🛡️ MyZubster: From Deployment to Security Hardening

🛡️ MyZubster: From Deployment to Security Hardening

How I built a decentralized marketplace with Monero, Docker, and an AI-powered security bot—and made it production-ready.
🌱 The Vision

MyZubster is an open-source decentralized marketplace that uses Monero (XMR) for private, untraceable payments. The ecosystem consists of:

Gateway – Monero payment engine (Node.js + MongoDB)

Marketplace – RESTful API backend (Node.js + SQLite)

Frontend – React/Vite web interface (Nginx + HTTPS)

Security Bot – Automated vulnerability scanner with DeepSeek AI

This post documents the complete journey: from initial deployment on a VPS to full security hardening, including the integration of an AI-powered security bot.
🗺️ Roadmap and Priorities
Priority Task Status
🔴 High Deploy Gateway with Docker ✅ Completed
🔴 High Connect Marketplace to Gateway ✅ Completed
🟡 Medium Deploy Frontend with Nginx ✅ Completed
🟡 Medium Integrate Security Bot ✅ Completed
🟢 Low Deploy NFT template on Tari In Progress
🛠️ Technology Stack
Layer Technology Purpose
Languages JavaScript (Node.js), Python, Rust Backend, automation, blockchain
Databases MongoDB, SQLite Transactional and user data
Containerization Docker & Docker Compose Reproducible deployments
Blockchain Monero (mainnet), Tari Private payments, NFTs
Security Kali Linux, nmap, nikto, sqlmap, gobuster, DeepSeek (Ollama) Vulnerability scanning, AI analysis
Frontend React + Vite Modern web interface
Web Server Nginx with Let's Encrypt HTTPS and security headers
🔧 Step 1: Gateway Configuration
1.1 Dockerfile
dockerfile

FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
COPY . .

FROM node:20-slim
RUN groupadd -r myzubster && useradd -r -g myzubster myzubster
WORKDIR /app
COPY --from=builder --chown=myzubster:myzubster /app/node_modules ./node_modules
COPY --from=builder --chown=myzubster:myzubster /app ./
EXPOSE 3000
USER myzubster
CMD ["node", "server.js"]

1.2 docker-compose.yml
yaml

services:
mongodb:
image: mongo:7-jammy
container_name: myzubster-mongodb
restart: unless-stopped
environment:
MONGO_INITDB_ROOT_USERNAME: ${MONGO_USER:-admin}
MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:-securepassword}
volumes:
- mongodb_data:/data/db
ports:
- "27018:27017"
networks:
- myzubster-network
healthcheck:
test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
interval: 30s
timeout: 10s
retries: 5

gateway:
build:
context: .
dockerfile: Dockerfile
container_name: myzubster-gateway
restart: unless-stopped
environment:
- NODE_ENV=${NODE_ENV:-production}
- PORT=${PORT:-3000}
- MONGO_URI=mongodb://${MONGO_USER:-admin}:${MONGO_PASSWORD:-securepassword}@mongodb:27017/myzubster?authSource=admin
- MONERO_RPC_URL=${MONERO_RPC_URL:-http://node.moneroworld.com:18081}
- MONERO_NETWORK=${MONERO_NETWORK:-mainnet}
- JWT_SECRET=${JWT_SECRET}
- API_KEY=${API_KEY}
ports:
- "3001:3000"
depends_on:
mongodb:
condition: service_healthy
networks:
- myzubster-network
volumes:
- ./public:/app/public
- gateway_logs:/app/logs

volumes:
mongodb_data:
driver: local
gateway_logs:
driver: local

networks:
myzubster-network:
driver: bridge

🔗 Step 2: Connecting the Marketplace

The marketplace communicates with the gateway via REST API.
2.1 Marketplace .env
env

PORT=4000
NODE_ENV=production
DB_DIALECT=sqlite
DB_STORAGE=./data/marketplace.sqlite
MYZUBSTER_API_URL=http://localhost:3001/api
MYZUBSTER_API_TOKEN=your_api_token
MONERO_NETWORK=mainnet
MONERO_RPC_URL=http://node.moneroworld.com:18081
MONERO_WALLET_ADDRESS=your_wallet_address
MONERO_WALLET_PASSWORD=your_wallet_password
MONERO_MIN_CONFIRMATIONS=10
JWT_SECRET=your_jwt_secret
JWT_EXPIRES_IN=7d

2.2 Verify Integration
bash

curl http://localhost:4000/api/health

{"status":"ok","service":"MyZubster-Marketplace","database":"sqlite"}

curl http://localhost:4000/api/gateway/status

{"gateway":{"status":"ok"},"status":"connected"}

🛡️ Step 3: Security Hardening
3.1 JWT Authentication
javascript

const authenticate = (req, res, next) => {
const publicRoutes = ['/api/health', '/api/auth/login', '/api/auth/register'];
if (publicRoutes.includes(req.path)) return next();

const authHeader = req.headers.authorization;
if (!authHeader) return res.status(401).json({ error: 'Token required' });

try {
const token = authHeader.split(' ')[1];
const decoded = jwt.verify(token, process.env.JWT_SECRET);
req.user = decoded;
next();
} catch {
res.status(401).json({ error: 'Invalid or expired token' });
}
};
app.use('/api', authenticate);

3.2 Rate Limiting
javascript

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 100,
message: 'Too many requests, please try again later',
});

app.use('/api', limiter);

3.3 UFW Firewall
bash

ufw default deny incoming
ufw allow from YOUR_IP to any port 22
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow from YOUR_IP to any port 3001
ufw allow from YOUR_IP to any port 4000
ufw enable

3.4 Nginx Security Headers
nginx

add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;

🤖 Step 4: AI-Powered Security Bot

The security bot performs automated vulnerability scanning using Kali Linux tools and DeepSeek AI.
4.1 Security Bot Code
python

!/usr/bin/env python3

import subprocess
import json
import logging
import datetime
import requests

def run_nmap():
return subprocess.run("nmap -sV --script=default localhost",
shell=True, capture_output=True, text=True).stdout

def run_nikto():
return subprocess.run("nikto -h https://myzubster.com -ssl",
shell=True, capture_output=True, text=True).stdout

def run_sqlmap():
return subprocess.run("sqlmap -u localhost --batch --level=1 --risk=1",
shell=True, capture_output=True, text=True).stdout

def run_gobuster():
return subprocess.run("gobuster dir -u localhost -w /usr/share/wordlists/dirb/common.txt -t 50",
shell=True, capture_output=True, text=True).stdout

def main():
results = {
"timestamp": datetime.datetime.now().isoformat(),
"scans": {
"nmap": run_nmap(),
"nikto": run_nikto(),
"sqlmap": run_sqlmap(),
"gobuster": run_gobuster()
}
}
timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
with open(f"/var/log/security_report_{timestamp}.json", 'w') as f:
json.dump(results, f, indent=2)

4.2 Sample Report
json

{
"timestamp": "2026-07-26T09:12:11.584991",
"target": "localhost",
"scans": {
"nmap": "22/tcp open ssh OpenSSH 9.6p1...",
"nikto": "SSL Info: Subject: /CN=myzubster.com...",
"sqlmap": "All tested parameters are not injectable...",
"gobuster": "No vulnerabilities found..."
}
}

4.3 Automate with Cron
bash

0 * * * * /usr/bin/python3 /root/MyZubsterGateway/security/security_bot.py >> /var/log/security_bot.log 2>&1

✅ Final Results

After completing the deployment and security hardening, all services are operational:
Service Endpoint Status
Gateway /api/health {"status":"ok"}
Marketplace /api/health {"status":"ok"}
Integration /api/gateway/status "connected"
Frontend / HTTPS 200 OK
Security Bot Cron job ✅ Running hourly
Security Headers Verified
text

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'...
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=()

💡 Lessons Learned

Docker simplifies deployment – Containerization made the process reproducible and scalable.

Security is a layered approach – JWT, rate limiting, UFW, and Nginx headers work together.

Automated scanning saves time – The security bot runs hourly, producing detailed reports.

HTTPS is non-negotiable – Let's Encrypt makes it easy and free.

Header security is essential – CSP, HSTS, and X-Frame-Options protect against common attacks.

Local AI has tradeoffs – DeepSeek provides intelligent analysis but can be slow on limited hardware.

Backup access is critical – KVM/iDRAC access saved the day when UFW blocked SSH.

🔮 Next Steps

Deploy the Mobile App to Google Play Store

Integrate NFC payments for physical interactions

Implement DAO Governance for community decisions

Complete Security Audit with third-party tools

Add more NFT functionality for real-world asset tokenization

📚 Repository & Documentation

All code is available on GitHub:
Repository Description Stars
MyZubsterGateway Monero payment engine ⭐ 3
MyZubster-Marketplace Backend API ⭐ 1
myzubster-frontend React frontend ⭐ 0
MyZubster-App Mobile app ⭐ 1
tari-nft-template NFT template ⭐ 1
my-monero-bounty Micro-bounty system ⭐ 0
🤝 Contribute

If you're interested in blockchain, privacy-first payments, or decentralized markets, contribute to the repositories on GitHub or open an issue to discuss new features.

Key areas for contribution:

Frontend: Improve the admin dashboard

Testing: Add webhook integration tests

Documentation: Write tutorials for new users

Security: Conduct penetration testing

🌐 Connect with Me

Blog: DEV.to - Daniel Ioni

X (Twitter): @myzubster

LinkedIn: Daniel Ioni

GitHub: DanielIoni-creator

TikTok: @h4x0r_23

Built with ❤️ for Monero, open source, and the global community. 🌱

Originally published on DEV.to