n0mad1k/CoM-ghost_protocol
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5 Commits 1 Branch 0 Tags
0d9da7f7f2ebfdb52a9c01089a76144c0c8f8829
Commit Graph

4 Commits

Author SHA1 Message Date
n0mad1k 0d9da7f7f2 Fix WireGuard service start failure 
- ip6tables nat commands now redirect stderr to /dev/null so missing
  ip6table_nat module doesn't fail PostUp and kill the service
- Pre-load ip6table_nat kernel module (ignore_errors for minimal kernels)
- Collapse PostUp/PostDown to single-line semicolon-chained commands
  (avoids any heredoc whitespace or multi-line parsing issues)
- Remove comments from inside wg0.conf config body

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-09 16:14:56 -04:00
n0mad1k 20bcecbcec Harden WireGuard VPN configuration 
- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was
  enabled but only IPv4 masquerade existed)
- Tighten FORWARD chain: only allow wg0→internet and established return,
  instead of blanket ACCEPT from wg0
- Scope NAT masquerade to VPN subnet only
- Block VPN clients from server-local services (SSH/80/443) via INPUT rules
- Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base
  hardening sets default deny which blocks forwarded packets)
- Add SaveConfig = false to prevent runtime state overwriting config
- Add reload ufw handler

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-09 15:59:02 -04:00
n0mad1k 7484a0e034 Phantom v2: dual-mode architecture, security hardening, deployment management 
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-09 15:45:24 -04:00
ghost 973cede31f Initial release: ghost_protocol privacy toolkit 2026-03-04 09:13:16 -05:00