Production hardening: host-aware install, ownership contracts, firewall safety

package/config/hy2xs.env

@@ -6,7 +6,9 @@ HY2XS_PUBLIC_PORT=443
 HY2XS_SSH_PORT=22
 HY2XS_FIREWALL_ENABLED=true
 HY2XS_FIREWALL_STAGED_APPLY=true
+HY2XS_FIREWALL_ALLOW_TAKEOVER=false
 HY2XS_UI_BIND_HOST=127.0.0.1
+HY2XS_UI_PUBLIC_ACCESS=false
 HY2XS_UI_PORT=8080
 HY2XS_ADMIN_USER=hy2xsadmin
 HY2XS_ADMIN_INITIAL_PASSWORD=__GENERATE__
@@ -30,6 +32,7 @@ HY2XS_HYSTERIA_BANDWIDTH_UP=50 mbps
 HY2XS_HYSTERIA_BANDWIDTH_DOWN=50 mbps
 HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH=false
 HY2XS_HYSTERIA_CONFIG_PATH=/etc/hysteria/config.yaml
+HY2XS_ALLOW_LATEST_HYSTERIA=false
 HY2XS_HYSTERIA_VERSION=v2.6.0
 HY2XS_INSTALL_DIR=/opt/hy2xs-admin
 HY2XS_DATA_DIR=/var/lib/hy2xs-admin

package/systemd/hy2xs-admin.service

@@ -16,10 +16,14 @@ Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
 PrivateTmp=true
+UMask=0077
 ProtectHome=true
 ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
 ReadWritePaths={{DATA_DIR}} {{LOG_DIR}}
 RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true
 CapabilityBoundingSet=
 AmbientCapabilities=
 

package/systemd/hysteria-server.service

@@ -11,7 +11,16 @@ ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
 Restart=on-failure
 RestartSec=5s
 AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
+ReadWritePaths=/var/lib/hysteria
+RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true
 
 [Install]
 WantedBy=multi-user.target

package/templates/env/post-install.env.tpl

@@ -2,7 +2,7 @@
 # Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.
 
 DEPLOY_TARGET_OS=debian12
-DEPLOY_TIMESTAMP={{INSTALL_DATE}}
+DEPLOY_TIMESTAMP={{LAST_APPLY_DATE}}
 PACKAGE_NAME=hy2xs-install-package
 PACKAGE_BUILD_ID={{PACKAGE_BUILD_ID}}
 PACKAGE_VERSION={{PACKAGE_VERSION}}

package/templates/nftables/hy2xs.nft.tpl

@@ -7,7 +7,6 @@ table ip hy2xs {
     tcp dport {{SSH_PORT}} accept
     {{ACME_RULE}}
     udp dport {{HYSTERIA_PORT}} accept
-    tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
     icmp type echo-request accept
   }
 }