Production hardening: host-aware install, ownership contracts, firewall safety

2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
@@ -16,10 +16,14 @@ Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
 PrivateTmp=true
+UMask=0077
 ProtectHome=true
 ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
 ReadWritePaths={{DATA_DIR}} {{LOG_DIR}}
 RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true
 CapabilityBoundingSet=
 AmbientCapabilities=