bed41cfaf3
- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport), fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER), filter for the JSON access log, sshd hardening.conf, README with the order and the two traps measured in the episode - caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image - Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404, rate_limit zones on the vault token endpoint and the git login form - HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA
9 lines
473 B
Docker
9 lines
473 B
Docker
# episode 10: the stock caddy:2-alpine image cannot rate limit. The directive
|
|
# lives in a plugin (github.com/mholt/caddy-ratelimit) that has to be compiled
|
|
# in with xcaddy - there is no runtime "enable" for it. Two stages so the final
|
|
# image stays the same small alpine, just with our own caddy binary.
|
|
FROM caddy:2-builder-alpine AS builder
|
|
RUN xcaddy build --with github.com/mholt/caddy-ratelimit
|
|
|
|
FROM caddy:2-alpine
|
|
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
|