log "=== SYSTEM UPDATES ==="

    # Update package database
    apt update

    # Upgrade all packages
    apt upgrade -y

    # Remove unnecessary packages
    apt autoremove -y

    # Configure automatic security updates
    cat > /etc/apt/apt.conf.d/20auto-upgrades << EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
EOF

    # Configure unattended upgrades
    cat > /etc/apt/apt.conf.d/50unattended-upgrades << EOF
Unattended-Upgrade::Allowed-Origins {
    "\${distro_id}:\${distro_codename}-security";
    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
    "\${distro_id}ESM:\${distro_codename}-infra-security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
EOF

    log "System updates configured"
}

# 2. SSH Hardening
harden_ssh() {
    log "=== SSH HARDENING ==="

    # Backup original SSH config
    cp /etc/ssh/sshd_config "$BACKUP_DIR/sshd_config.backup"

    # Create hardened SSH configuration
    cat > /etc/ssh/sshd_config << EOF
# SSH Hardened Configuration
Port 2222
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Authentication
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes

# Security settings
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
PermitTunnel no
GatewayPorts no
PermitUserEnvironment no

# Connection settings
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 2
MaxStartups 2
LoginGraceTime 60

# Logging
SyslogFacility AUTH
LogLevel VERBOSE

# Allowed users/groups
AllowGroups ssh-users

# Ciphers and algorithms
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
EOF

    # Create SSH users group
    groupadd -f ssh-users

    # Test SSH configuration
    if sshd -t; then
        systemctl restart ssh
        log "SSH hardening completed successfully"
    else
        log "ERROR: SSH configuration invalid, restoring backup"
        cp "$BACKUP_DIR/sshd_config.backup" /etc/ssh/sshd_config
        systemctl restart ssh
    fi
}

# 3. Firewall Configuration
harden_firewall() {
    log "=== FIREWALL HARDENING ==="

    # Reset UFW to defaults
    ufw --force reset

    # Set default policies
    ufw default deny incoming
    ufw default allow outgoing
    ufw default deny forward

    # Allow SSH (custom port)
    ufw allow 2222/tcp comment 'SSH'

    # Allow HTTP/HTTPS
    ufw allow 80/tcp comment 'HTTP'
    ufw allow 443/tcp comment 'HTTPS'

    # Rate limiting for SSH
    ufw limit 2222/tcp

    # Enable logging
    ufw logging on

    # Enable firewall
    ufw --force enable

    log "Firewall hardening completed"
}

# 4. Kernel Hardening
harden_kernel() {
    log "=== KERNEL HARDENING ==="

    # Backup original sysctl configuration
    cp /etc/sysctl.conf "$BACKUP_DIR/sysctl.conf.backup"

    # Create hardened sysctl configuration
    cat >> /etc/sysctl.conf << EOF

# Security hardening parameters
# Network security
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Memory protection
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.yama.ptrace_scope = 1
kernel.kexec_load_disabled = 1

# File system protection
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.suid_dumpable = 0

# Process restrictions
kernel.core_uses_pid = 1
kernel.ctrl-alt-del = 0
EOF

    # Apply sysctl settings
    sysctl -p

    log "Kernel hardening completed"
}

# 5. File System Hardening
harden_filesystem() {
    log "=== FILESYSTEM HARDENING ==="

    # Set proper permissions on critical files
    chmod 600 /etc/shadow
    chmod 600 /etc/gshadow
    chmod 644 /etc/passwd
    chmod 644 /etc/group

    # Secure /tmp with proper mount options
    if ! grep -q "/tmp" /etc/fstab; then
        echo "tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,size=1G 0 0" >> /etc/fstab
    fi

    # Remove unnecessary SUID/SGID binaries
    local suid_binaries=(
        "/usr/bin/at"
        "/usr/bin/wall"
        "/usr/bin/write"
        "/usr/bin/chfn"
        "/usr/bin/chsh"
        "/usr/bin/newgrp"
    )

    for binary in "${suid_binaries[@]}"; do
        if [[ -f "$binary" ]]; then
            chmod u-s "$binary"
            log "Removed SUID bit from $binary"
        fi
    done

    # Set umask for better default permissions
    echo "umask 027" >> /etc/profile
    echo "umask 027" >> /etc/bash.bashrc

    log "Filesystem hardening completed"
}

# 6. Service Hardening
harden_services() {
    log "=== SERVICE HARDENING ==="

    # Disable unnecessary services
    local services_to_disable=(
        "avahi-daemon"
        "cups"
        "bluetooth"
        "whoopsie"
        "apport"
    )

    for service in "${services_to_disable[@]}"; do
        if systemctl is-enabled "$service" &>/dev/null; then
            systemctl disable "$service"
            systemctl stop "$service"
            log "Disabled service: $service"
        fi
    done

    # Configure fail2ban
    apt install -y fail2ban

    cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
backend = systemd

[sshd]
enabled = true
port = 2222
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 3

[nginx-noscript]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 6
EOF

    systemctl enable fail2ban
    systemctl start fail2ban

    log "Service hardening completed"
}

# 7. Audit Configuration
harden_audit() {
    log "=== AUDIT HARDENING ==="

    # Install auditd
    apt install -y auditd audispd-plugins

    # Configure audit rules
    cat > /etc/audit/rules.d/hardening.rules << EOF
# Delete all existing rules
-D

# Buffer size
-b 8192

# Failure mode (0=silent, 1=printk, 2=panic)
-f 1

# Monitor authentication events
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity

# Monitor system configuration changes
-w /etc/ssh/sshd_config -p wa -k ssh_config
-w /etc/sudoers -p wa -k sudo_config
-w /etc/hosts -p wa -k network_config

# Monitor privilege escalation
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=4294967295 -k privilege_escalation
-a always,exit -F arch=b32 -S execve -F euid=0 -F auid>=1000 -F auid!=4294967295 -k privilege_escalation

# Monitor file access
-a always,exit -F arch=b64 -S open,openat,creat -F exit=-EACCES -k file_access
-a always,exit -F arch=b64 -S open,openat,creat -F exit=-EPERM -k file_access

# Lock the configuration
-e 2
EOF

    # Restart auditd
    systemctl enable auditd
    systemctl restart auditd

    log "Audit hardening completed"
}

# 8. Generate security report
generate_security_report() {
    log "=== GENERATING SECURITY REPORT ==="

    local report_file="/var/log/security-report-$(date +%Y%m%d_%H%M%S).txt"

    cat > "$report_file" << EOF
Security Hardening Report
========================
Date: $(date)
Hostname: $(hostname)
OS: $(lsb_release -d | cut -f2)
Kernel: $(uname -r)

Hardening Steps Completed:
- System updates and automatic security updates
- SSH hardening (port 2222, key-only auth)
- Firewall configuration (UFW)
- Kernel parameter hardening
- File system permissions hardening
- Service hardening and fail2ban
- Audit system configuration

Security Status:
- SSH Port: 2222
- Root Login: Disabled
- Password Auth: Disabled
- Firewall: Enabled
- Fail2ban: Active
- Audit: Enabled

Next Steps:
- Regular security updates
- Monitor audit logs
- Review fail2ban logs
- Periodic security assessments

Backup Location: $BACKUP_DIR
EOF

    log "Security report generated: $report_file"

    # Send report via email if configured
    if command -v mail &> /dev/null; then
        mail -s "Security Hardening Report - $(hostname)" admin@example.com < "$report_file"
    fi
}

# Main execution
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root"
    exit 1
fi

echo "WARNING: This script will make significant security changes to your system."
echo "Ensure you have console access and backups before proceeding."
read -p "Continue? (y/N): " -n 1 -r
echo

if [[ $REPLY =~ ^[Yy]$ ]]; then
    harden_system_updates
    harden_ssh
    harden_firewall
    harden_kernel
    harden_filesystem
    harden_services
    harden_audit
    generate_security_report

    log "Security hardening completed successfully"
    echo "IMPORTANT: SSH port changed to 2222. Update your connection settings."
    echo "Reboot recommended to apply all changes."
else
    echo "Security hardening cancelled."
fi

#!/bin/bash
# performance-optimization.sh - Comprehensive performance tuning

PERF_LOG="/var/log/performance-tuning.log"
BENCHMARK_DIR="/tmp/benchmarks-$(date +%Y%m%d_%H%M%S)"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$PERF_LOG"
}

mkdir -p "$BENCHMARK_DIR"

log "Starting comprehensive performance optimization"

# Baseline performance measurement
baseline_performance() {
    log "=== BASELINE PERFORMANCE MEASUREMENT ==="

    # CPU performance
    log "CPU Performance Test:"
    sysbench cpu --cpu-max-prime=20000 --threads=$(nproc) run > "$BENCHMARK_DIR/cpu_baseline.txt" 2>&1

    # Memory performance
    log "Memory Performance Test:"
    sysbench memory --memory-total-size=10G run > "$BENCHMARK_DIR/memory_baseline.txt" 2>&1

    # Disk I/O performance
    log "Disk I/O Performance Test:"
    sysbench fileio --file-total-size=5G prepare > /dev/null 2>&1
    sysbench fileio --file-total-size=5G --file-test-mode=rndrw run > "$BENCHMARK_DIR/disk_baseline.txt" 2>&1
    sysbench fileio --file-total-size=5G cleanup > /dev/null 2>&1

    # Network performance (if iperf3 is available)
    if command -v iperf3 &> /dev/null; then
        log "Network Performance Test (loopback):"
        iperf3 -s -D -p 5201
        sleep 2
        iperf3 -c 127.0.0.1 -p 5201 -t 10 > "$BENCHMARK_DIR/network_baseline.txt" 2>&1
        pkill iperf3
    fi

    log "Baseline measurements completed"
}

# CPU optimization
optimize_cpu() {
    log "=== CPU OPTIMIZATION ==="

    # Set CPU governor to performance
    if [[ -f /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor ]]; then
        echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
        log "CPU governor set to performance"
    fi

    # Disable CPU mitigations for performance (security trade-off)
    if ! grep -q "mitigations=off" /proc/cmdline; then
        log "WARNING: Consider adding 'mitigations=off' to GRUB for better performance (reduces security)"
    fi

    # Configure CPU affinity for critical services
    local critical_services=("nginx" "mysql" "postgresql")
    local cpu_count=$(nproc)
    local reserved_cpus=$((cpu_count - 1))

    for service in "${critical_services[@]}"; do
        if systemctl is-active --quiet "$service"; then
            local pid=$(systemctl show --property MainPID --value "$service")
            if [[ "$pid" != "0" ]]; then
                taskset -cp "0-$reserved_cpus" "$pid" 2>/dev/null
                log "Set CPU affinity for $service (PID: $pid)"
            fi
        fi
    done

    log "CPU optimization completed"
}

# Memory optimization
optimize_memory() {
    log "=== MEMORY OPTIMIZATION ==="

    # Configure swap settings
    sysctl vm.swappiness=10
    sysctl vm.vfs_cache_pressure=50
    sysctl vm.dirty_ratio=15
    sysctl vm.dirty_background_ratio=5

    # Configure huge pages for databases
    local total_mem_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')
    local hugepage_size_kb=$(grep Hugepagesize /proc/meminfo | awk '{print $2}')
    local hugepages_count=$((total_mem_kb / hugepage_size_kb / 4))  # Use 25% for huge pages

    echo "$hugepages_count" > /sys/kernel/mm/hugepages/hugepages-${hugepage_size_kb}kB/nr_hugepages
    log "Configured $hugepages_count huge pages"

    # Memory compaction
    echo 1 > /proc/sys/vm/compact_memory

    # Configure NUMA policy for multi-socket systems
    if [[ $(numactl --hardware | grep "available:" | awk '{print $2}') -gt 1 ]]; then
        log "Multi-NUMA system detected, configuring NUMA policies"
        # Set NUMA balancing
        echo 1 > /proc/sys/kernel/numa_balancing
    fi

    log "Memory optimization completed"
}

# Disk I/O optimization
optimize_disk_io() {
    log "=== DISK I/O OPTIMIZATION ==="

    # Optimize I/O scheduler for different disk types
    for disk in /sys/block/*/queue/scheduler; do
        local device=$(echo "$disk" | cut -d'/' -f4)

        # Check if it's an SSD
        if [[ $(cat "/sys/block/$device/queue/rotational") == "0" ]]; then
            echo "none" > "$disk" 2>/dev/null || echo "mq-deadline" > "$disk"
            log "Set scheduler for SSD $device: $(cat "$disk")"
        else
            echo "mq-deadline" > "$disk"
            log "Set scheduler for HDD $device: mq-deadline"
        fi
    done

    # Optimize read-ahead for better sequential performance
    for disk in /sys/block/*/queue/read_ahead_kb; do
        local device=$(echo "$disk" | cut -d'/' -f4)
        echo 4096 > "$disk"
        log "Set read-ahead for $device: 4096KB"
    done

    # Configure I/O limits with systemd
    mkdir -p /etc/systemd/system/user.slice.d
    cat > /etc/systemd/system/user.slice.d/io-limits.conf << EOF
[Slice]
IOWeight=100
IODeviceWeight=/dev/sda 200
IOReadBandwidthMax=/dev/sda 100M
IOWriteBandwidthMax=/dev/sda 50M
EOF

    systemctl daemon-reload

    log "Disk I/O optimization completed"
}

# Network optimization
optimize_network() {
    log "=== NETWORK OPTIMIZATION ==="

    # TCP buffer tuning
    sysctl net.core.rmem_default=262144
    sysctl net.core.rmem_max=16777216
    sysctl net.core.wmem_default=262144
    sysctl net.core.wmem_max=16777216
    sysctl net.ipv4.tcp_rmem="4096 65536 16777216"
    sysctl net.ipv4.tcp_wmem="4096 65536 16777216"

    # TCP congestion control
    sysctl net.ipv4.tcp_congestion_control=bbr

    # Network device optimization
    for interface in $(ip link show | grep -E '^[0-9]+:' | cut -d: -f2 | tr -d ' ' | grep -v lo); do
        # Increase ring buffer sizes
        ethtool -G "$interface" rx 4096 tx 4096 2>/dev/null || true

        # Enable offloading features
        ethtool -K "$interface" gro on 2>/dev/null || true
        ethtool -K "$interface" tso on 2>/dev/null || true
        ethtool -K "$interface" gso on 2>/dev/null || true

        log "Optimized network interface: $interface"
    done

    # Increase connection tracking table size
    sysctl net.netfilter.nf_conntrack_max=1048576

    log "Network optimization completed"
}

# Application-specific optimization
optimize_applications() {
    log "=== APPLICATION OPTIMIZATION ==="

    # Nginx optimization
    if systemctl is-active --quiet nginx; then
        log "Optimizing Nginx configuration"

        # Backup original config
        cp /etc/nginx/nginx.conf "/etc/nginx/nginx.conf.backup.$(date +%Y%m%d_%H%M%S)"

        # Create optimized nginx config
        cat > /etc/nginx/conf.d/performance.conf << EOF
# Performance optimizations
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    # Basic optimizations
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 30;
    keepalive_requests 1000;

    # Buffer optimizations
    client_body_buffer_size 128k;
    client_max_body_size 10m;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;
    output_buffers 1 32k;
    postpone_output 1460;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;

    # File caching
    open_file_cache max=200000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
}
EOF

        nginx -t && systemctl reload nginx
        log "Nginx optimization completed"
    fi

    # MySQL optimization
    if systemctl is-active --quiet mysql; then
        log "Optimizing MySQL configuration"

        local total_mem_mb=$(($(grep MemTotal /proc/meminfo | awk '{print $2}') / 1024))
        local innodb_buffer_pool_size=$((total_mem_mb * 70 / 100))  # 70% of total memory

        cat > /etc/mysql/conf.d/performance.cnf << EOF
[mysqld]
# Performance optimizations
innodb_buffer_pool_size = ${innodb_buffer_pool_size}M
innodb_log_file_size = 256M
innodb_log_buffer_size = 16M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT
innodb_file_per_table = 1
innodb_read_io_threads = 8
innodb_write_io_threads = 8

# Query cache (if using MySQL < 8.0)
query_cache_type = 1
query_cache_size = 128M
query_cache_limit = 2M

# Connection settings
max_connections = 200
max_connect_errors = 10000
thread_cache_size = 50
table_open_cache = 4000

# Buffer settings
join_buffer_size = 256K
sort_buffer_size = 2M
read_buffer_size = 128K
read_rnd_buffer_size = 256K
EOF

        systemctl restart mysql
        log "MySQL optimization completed"
    fi

    log "Application optimization completed"
}

# Post-optimization benchmarks
post_optimization_benchmarks() {
    log "=== POST-OPTIMIZATION BENCHMARKS ==="

    # Wait for system to stabilize
    sleep 30

    # CPU performance
    log "CPU Performance Test (Post-optimization):"
    sysbench cpu --cpu-max-prime=20000 --threads=$(nproc) run > "$BENCHMARK_DIR/cpu_optimized.txt" 2>&1

    # Memory performance
    log "Memory Performance Test (Post-optimization):"
    sysbench memory --memory-total-size=10G run > "$BENCHMARK_DIR/memory_optimized.txt" 2>&1

    # Disk I/O performance
    log "Disk I/O Performance Test (Post-optimization):"
    sysbench fileio --file-total-size=5G prepare > /dev/null 2>&1
    sysbench fileio --file-total-size=5G --file-test-mode=rndrw run > "$BENCHMARK_DIR/disk_optimized.txt" 2>&1
    sysbench fileio --file-total-size=5G cleanup > /dev/null 2>&1

    log "Post-optimization benchmarks completed"
}

# Generate performance report
generate_performance_report() {
    log "=== GENERATING PERFORMANCE REPORT ==="

    local report_file="/var/log/performance-report-$(date +%Y%m%d_%H%M%S).txt"

    cat > "$report_file" << EOF
Performance Optimization Report
==============================
Date: $(date)
Hostname: $(hostname)
CPU Cores: $(nproc)
Total Memory: $(free -h | grep Mem | awk '{print $2}')
Kernel: $(uname -r)

Optimizations Applied:
- CPU governor set to performance
- Memory settings optimized (swappiness, cache pressure)
- Huge pages configured
- Disk I/O schedulers optimized
- Network buffers and TCP settings tuned
- Application-specific optimizations (Nginx, MySQL)

Benchmark Results:
See detailed results in: $BENCHMARK_DIR

Recommendations:
- Monitor system performance regularly
- Adjust settings based on workload patterns
- Consider hardware upgrades for bottlenecks
- Implement application-level caching

Next Steps:
- Regular performance monitoring
- Workload-specific tuning
- Capacity planning
EOF

    log "Performance report generated: $report_file"

    # Compare baseline vs optimized results
    if [[ -f "$BENCHMARK_DIR/cpu_baseline.txt" && -f "$BENCHMARK_DIR/cpu_optimized.txt" ]]; then
        local baseline_cpu=$(grep "events per second:" "$BENCHMARK_DIR/cpu_baseline.txt" | awk '{print $4}')
        local optimized_cpu=$(grep "events per second:" "$BENCHMARK_DIR/cpu_optimized.txt" | awk '{print $4}')

        if [[ -n "$baseline_cpu" && -n "$optimized_cpu" ]]; then
            local improvement=$(echo "scale=2; ($optimized_cpu - $baseline_cpu) / $baseline_cpu * 100" | bc)
            echo "CPU Performance Improvement: ${improvement}%" >> "$report_file"
            log "CPU Performance Improvement: ${improvement}%"
        fi
    fi
}

# Main execution
if [[ $EUID -ne 0 ]]; then
    echo "This script must be run as root"
    exit 1
fi

# Install required tools
apt update
apt install -y sysbench bc

baseline_performance
optimize_cpu
optimize_memory
optimize_disk_io
optimize_network
optimize_applications
post_optimization_benchmarks
generate_performance_report

log "Performance optimization completed successfully"
echo "Performance report and benchmarks saved to: $BENCHMARK_DIR"
echo "Reboot recommended to ensure all optimizations are active."

# Build a complete infrastructure automation solution:
# - Infrastructure as Code with Ansible/Terraform
# - Automated security hardening and compliance
# - Performance optimization and monitoring
# - Disaster recovery and backup automation
# - Documentation and knowledge management
# - Testing and validation frameworks

# Implement enterprise monitoring and alerting:
# - Multi-tier monitoring (infrastructure, application, business)
# - Predictive analytics and anomaly detection
# - Automated incident response and remediation
# - Comprehensive dashboards and reporting
# - Integration with external systems and APIs

# Create a mini Security Operations Center:
# - Centralized log collection and analysis
# - Threat detection and incident response
# - Vulnerability management and patching
# - Compliance monitoring and reporting
# - Security awareness and training programs

# Linux Certifications
# 1. CompTIA Linux+ (Entry level)
# 2. LPIC-1, LPIC-2, LPIC-3 (Linux Professional Institute)
# 3. Red Hat Certified System Administrator (RHCSA)
# 4. Red Hat Certified Engineer (RHCE)

# Networking Certifications
# 1. CompTIA Network+ (Foundation)
# 2. Cisco CCNA (Cisco networking)
# 3. CompTIA Security+ (Network security)
# 4. Certified Ethical Hacker (CEH)

# Cloud and DevOps
# 1. AWS Certified Solutions Architect
# 2. Certified Kubernetes Administrator (CKA)
# 3. Docker Certified Associate
# 4. Ansible Certified Specialist

# Security Specializations
# 1. CISSP (Information security management)
# 2. CISM (Information security management)
# 3. GSEC (SANS security essentials)
# 4. OSCP (Offensive security)

# 12-Month Professional Development Plan

## Months 1-3: Foundation Strengthening

- [ ] Complete advanced Linux administration courses
- [ ] Practice with complex networking scenarios
- [ ] Build home lab environment
- [ ] Start contributing to open-source projects
- [ ] Begin studying for first certification

## Months 4-6: Specialization

- [ ] Choose specialization area (security, cloud, networking)
- [ ] Take relevant certification exam
- [ ] Build portfolio projects
- [ ] Attend industry conferences/meetups
- [ ] Start mentoring junior colleagues

## Months 7-9: Advanced Skills

- [ ] Learn automation and orchestration tools
- [ ] Study cloud platforms and services
- [ ] Practice incident response scenarios
- [ ] Develop leadership and communication skills
- [ ] Pursue advanced certifications

## Months 10-12: Leadership and Innovation

- [ ] Lead technical projects
- [ ] Speak at conferences or write technical articles
- [ ] Develop training materials for others
- [ ] Explore emerging technologies
- [ ] Plan next year's development goals