mk
|
efdf056352
|
hardening(angie): default_server needs a cert on its 443 listener or 'angie -t' fails with 'no ssl_certificate defined' — generate a one-time self-signed dummy (CN=bootstrap-default, 10y) in /etc/angie/ssl so unknown-SNI clients handshake then get 444; mark listen 443 as ssl explicitly
|
2026-07-28 06:55:31 +03:00 |
|
mk
|
94a0bac9f4
|
hardening(angie): resolve mime.types from whichever path the package ships (angie-bin=/etc/angie, Arch source=/etc/nginx via mailcap dep) — fixes 'angie -t' 'open() mime.types failed' on source path; fallback ships a minimal mime.types; ensure modules/ include dirs exist before glob
|
2026-07-28 06:04:57 +03:00 |
|
mk
|
26185978ac
|
hardening(angie): source-angie bridge — symlink /etc/nginx/nginx.conf -> /etc/angie/angie.conf so the _on/targets layout actually loads under the source AUR package's '/usr/bin/nginx' service (angie-bin/Debian already read /etc/angie directly); backup original once
|
2026-07-28 05:59:08 +03:00 |
|
mk
|
cb0e517a7d
|
hardening(angie): fix 'angie_user: unbound variable' under set -u — init extraction locals to empty; also read source AUR package's /etc/nginx/nginx.conf as alt stock config path
|
2026-07-28 05:57:44 +03:00 |
|
mk
|
8930e7aa76
|
non-interactive --yes: ask() assumes prompt default (no read); timezone defaults UTC; --username implies force-create; create-user name defaults to mk under --yes
|
2026-07-28 05:21:23 +03:00 |
|
mk
|
0116ac60b3
|
hardening: angie config layout (_on/targets/modules) + sane root config + enable/disable helpers
|
2026-07-28 04:50:08 +03:00 |
|
mk
|
5e0e96e8e2
|
modules: hardening (ssh/ufw/updates/tz/hostname/swap/locale/fail2ban) + sanity report
|
2026-07-28 04:32:38 +03:00 |
|