# Planned Features

This document tracks planned features and enhancements for the Bash Script Generator.

## Automated Security Patching Based on CVE Databases

### Overview
Add automated security patching functionality that monitors CVE (Common Vulnerabilities and Exposures) databases and applies security patches based on reliable CVE reports.

### Goals
- Automate security patch management
- Integrate with reliable CVE databases (NVD, Ubuntu Security Notices, etc.)
- Provide scheduled patching options
- Generate reports on applied patches
- Support for different patch urgency levels (Critical, High, Medium, Low)

### Proposed Implementation

#### Features to Include:
1. **CVE Database Integration**
   - NVD (National Vulnerability Database)
   - Ubuntu Security Notices (USN)
   - Debian Security Advisories (DSA)
   - Package-specific CVE tracking

2. **Patch Management Script**
   - Automated vulnerability scanning
   - Patch availability checking
   - Selective patching (by severity level)
   - Dry-run mode for testing
   - Rollback capabilities

3. **Scheduling Options**
   - Daily automated security updates
   - Weekly patch review and application
   - Manual trigger option
   - Maintenance window scheduling

4. **Reporting**
   - CVE reports (affected packages, severity)
   - Patch application logs
   - System compliance status
   - Email/notification support

5. **Configuration Options**
   - Severity thresholds (Critical/High only, or all)
   - Exclude specific packages from auto-patching
   - Whitelist/blacklist packages
   - Reboot requirements handling

### Technical Considerations

#### Tools to Integrate:
- `apt-listchanges` - View changelogs
- `unattended-upgrades` - Already included, enhance configuration
- `apt-audit` or similar - CVE scanning
- `debsums` - Verify package integrity
- Custom CVE API integration

#### Script Structure:
```bash
# Proposed function structure
scan_cve_vulnerabilities()
apply_security_patches()
generate_cve_report()
schedule_automatic_patching()
```

### UI Integration

Add to the web form:
- [ ] Enable automated CVE-based patching
- [ ] Select severity levels (Critical, High, Medium, Low)
- [ ] Configure update schedule (Daily, Weekly, Manual)
- [ ] Set maintenance window
- [ ] Configure email notifications
- [ ] Package exclusion list

### Security Considerations

- Ensure patches are from official repositories only
- Verify package signatures
- Test patches in staging before production
- Maintain audit logs
- Support for air-gapped systems

### Future Enhancements

- Integration with vulnerability scanners (OpenVAS, Nessus)
- Compliance reporting (CIS Benchmarks, STIG)
- Multi-server management
- Patch testing in containers before applying
- Integration with SIEM systems

### Status
**Status:** Planned for future release  
**Priority:** High  
**Estimated Complexity:** Medium-High

---

## Other Planned Features

### Additional server setup options
- [ ] SELinux/AppArmor configuration
- [ ] Log rotation and centralized logging (rsyslog, syslog-ng)
- [ ] Backup automation (rsync, rclone, cloud storage)
- [ ] SSL/TLS certificate management (Let's Encrypt automation)
- [ ] Database server setup (PostgreSQL, MySQL, MongoDB)
- [ ] Web server configuration (Nginx, Apache)
- [ ] Load balancer setup (HAProxy, Nginx)
- [ ] Monitoring stack (Prometheus, Grafana, AlertManager)
- [ ] Container orchestration (Kubernetes, Docker Swarm)

### UI Enhancements
- [ ] Profile presets (Safe remote server, Console access, Lab/dev box)
- [ ] Script preview before download
- [ ] Save/load configurations
- [ ] Multi-language support
- [ ] Dark mode

### Script Generator Improvements
- [ ] Support for other Linux distributions (CentOS/RHEL, Debian, Alpine)
- [ ] Cloud provider specific optimizations (AWS, Azure, GCP)
- [ ] Idempotency improvements
- [ ] Better error handling and rollback
- [ ] Script validation and testing

---

**Last Updated:** 2026-01-27  
**Maintainer:** Avni Ademi (@avni.ademi)