Security, Backup & ScyllaDB

# Enable authentication (default: AllowAllAuthenticator)
authenticator: PasswordAuthenticator

# Enable authorization (default: AllowAllAuthorizer)
authorizer: CassandraAuthorizer

# Role management
role_manager: CassandraRoleManager

# Password hashing rounds (higher = more secure, slower login)
credentials_validity_in_ms: 2000
credentials_update_interval_in_ms: 1000

-- Default superuser (change password immediately!)
-- Username: cassandra, Password: cassandra
ALTER USER cassandra WITH PASSWORD 'new_secure_password';

-- Create application roles
CREATE ROLE app_readwrite WITH PASSWORD = 'strong_pass_123'
  AND LOGIN = true;

CREATE ROLE app_readonly WITH PASSWORD = 'strong_pass_456'
  AND LOGIN = true;

CREATE ROLE admin_role WITH PASSWORD = 'admin_pass_789'
  AND LOGIN = true AND SUPERUSER = true;

-- Grant permissions
GRANT SELECT ON KEYSPACE my_app TO app_readonly;
GRANT SELECT, MODIFY ON KEYSPACE my_app TO app_readwrite;
GRANT ALL PERMISSIONS ON ALL KEYSPACES TO admin_role;

-- Fine-grained permissions
GRANT SELECT ON TABLE my_app.users TO app_readonly;
GRANT MODIFY ON TABLE my_app.sessions TO app_readwrite;

-- Revoke permissions
REVOKE MODIFY ON KEYSPACE my_app FROM app_readonly;

-- List permissions
LIST ALL PERMISSIONS OF app_readwrite;

# Client-to-node encryption (application → Cassandra)
client_encryption_options:
  enabled: true
  optional: false          # Require TLS (reject unencrypted connections)
  keystore: /etc/cassandra/keystore.jks
  keystore_password: changeit
  truststore: /etc/cassandra/truststore.jks
  truststore_password: changeit
  protocol: TLS            # TLSv1.2 minimum recommended
  cipher_suites:
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  require_client_auth: false  # Set true for mutual TLS

# Node-to-node encryption (Cassandra ↔ Cassandra)
server_encryption_options:
  internode_encryption: all  # Options: none, dc, rack, all
  keystore: /etc/cassandra/keystore.jks
  keystore_password: changeit
  truststore: /etc/cassandra/truststore.jks
  truststore_password: changeit
  require_client_auth: true  # Mutual TLS between nodes

Network Security Architecture:

┌─────────────────────────────────────────────────────────┐
│ Application Layer (VPC/Subnet A)                        │
│                                                         │
│  [App Server 1]  [App Server 2]  [App Server 3]        │
│       │               │               │                 │
│       └───────────────┼───────────────┘                 │
│                       │ Port 9042/9142 only             │
└───────────────────────┼─────────────────────────────────┘
                        │
                   ┌────▼────┐ (Security Group / Firewall)
                   │ Allow:  │
                   │ 9042    │ from app subnet
                   │ 7000    │ from cassandra subnet
                   │ 7199    │ from admin subnet
                   └────┬────┘
                        │
┌───────────────────────┼─────────────────────────────────┐
│ Cassandra Layer (VPC/Subnet B)                          │
│                       │                                  │
│  [Cass Node 1] ◄────►[Cass Node 2] ◄────► [Cass Node 3]│
│       Port 7000/7001 (inter-node)                       │
└─────────────────────────────────────────────────────────┘

Rules:
  ✅ 9042: Only from application subnet
  ✅ 7000/7001: Only between Cassandra nodes
  ✅ 7199: Only from admin/monitoring hosts
  ❌ Never expose 7000/7199 to the internet
  ❌ Never expose 9042 to the internet (use VPN/bastion)

# Take a snapshot of all keyspaces
nodetool snapshot -t daily_backup_2024_01_15

# Take a snapshot of a specific keyspace
nodetool snapshot my_keyspace -t my_snapshot

# Snapshot location:
# <data_dir>/<keyspace>/<table>/snapshots/<snapshot_name>/

# List snapshots
nodetool listsnapshots

# Clear a snapshot (free disk space)
nodetool clearsnapshot -t daily_backup_2024_01_15

# Restore from snapshot:
# 1. Stop Cassandra
# 2. Clear commitlog and data directories
# 3. Copy snapshot SSTable files to the table's data directory
# 4. Start Cassandra
# 5. Run nodetool repair to ensure consistency

Disaster Recovery Strategy (Multi-DC):

Primary defense: Multi-DC replication
  - RF=3 in each of 2+ DCs
  - LOCAL_QUORUM ensures each DC is self-sufficient
  - DC failure = automatic failover (no action needed)

Secondary defense: Regular backups
  - Daily snapshots uploaded to S3/GCS (cross-region)
  - Medusa for automated, coordinated cluster backup
  - Retain 7-30 days of snapshots

Recovery procedures:
  1. Single node: replace with new node, run repair
  2. Multiple nodes: replace, rebuild from remaining replicas
  3. Full DC: add new DC, run nodetool rebuild
  4. Logical corruption: restore from last known-good snapshot
  5. Complete loss: restore all nodes from backup, repair

Testing:
  - Quarterly DR drills (restore from backup to test cluster)
  - Chaos engineering (kill nodes/racks, verify automatic recovery)
  - Validate backup integrity (restore and query sample data)

Migrating from Cassandra to ScyllaDB:

1. Schema: Export with cqlsh, import directly (100% CQL compatible)
2. Data: Use Spark migrator, sstableloader, or ScyllaDB Migrator
3. Drivers: Same Cassandra drivers work unchanged
4. Operations: scylla replaces cassandra process
              nodetool works the same (or use scylla-tools)
5. Configuration: scylla.yaml similar to cassandra.yaml

Key differences in operation:
  - No JVM tuning needed (no heap, no GC configuration)
  - CPU pinning is automatic (shard-per-core)
  - I/O scheduler is self-tuning
  - Compaction runs per-shard (parallel, no global lock)
  - Repair is faster (parallel, per-shard)

Typical migration result:
  Cassandra: 12 nodes, i3.2xlarge, 8 GB heap each
  ScyllaDB:  3 nodes, i3.2xlarge (same hardware, 4x fewer nodes)
  Same throughput, lower p99 latency