nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

Add a security review gate for new hosts and custom services #41

New issue
Open
opened 2026-07-01 19:37:23 +01:00 by nimmo · 0 comments
nimmo commented 2026-07-01 19:37:23 +01:00
Owner
Copy link

Context

Several review findings are easier to prevent at creation time than to retrofit. A concise checklist should make security posture explicit whenever a host or custom service is introduced.

Scope

Document and apply a review gate covering:

  • disk encryption and physical-access threat model
  • SSH authentication and source restrictions
  • SOPS recipient scope and secret ownership
  • firewall openings and bind addresses
  • reverse-proxy, VPN, or mesh access paths
  • backup and recovery coverage
  • Docker group/root-equivalent access
  • practical systemd sandboxing for custom services

Completion criteria

  • The checklist is published in the repository wiki.
  • Host/service implementation issues reference it where relevant.
  • At least one current host or service is reviewed against it to validate that the checklist is usable.
## Context Several review findings are easier to prevent at creation time than to retrofit. A concise checklist should make security posture explicit whenever a host or custom service is introduced. ## Scope Document and apply a review gate covering: - disk encryption and physical-access threat model - SSH authentication and source restrictions - SOPS recipient scope and secret ownership - firewall openings and bind addresses - reverse-proxy, VPN, or mesh access paths - backup and recovery coverage - Docker group/root-equivalent access - practical systemd sandboxing for custom services ## Completion criteria - The checklist is published in the repository wiki. - Host/service implementation issues reference it where relevant. - At least one current host or service is reviewed against it to validate that the checklist is usable.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/split-scoped-secrets
cosmos-postgres-vm-stable
electra-sddm-hyprland
pre-electra-disko-migration
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#41
No description provided.