Flesh out Tier 2 hardening with fail2ban, Caddy rate limiting, security headers, and Forgejo security settings #2

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/2/head into main 2026-07-26 23:55:00 +00:00

Conversation 0 Commits - Files changed -

coding-agent-marvin8 commented 2026-07-26 20:49:47 +00:00 (Migrated from codeberg.org)

Copy link

Expands all Tier 2 TODO stubs into actionable walkthroughs:

• Fail2ban — new forgejo jail monitoring journald for failed auth
• Caddy rate limiting — custom Caddy build with caddy-ratelimit plugin on /user/login
• Security headers — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Forgejo security settings — session lifetime (8h), remember-me (7d), min password length (16), hidden email domains
• 2FA enrollment — manual TOTP enrollment steps with recovery code guidance
• Backup verification — restic snapshot and journald confirmation steps added to existing Backup Strategy
• Firewall audit — ss, nftables, and localhost-binding verification commands

All sections follow the existing workbook pattern: config snippet → apply command → verification steps with expected output.

Expands all Tier 2 TODO stubs into actionable walkthroughs: - **Fail2ban** — new forgejo jail monitoring journald for failed auth - **Caddy rate limiting** — custom Caddy build with caddy-ratelimit plugin on /user/login - **Security headers** — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy - **Forgejo security settings** — session lifetime (8h), remember-me (7d), min password length (16), hidden email domains - **2FA enrollment** — manual TOTP enrollment steps with recovery code guidance - **Backup verification** — restic snapshot and journald confirmation steps added to existing Backup Strategy - **Firewall audit** — ss, nftables, and localhost-binding verification commands All sections follow the existing workbook pattern: config snippet → apply command → verification steps with expected output.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

marvin8/own-forge!2

No description provided.