Platform-level security posture for victorpatrin.dev. Application-level security (auth, JWT, rate limiting) lives in each app repo. All hardening is codified in the Ansible security role and validated on every fresh provision.

• Deploy user in Docker group is root-equivalent: required for docker compose — mitigated by SSH key in vault, fail2ban, AllowUsers, and auditd on the Docker socket. Goes away with K3s migration (Phase 7).
• Deploy user has scoped sudo to write systemd units: tee to specific unit file paths (pg-backup, disk-alert, coupette-scraper, coupette-availability). Doesn't expand blast radius beyond Docker group membership.
• Docker socket mounted into Alloy (read-only): grants read access to the Docker API — can list containers, inspect images, read env vars. Mitigated by read_only: true, cap_drop: ALL, internal-only network, and no-new-privileges. Required for container log tailing. Goes away with K3s migration (journal/CRI logs replace Docker socket).
• Caddy admin API on 0.0.0.0:2019: reachable from any container on the internal network, not just Alloy. Read-only config endpoint used for health checks and Prometheus scraping. No write operations exposed. Will be locked to Alloy-only via NetworkPolicy on K3s.
• cAdvisor runs without cap_drop: ALL: requires pid: host and cgroup: host for container metrics collection. Mitigated by read_only: true, no-new-privileges, 128m memory limit, and internal-only network access.
• Umami uses floating tag (postgresql-latest): no digest pin — a push to the tag could pull a breaking change. Pinning was attempted but the digest-pinned image lacked ARM64 support. Acceptable at this scale; Umami is stateless and recoverable.
• Brief downtime during maintenance window (~6:00–7:00 UTC): containers restart automatically, but there's a brief window where services are unavailable. Acceptable for a solo-dev VPS with no SLA.
• No drain/health-check before restart: unlike K3s with kured, there's no graceful pod draining. Services stop and start. At this scale, this is fine.

Security patches are applied automatically. The maintenance window is 6:00–7:00 UTC — the only time services or the kernel may restart.

Configuration (Ansible security role via geerlingguy.security):

• security_autoupdate_enabled: true — unattended-upgrades active
• security_autoupdate_reboot: true — auto-reboot after kernel updates
• security_autoupdate_reboot_time: "07:00" — reboot after apt finishes (~6:00–7:00 UTC)
• needrestart mode 'a' (automatic) — restarts services without prompting after apt

1. Hetzner cloud firewall — applied at the network edge before traffic reaches the VPS. Only ports 22, 80, 443 open.
2. ufw on the VPS — defense in depth. Same port allowlist: 22, 80, 443.

All services communicate over a shared Docker network (internal). Only Caddy binds to host ports 80/443 — everything else is internal-only.

No service except Caddy has a host port binding in the base compose. Dev port bindings (PostgreSQL, Grafana, Prometheus, Alloy) are in docker-compose.dev.yml. Production adds localhost-only bindings for SSH tunnel access to the observability stack.

Caddy handles automatic HTTPS via Let's Encrypt (ACME). Certificates are auto-renewed — no manual intervention required.

• HSTS with 2-year max-age (max-age=63072000; includeSubDomains)
• HTTP → HTTPS redirect handled automatically

Applied to all sites via a shared Caddyfile snippet:

Every container in docker-compose.yml follows these security defaults:

Configured via geerlingguy.security + /etc/ssh/sshd_config.d/hardening.conf (Ansible security role).

OpenSSH 10.0 (Debian 13) removed ChallengeResponseAuthentication — replaced by KbdInteractiveAuthentication.

Sysctl parameters in /etc/sysctl.d/99-hardening.conf (Ansible security role). Not /etc/sysctl.conf — deprecated in Debian 13.

net.ipv4.ip_forward stays 1 — required for Docker networking (CIS recommends 0 but Docker breaks without it).

Unused filesystem and network protocol modules are blacklisted via /etc/modprobe.d/hardening.conf: cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf, dccp, sctp, rds, tipc, usb-storage, firewire-core. Reduces kernel attack surface — none of these are needed on a Docker VPS.

Mount options applied by Ansible security role.

auditd with immutable rules in /etc/audit/rules.d/hardening.rules (Ansible security role).

Two encryption layers for different lifecycle stages:

sops + age: production secrets committed as .env.prod.enc per service. Deploy script decrypts at deploy time using SOPS_AGE_KEY from the environment. Decrypted files created with umask 077 (owner-only).

ansible-vault: bootstrap secrets in ansible/group_vars/all/vault.yml. Encrypted with AES-256, decrypted by ~/.ansible_vault_pass on the operator's laptop. Never touches CI or the VPS.

Development .env files live on disk (gitignored). Each service has a committed .env.example with placeholder values.

Run after provisioning or major changes to validate hardening.

Stateful data lives in Docker volumes. Two volumes are external: true (pre-existing, not recreated on docker compose down):

Backups cover PostgreSQL only. All other volumes are considered recoverable — observability data rebuilds from live sources, Caddy certs auto-renew. See ARCHITECTURE.md for backup strategy.

Context: All containers ran with default capabilities — full Linux capability set, no memory limits, no log rotation. Action: Added cap_drop: ALL + minimal cap_add, no-new-privileges, log rotation (10MB × 3), healthchecks to every service. Umami set to read_only: true. Only three services retain caps: Caddy (NET_BIND_SERVICE), PostgreSQL (SETUID/SETGID/CHOWN/FOWNER/DAC_READ_SEARCH), Alloy (DAC_READ_SEARCH/DAC_OVERRIDE).

Context: Caddy served traffic with no security headers — no HSTS, no CSP, no clickjacking protection. Action: Added shared Caddyfile snippet with HSTS (2yr), X-Frame-Options DENY, CSP, Referrer-Policy, Permissions-Policy. Removed Server header. All sites inherit via import security_headers; per-site CSP overrides where needed.

Context: PostgreSQL, Umami, and Uptime Kuma ran as separate repos with inconsistent security posture. Action: Absorbed all services into single repo. Applied uniform hardening (cap_drop, no-new-privileges, log rotation) across all containers.

Context: Push monitor URLs (Uptime Kuma heartbeat endpoints) needed to be accessible to systemd timers without being in the repo. Action: Stored push URLs in sops-encrypted secrets/<monitor>.env.enc files. Deploy script decrypts to secrets/<monitor>.env at deploy time. Systemd units load via EnvironmentFile.

Context: Production .env files lived on the VPS with no encryption, no version control, no audit trail. Losing the VPS meant losing all secrets. Action: Encrypted all production secrets with sops + age, committed as .env.prod.enc. Deploy script decrypts at deploy time with SOPS_AGE_KEY. Decrypted files created with umask 077. Secrets now version-controlled (encrypted), recoverable from git, deploy-time only on disk.

Context: CI deploys ran as the admin user — overprivileged for automated workloads. Action: Created dedicated deploy system user with scoped sudo (systemd commands only). Dedicated ed25519 SSH deploy key for GitHub Actions. Admin (admin) and automation (deploy) are now separate users with separate privilege sets.

Context: Alloy needs host filesystem access (/proc, /sys, /) for node metrics and Docker socket for log collection — broad attack surface. Action: read_only: true, no-new-privileges, cap_drop: ALL + only DAC_READ_SEARCH/DAC_OVERRIDE. Docker socket mounted read-only. All observability services internal-only — no host port bindings in base compose, no internet exposure.

Context: All sites shared a single CSP policy. Coupette needed unsafe-eval for a Telegram widget, but other sites shouldn't have it. Action: Moved CSP to per-site configuration in Caddyfile. Each domain block defines its own CSP policy — only coupette.club allows unsafe-eval.

Context: VPS provisioning was manual (VPS_SETUP_GUIDE.md). No kernel sysctl hardening, no SSH crypto pinning, no filesystem mount hardening, no audit logging. Action: Ansible playbook codifies full VPS setup. Added: sysctl hardening (28 parameters from CIS/ANSSI/dev-sec/Lynis), SSH crypto pinning (post-quantum KEX, AEAD-only ciphers, ETM MACs, AllowUsers), /tmp and /dev/shm noexec mounts, auditd with immutable rules covering identity files, sudoers, Docker socket, and SSH config. Validated with Lynis audit: baseline Debian 13 scores 64/100, after hardening 80/100 (+16). Remaining suggestions triaged — most are noise at single-VPS scale (GRUB password, separate partitions, password aging on key-only users). Sources: CIS Debian Linux Benchmark, ANSSI-BP-028 v2.0, dev-sec.io baselines, ssh-audit.com, Lynis 3.1.4.

Context: Uptime Kuma failed to start on fresh volumes — cap_drop: ALL prevented it from creating data/upload/. Fail2ban with maxretry: 3 banned the operator after 3 Ansible runs (Phase 1 root SSH probe counts as a failed attempt). Action: Added cap_add: [CHOWN, DAC_OVERRIDE] to Uptime Kuma. Bumped fail2ban maxretry from 3 to 5.

Context: Coupette app deploy script needed sudo tee and sudo systemctl for its own systemd timers (scraper, availability), but the deploy user's scoped sudoers only allowed infra timers. Action: Added coupette-scraper and coupette-availability service/timer units to the deploy user's scoped sudoers in the Ansible infra role.

• CIS Debian Linux Benchmark — Level 1 and Level 2 controls
• ANSSI-BP-028 v2.0 — French cybersecurity agency Linux hardening guide
• dev-sec.io Linux Baseline — Ansible/InSpec hardening framework
• dev-sec.io SSH Baseline
• ssh-audit.com hardening guides — Algorithm-specific SSH configuration
• OVH debian-cis — CIS benchmark scripts for Debian