From 2e1ce9f08ace27732402743056b669ae730fc23b Mon Sep 17 00:00:00 2001
From: MrSnowy <snow@mrsnowy.dev>
Date: Thu, 29 Jan 2026 23:25:39 +0100
Subject: [PATCH] Caddy service hardening

---
 hosts/server/default.nix              |  2 +-
 hosts/server/services/caddy.nix       | 48 +++++++++++++++++++++++++--
 hosts/server/services/random.nix      |  9 +++--
 hosts/server/system/configuration.nix | 32 ++++++++++++++----
 hosts/server/system/network.nix       |  1 +
 5 files changed, 80 insertions(+), 12 deletions(-)

diff --git a/hosts/server/default.nix b/hosts/server/default.nix
index ad37beb..020ae03 100644
--- a/hosts/server/default.nix
+++ b/hosts/server/default.nix
@@ -30,7 +30,7 @@
     ./containers
     ./services
 
-    ../sops
+    ../../sops
     args.flakes.home-manager.nixosModules.home-manager
   ];
 
diff --git a/hosts/server/services/caddy.nix b/hosts/server/services/caddy.nix
index b64cdba..3ee6d63 100644
--- a/hosts/server/services/caddy.nix
+++ b/hosts/server/services/caddy.nix
@@ -1,7 +1,5 @@
 {
   config,
-  lib,
-  pkgs,
   ...
 }:
 let
@@ -163,4 +161,50 @@ in
     '';
   };
 
+  systemd.services.caddy.serviceConfig = {
+    RemoveIPC = true;
+    ProtectSystem = "strict";
+    CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+    AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+
+    ProtectClock = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    ProtectKernelLogs = true;
+    ProtectControlGroups = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    UMask = "0077";
+
+    SystemCallArchitectures = "native";
+    RestrictSUIDSGID = true;
+    LockPersonality = true;
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    MemoryDenyWriteExecute = true;
+    PrivateDevices = true;
+    DevicePolicy = "closed";
+    DeviceAllow = [ "" ];
+
+    SystemCallFilter = [
+      "~@privileged"
+      "~@resources"
+      "~@mount"
+      "~@reboot"
+      "~@obsolete"
+      "~@clock"
+      "~@cpu-emulation"
+      "~@debug"
+      "~@module"
+      "~@raw-io"
+      "~@swap"
+    ];
+    SystemCallErrorNumber = "EPERM";
+  };
 }
diff --git a/hosts/server/services/random.nix b/hosts/server/services/random.nix
index 83af24d..d24104d 100644
--- a/hosts/server/services/random.nix
+++ b/hosts/server/services/random.nix
@@ -1,12 +1,9 @@
 {
   config,
-  lib,
-  pkgs,
   ...
 }:
 
 {
-
   services = {
     openssh = {
       enable = true;
@@ -18,7 +15,13 @@
       authorizedKeysInHomedir = false;
       settings = {
         PasswordAuthentication = false;
+        AllowTcpForwarding = false;
+        TCPKeepAlive = false;
         PermitRootLogin = "no";
+        MaxAuthTries = 3;
+        ClientAliveCountMax = 2;
+        MaxSessions = 2;
+        LogLevel = "VERBOSE";
         AllowUsers = [
           "snow"
           "file-backup"
diff --git a/hosts/server/system/configuration.nix b/hosts/server/system/configuration.nix
index aedde5d..b48f278 100644
--- a/hosts/server/system/configuration.nix
+++ b/hosts/server/system/configuration.nix
@@ -69,13 +69,25 @@
       # Disable ftrace debugging
       "kernel.ftrace_enabled" = false;
 
+      "dev.tty.ldisc_autoload" = 0; # disallow loading ldiscs
+      "fs.protected_fifos" = 2; # protect /tmp
+      "fs.protected_regular" = 2; # protect /tmp
+      "fs.suid_dumpable" = 0; # disable core dumping of privilaged prograns
+      "kernel.sysrq" = 0; # Disallow sysrq keybinds, not needed for a server.
+      "net.core.bpf_jit_harden" = 2;
+
       # Disable bpf() JIT (to eliminate spray attacks)
       # "net.core.bpf_jit_enable" = false;
 
       # https://wiki.archlinux.org/title/Sysctl#Enable_TCP_Fast_Open
       "net.ipv4.tcp_fastopen" = 3;
 
+      # for containers :3
       "kernel.unprivileged_userns_clone" = 1;
+
+      # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
+      "net.core.rmem_max" = 7500000;
+      "net.core.wmem_max" = 7500000;
     };
 
     loader = {
@@ -92,10 +104,18 @@
     };
 
     blacklistedKernelModules = [
+      # USB storage protocols
+      "usb-storage"
+      "uas"
+
       # Obscure network protocols
       "ax25"
       "netrom"
       "rose"
+      "dccp"
+      "sctp"
+      "rds"
+      "tipc"
 
       # Old or rare or insufficiently audited filesystems
       "adfs"
@@ -162,10 +182,12 @@
   };
 
   security = {
-    # lockKernelModules = true;
+    lockKernelModules = true;
     protectKernelImage = true;
 
-    auditd.enable = true;
+    # auditd = {
+    #   enable = true;
+    # };
     sudo.enable = false;
     sudo-rs = {
       enable = true;
@@ -216,6 +238,7 @@
       file-backup = { };
     };
     users = {
+      # mutableUsers = false;
       snow = {
         isNormalUser = true;
         description = "snow";
@@ -257,10 +280,7 @@
   };
 
   systemd = {
+    # Make docker only run for the "snow" user.
     user.services.docker.unitConfig.ConditionUser = lib.mkForce "snow";
-    # tmpfiles.rules = [
-    #   "d ${config.users.users.file-backup.home} 0755 root root -"
-    #   "d ${config.users.users.file-backup.home}/meow 0700 ${config.users.users.file-backup.name} ${config.users.users.file-backup.group} -"
-    # ];
   };
 }
diff --git a/hosts/server/system/network.nix b/hosts/server/system/network.nix
index bdc6411..cacf483 100644
--- a/hosts/server/system/network.nix
+++ b/hosts/server/system/network.nix
@@ -2,6 +2,7 @@
 {
   networking = {
     hostName = "snow-den";
+    domain = "mrsnowy.dev";
 
     nameservers = [
       # Mullvad
-- 
2.51.2