Harden `dnsc-vps-sm` #2

New issue

Closed

opened 2026-03-13 11:32:25 +01:00 by dennis · 0 comments

dennis commented

2026-03-13 11:32:25 +01:00

Owner

Step 1

Create access log files through caddy config (per-host). Pay attention to roll: https://caddyserver.com/docs/caddyfile/directives/log#examples

Step 2

Install and configure goaccess for Caddy

Step 3

Identify IP ranges to ban

Step 4

Switch to nftables with networking.firewall.nftables.enable = true and then set rules with:

networking.firewall.extraInputRules = ''
  ip saddr 192.0.2.0/24 tcp dport { 80, 443 } drop
  ip6 saddr 2001:db8::/32 tcp dport { 80, 443 } drop
'';

Step 5

Maybe follow-up by using CrowdSec. Avoid Cloudflare, but might be needed at some point.

## Step 1 Create access log files through caddy config (per-host). Pay attention to roll: https://caddyserver.com/docs/caddyfile/directives/log#examples ## Step 2 Install and configure `goaccess` for Caddy ## Step 3 Identify IP ranges to ban ## Step 4 Switch to nftables with `networking.firewall.nftables.enable = true` and then set rules with: ```nix networking.firewall.extraInputRules = '' ip saddr 192.0.2.0/24 tcp dport { 80, 443 } drop ip6 saddr 2001:db8::/32 tcp dport { 80, 443 } drop ''; ``` ## Step 5 Maybe follow-up by using CrowdSec. Avoid Cloudflare, but might be needed at some point.

dennis referenced this issue from a commit

2026-03-13 14:50:49 +01:00

enables some global logging options

dennis added reference feat/caddy-hardening

2026-03-13 14:51:01 +01:00

dennis referenced this issue from a pull request that will close it,

2026-03-13 14:51:36 +01:00

caddy hardening #3

dennis closed this issue

2026-03-14 22:06:14 +01:00