Закрыли часть проблем с безопасностью + мелкие починки

codebase/backend/tests/test_config.py

@@ -75,6 +75,29 @@ class InfrastructureConfigTests(unittest.TestCase):
         self.assertIn('NGINX_HTTP_PORT:-80}:80', nginx)
         self.assertIn('NGINX_HTTPS_PORT:-443}:443', nginx)
 
+    def test_vm_and_nginx_security_defaults(self) -> None:
+        setup = (ROOT / "deployment/scripts/setup-vm.sh").read_text(encoding="utf-8")
+        env_example = (ROOT / ".env.example").read_text(encoding="utf-8")
+        compose = (ROOT / "nginx/docker-compose.yml").read_text(encoding="utf-8")
+        ssl_renew = (
+            ROOT / "deployment/scripts/ssl-renew.sh"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("LOCK_ACCOUNT_PASSWORDS=true", setup)
+        self.assertIn('passwd --lock root', setup)
+        self.assertIn('passwd --lock "$DEPLOY_USER"', setup)
+        self.assertIn("X11Forwarding no", setup)
+        self.assertIn("PasswordAuthentication no", setup)
+        self.assertIn("NGINX_HSTS_MAX_AGE=31536000", env_example)
+        self.assertIn("NGINX_HSTS_MAX_AGE:-31536000", compose)
+        self.assertIn("compose kill --signal HUP nginx", ssl_renew)
+        executable_ssl_renew = "\n".join(
+            line
+            for line in ssl_renew.splitlines()
+            if not line.lstrip().startswith("#")
+        )
+        self.assertNotIn("nginx -s reload", executable_ssl_renew)
+
     def test_nginx_internal_denies_precede_spa(self) -> None:
         site = (ROOT / "nginx/templates/site-tls.conf.template").read_text(encoding="utf-8")
         compose = (ROOT / "nginx/docker-compose.yml").read_text(encoding="utf-8")