Production hardening: host-aware install, ownership contracts, firewall safety

2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
@@ -16,10 +16,14 @@ Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
 PrivateTmp=true
+UMask=0077
 ProtectHome=true
 ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
 ReadWritePaths={{DATA_DIR}} {{LOG_DIR}}
 RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true
 CapabilityBoundingSet=
 AmbientCapabilities=

@@ -11,7 +11,16 @@ ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
 Restart=on-failure
 RestartSec=5s
 AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
+ReadWritePaths=/var/lib/hysteria
+RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true

 [Install]
 WantedBy=multi-user.target