How to respond to a security incident

1. Contain: block IP (host firewall / iptables) and review Fail2Ban.
2. Preserve logs: journalctl -u sshd, /var/log/auth.log, /var/log/nginx/*, /var/log/mail.log.
3. Rotate: admin password, app admins, DB passwords, SSH keys; Vaultwarden master is separate — handle via your vault SOP.
4. yunohost user list, review unexpected users.
5. ps auxf, ss -lntp, docker ps.
6. Prefer tightening SSH (disable passwords; Tailscale-only) after recovery — see security model.