Консультация по поводу стабильной архитектуры веб-приложения (DevOps)

Good day. A virus blackfl has penetrated the server and encrypted the files. It needs to be removed and the server's operation normalized.

It is necessary to deploy the open-source banking accounting platform Apache Fineract on a VPS (AWS Free Tier, Ubuntu OS) using Docker-compose, set up the database, and demonstrate basic functions.Main tasks:Install Docker and Docker Compose on the provided AWS server (Ubuntu).Deploy the official Apache Fineract image and the database (MySQL/MariaDB).Configure port forwarding and check the operation of the REST API and web interface (Community App).Create a Super Administrator account.Provide a short text manual or conduct a brief call/video demonstrating the execution of the following scenarios in the system:Creating a client, opening an account, deposit, and withdrawal;The mechanism for internal P2P transfers and interbank transactions;Navigation through the accounting module (General Ledger) and chart of accounts;Viewing audit logs (write-offs/losses of funds) and the return procedure (chargeback/refund).Work result:A working system with SSH access and Admin panel, a short manual/video demonstrating 6 business scenarios.

We are looking for the DEVOPS / OPSEC specialist to overview our current project setup from the soct optimization side and security.

Who can help set up such a setup: I plan to deploy a server that will work in parallel with 4–5 different AI models for programming tasks. The key requirement is multi-user access: several developers will be able to use the server simultaneously, each in an isolated session with their own agents. Models Claude / GPT / Kimi k3

As part of enhancing the cybersecurity level of our infrastructure, we need to abandon the practice of storing "eternal" and static API keys, passwords, and integration tokens in the configuration files (.env, appsettings.json, config.yaml) of our microservices. Business Goal: Create a single secure storage point for confidential data (secrets) with a mechanism for their automatic updating (rotation) in external systems on a schedule. Our other services will request current tokens "on the fly" via API, which will minimize damage in case of compromise of any system component.Security Model and Encryption (Crypto Core) No secret should be stored in plaintext in the database. Upon application startup, a Master Key is passed to the environment variables. If the key is missing or has an invalid length, the service should fail at the initialization stage with a clear error in the logs. Each secret is encrypted before being written to the database using this Master Key. Upon request, it is decrypted in memory and returned in the response body.Audit Logging (Audit Trail) Any action with secrets (creation, reading by the service, successful or unsuccessful rotation) must be recorded in a separate log file audit.log (or a separate table in the database). Strict Taboo: It is strictly prohibited to record the actual values of secrets in the audit log (neither in plaintext nor in encrypted form).