Commit 2a6874e6b7
Verified · cmc
docs/roadmap.org +12 −9
| @@ -101,15 +101,18 @@ and the whole set gates flipping gitbay.org to open registration. | ||
| 101 | 101 | |
| 102 | 102 | - [[https://gitbay.org/krz/gitbay/issues/14][#14]] audit logging, rate limiting, quotas, user disable — the |
| 103 | 103 | multi-user half |
| 104 | - [[https://gitbay.org/krz/gitbay/issues/28][#28]] hardening umbrella — the rest, both layers: | |
| 105 | - software: fuzz all attacker-facing parsers (pkt-line, SSHSIG, | |
| 106 | commit, armor), web security headers (CSP et al.), govulncheck, | |
| 107 | constant-time comparison audit, a written threat model, signed | |
| 108 | releases | |
| 109 | - host: unattended OS patching, tighter systemd sandboxing | |
| 110 | (SystemCallFilter and friends), auth throttling on both SSH | |
| 111 | surfaces, database file modes and continuous replication, | |
| 112 | service/disk/cert monitoring | |
| 104 | [[https://gitbay.org/krz/gitbay/issues/28][#28]] hardening umbrella — concrete items done 2026-08-24 | |
| 105 | (umbrella stays open for ongoing work). Both layers landed: | |
| 106 | - software: fuzz targets for every attacker-facing parser (found and | |
| 107 | fixed a decodeArmor slice bug), CSP + security headers, govulncheck | |
| 108 | in =deploy/audit.sh= (fixed circl GO-2026-4550), token comparison | |
| 109 | audit (hash-lookup, no Go-level compare), =docs/threat-model.org=, | |
| 110 | optional minisign over release manifests | |
| 111 | - host: systemd sandbox (=SystemCallFilter=@system-service=, | |
| 112 | =PrivateDevices=, =LockPersonality=, =MemoryDenyWriteExecute=, …), | |
| 113 | unattended-upgrades, fail2ban + =MaxStartups=/=MaxAuthTries= on the | |
| 114 | admin sshd, hourly disk/service/cert monitoring; DB file modes 0750, | |
| 115 | litestream noted for continuous replication. Applied to bay1. | |
| 113 | 116 | |
| 114 | 117 | Already true and worth preserving (the threat model will write these |
| 115 | 118 | down): the forge never executes repository content; no server signing |