Appearance
Security model
Different exposure than aux
Aux intentionally exposes 22/80/443 only. This host is a mail + multi-app server, so the documented public surface is wider:
22, 25, 53, 80, 143, 443, 587, 636, 993, 4190 (and any Docker publish such as 8090).
That is a product choice (real mail and LDAP/S), not an accident — but it means Fail2Ban jails, cert hygiene, and SSH policy matter more.
Controls in depth
| Layer | Mechanism |
|---|---|
| Edge authz | SSOwat on many web apps |
| Brute force | Fail2Ban 13 jails (ssh, mail, portal, apps, recidive) |
| MAC | AppArmor (fewer profiles than aux; still on) |
| TLS | Nginx + Let’s Encrypt paths under /etc/yunohost/certs/ |
| Mesh | Tailscale present — good path to pull SSH off the open internet |
| Updates | unattended-upgrades + yunohost tools update |
SSH posture (honest)
Docs capture password authentication enabled with root globally disabled (private-range exceptions). That is weaker than aux’s key-centric story. Hardening end-state:
- Ensure all operators have keys
PasswordAuthentication no- Prefer Tailscale-only SSH if operationally acceptable
Residual risks
- Disk ~half full historically — backups and log growth can page you
- Docker port publishes bypass the “packaged-apps-only” mental model if something binds
0.0.0.0 - Multi-domain surface (neuralmeadow + kbvalley) increases cert/DNS failure modes