Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#8

P0: Harden deployment file modes and service unit

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

  • forge/instance.go and forge/identity/identity.go create directories 0755; SQLite databases and audit files are commonly 0644.
  • Existing ACME cache directory permissions are not checked.
  • The systemd unit is good but can be tightened.

Scope

  • Create the data directory 0700 (or 0750 with a dedicated group) and databases/audit/host key 0600.
  • Check existing permissions at startup and warn/fail on group/world-readable secrets.
  • Add UMask=0027 to the systemd unit.
  • Consider CapabilityBoundingSet=, RestrictAddressFamilies=, PrivateDevices=true, ProtectProc=invisible, ProcSubset=pid, LimitCORE=0, and MemoryDenyWriteExecute=true where tested.
  • Ensure vole admin account backup writes 0600.
  • Document the production baseline: loopback web behind TLS, firewalled SSH, conservative limits.

Acceptance

  • A fresh install has no world-readable account database, host key, ACME key, or audit log.
  • The service starts under the hardened unit.

Comments (0)

No comments yet.