#!/bin/bash
# Add Phase 1 DDoS Protection section to Project Scope

cd ~/firefrost-work/firefrost-operations-manual

# Create the Phase 1 section to insert
cat > /tmp/phase1-section.md << 'PHASE1EOF'

---

## 🛡️ PHASE 1: DDoS PROTECTION SYSTEM

### Overview

**Status:** Planning Phase  
**Priority:** Deploy after Phase 0.5 completion, before soft launch  
**Purpose:** Replace dismantled Phase 0 GRE system with reliable protection

### Phase 0 Context (Completed)

**What Was Dismantled:**
- Complex GRE tunnel configuration
- IP cloaking system prone to failures
- Over-engineered solution causing more problems than it solved

**Why It Was Removed:**
- Frequent connectivity issues
- Difficult to troubleshoot
- Required constant maintenance
- Prevented reliable infrastructure operations

### Phase 1 Goals

**Primary Objective:** Implement "good enough" DDoS protection that:
- ✅ Protects against common attacks (Layer 3/4)
- ✅ Doesn't break during normal operations
- ✅ Easy to maintain and troubleshoot
- ✅ Minimal complexity vs Phase 0

**NOT trying to:**
- ❌ Defend against state-level actors
- ❌ Create perfect invisibility
- ❌ Over-engineer like Phase 0

### Proposed Architecture (To Be Designed)

**Option A: Cloudflare Spectrum (Simplest)**
- Pros: Managed service, no infrastructure complexity
- Cons: Monthly cost, less control
- Best for: Quick deployment, low maintenance

**Option B: Simplified GRE + Cloudflare**
- Pros: More control, proven technology
- Cons: Requires careful implementation
- Best for: Custom requirements, cost control

**Option C: Hybrid Approach**
- VPS services behind Cloudflare
- Game servers with lightweight protection
- Best for: Tiered protection based on risk

**Decision Point:** Design session after Phase 0.5 completion

### Implementation Timeline

**Pre-Launch Requirements:**
1. Assess actual threat level (public launch = attack surface)
2. Design session: Choose architecture
3. Document decision rationale
4. Test implementation on non-critical service
5. Deploy to production

**Estimated Effort:** 4-8 hours (depends on approach chosen)

**Target Date:** Before soft launch (late February 2026)

### Success Metrics

- Withstands common DDoS attacks (volumetric, SYN floods)
- 99.9%+ uptime during normal operations
- < 1 hour maintenance per month
- Zero "midnight emergency" pages

### Fallback Plan

If Phase 1 protection proves inadequate:
- Cloudflare Spectrum as immediate mitigation
- Re-evaluate threat model
- Consider managed DDoS services
- Iterate rather than over-engineer

---

PHASE1EOF

# Find the right insertion point (after Phase 0.5, before Timeline)
# Insert before "## 📅 IMPLEMENTATION TIMELINE"

# Use awk to insert the new section
awk '/## 📅 IMPLEMENTATION TIMELINE/ {
    while ((getline line < "/tmp/phase1-section.md") > 0) {
        print line
    }
}
{print}' docs/FIREFROST-PROJECT-SCOPE-V2.md > /tmp/scope-updated.md

# Replace the original
mv /tmp/scope-updated.md docs/FIREFROST-PROJECT-SCOPE-V2.md

# Commit
git add docs/FIREFROST-PROJECT-SCOPE-V2.md
git commit -m "Add Phase 1 DDoS Protection section to Project Scope

Documented:
- Phase 0 dismantling context (what/why removed)
- Phase 1 goals (simplified, maintainable protection)
- Three architecture options (Cloudflare, GRE, Hybrid)
- Implementation timeline (after Phase 0.5, before launch)
- Success metrics and fallback plan

Design session needed after Phase 0.5 completion to choose approach.
Principle: Always revise scope when revision identified."

git push

echo "Phase 1 DDoS Protection section added to Project Scope V2"
