diff options
| author | Karan Jayachandra <mail@karanjayachandra.com> | 2026-07-31 21:12:16 +0200 |
|---|---|---|
| committer | Karan Jayachandra <mail@karanjayachandra.com> | 2026-07-31 21:12:16 +0200 |
| commit | 2144d31a0455ba32a7a0b655afdef33632a8724d (patch) | |
| tree | a5bb01f93649511360dabdfb13524082d3e4edfc /modules/common.nix | |
| parent | abfbee7c9b2632dcbd07e7940f8805942a93d14c (diff) | |
Hardened the server by blocking port 53 and added a deploy script
Diffstat (limited to 'modules/common.nix')
| -rw-r--r-- | modules/common.nix | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/modules/common.nix b/modules/common.nix index e27d276..7f46af8 100644 --- a/modules/common.nix +++ b/modules/common.nix @@ -15,14 +15,19 @@ }; }; - # Firewall: SSH, HTTP/HTTPS (Caddy), plain DNS, and AdGuard's own - # DNS-over-TLS (853) + DNS-over-HTTPS (8443) listeners. + # Firewall: SSH, HTTP/HTTPS (Caddy), and AdGuard's own DNS-over-TLS (853) + + # DNS-over-HTTPS (8443) listeners. + # Plain DNS (port 53) is deliberately NOT opened: CERT-Bund/BSI flagged this + # host as an open DNS resolver abusable for UDP reflection/amplification + # DDoS (spoofed source IP, no handshake). AdGuard's plain listener is + # disabled entirely in modules/adguard.nix (dns.port = 0) - all clients use + # DoT/DoH instead, which require a real TLS handshake with the real client + # IP and so aren't spoofable the same way. # Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here - # see modules/adguard.nix for why it still binds 0.0.0.0 anyway. networking.firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 53 853 8443 ]; - allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 22 80 443 853 8443 ]; }; # Nix settings: flakes, auto-gc, auto-optimise |