security hardening: software and host #28

Umbrella for security work beyond #14 (which covers audit logging, rate limiting, quotas, user disable). Two halves:

The software

• fuzz every parser that eats attacker-controlled bytes: the pkt-line reader in gitd, the SSHSIG and commit parsers in internal/sig, the armor decoder (the ssh tokenizer already has fuzz targets — extend the pattern)
• web security headers: CSP, X-Frame-Options, Referrer-Policy — none are set today; raw file serving already has nosniff
• dependency hygiene: govulncheck wired into the test loop, periodic review of the (deliberately short) module list
• constant-time comparison audit for every token/hash check
• a written threat model in docs/: what the forge trusts, what it never does (execute repo content, hold a signing key, serve repo HTML on its origin), where the boundaries are
• signed release artifacts (with #26)

The host (bay1 pattern, documented for any instance)

• unattended-upgrades for OS security patches; reboot policy
• tighter systemd sandboxing: SystemCallFilter=@system-service, RestrictAddressFamilies, PrivateDevices, LockPersonality on top of the existing ProtectSystem/NoNewPrivileges set
• auth throttling on both SSH surfaces (gitbayd port 22 via #14 ssh_auth_rate; admin sshd 2222 via MaxStartups/fail2ban)
• database: verify file modes, consider continuous replication (litestream-style) alongside the nightly archive and provider snapshots
• basic monitoring: disk, service failures, certificate renewal — journald + a webhook to somewhere visible

Concrete items shipped in !28 and applied to bay1. Software: fuzz targets for every attacker-facing parser (the SSHSIG armor fuzzer found a real decodeArmor negative-slice crash — fixed, crasher kept as a regression seed); CSP + X-Frame-Options/nosniff/no-referrer/HSTS on every response (live, verified on gitbay.org); govulncheck wired into deploy/audit.sh, which flagged CIRCL GO-2026-4550 reachable via PGP key parsing (bumped 1.6.2->1.6.3, now clean); token-comparison audit (every secret checked by SHA-256 hash DB lookup, never a Go-level compare — no timing oracle); docs/threat-model.org; optional minisign over release manifests. Host: systemd sandbox (SystemCallFilter=@system-service, PrivateDevices, LockPersonality, MemoryDenyWriteExecute, RestrictAddressFamilies) — verified clone, blob render, archive, and a signed push all still work under it; unattended-upgrades; fail2ban + MaxStartups/MaxAuthTries on the admin sshd (already banning 2 real attackers); hourly disk/service/cert monitoring (dormant until /etc/gitbay/monitor.url is set). Leaving this umbrella open for ongoing security work; the gating items for open registration are done.