Hardened edge

Security

Defense in depth for the website, mail server, AI plane, and Oracle Cloud host.

● TLS / HTTPS
● HSTS & CSP
● UFW deny-by-default
● Fail2ban
● SSH keys only
● Ops auth

Web edge

  • Automatic HTTPS via Caddy / Let's Encrypt
  • Strict transport security, frame denial, content type sniffing protection
  • Referrer policy and permissions policy hardened
  • Gzip/zstd compression; minimal public surface
  • Ops metrics and raw alerts require HTTP basic authentication

Host

  • UFW: default deny inbound
  • Only required ports: 22, 80, 443, mail (25/465/587/993/143)
  • SSH: public-key only, no root login, limited auth tries
  • Fail2ban: sshd, postfix, dovecot, recidive
  • Unattended security updates enabled
  • Kernel rp_filter, syncookies, no redirects

Mail

  • SPF, DKIM, DMARC on esoteric-kingdom.com
  • TLS on IMAP/SMTP (Let's Encrypt for mail hostname)
  • SASL-authenticated submission; open relay rejected
  • Fail2ban jails for SMTP/IMAP abuse

AI & admin

  • Ollama, AI chat, and web terminal bound to Tailscale only
  • Resource API and ops UI not anonymously browsable
  • Secrets stored root-only under /etc/gwen/secrets.env

What stays private

AI chat, Ollama API, web terminal, Postgres, and internal resource-aid bind to localhost or Tailscale — never the public internet.

Report a concern

Email admin@esoteric-kingdom.com with subject Security.

Live host
Loading…