Production hardening: host-aware install, ownership contracts, firewall safety

2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
@@ -11,7 +11,16 @@ ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
 Restart=on-failure
 RestartSec=5s
 AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/hysteria/config.yaml
+ReadWritePaths=/var/lib/hysteria
+RestrictAddressFamilies=AF_INET AF_UNIX
+SystemCallArchitectures=native
+LockPersonality=true

 [Install]
 WantedBy=multi-user.target