CoM-ghost_protocol

n0mad1k/CoM-ghost_protocol

Fork 0

Commit Graph

Author	SHA1	Message	Date
n0mad1k	20bcecbcec	Harden WireGuard VPN configuration - Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was enabled but only IPv4 masquerade existed) - Tighten FORWARD chain: only allow wg0→internet and established return, instead of blanket ACCEPT from wg0 - Scope NAT masquerade to VPN subnet only - Block VPN clients from server-local services (SSH/80/443) via INPUT rules - Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base hardening sets default deny which blocks forwarded packets) - Add SaveConfig = false to prevent runtime state overwriting config - Add reload ufw handler Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 15:59:02 -04:00
n0mad1k	7484a0e034	Phantom v2: dual-mode architecture, security hardening, deployment management - Dual-mode operation: standalone + c2itall integrated (env var detection) - SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts - Ansible output streaming with filtered console + full log capture - Deployment management menu: discover, SSH, teardown existing deployments - Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs - Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers - Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails - Add-matrix-user helper script deployed to all Matrix servers - .env support for standalone credential storage - Config key rename: deploy_id → deployment_id (with backward compat) - Provider cleanup playbooks for teardown - Test suite with 50 tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 15:45:24 -04:00
ghost	973cede31f	Initial release: ghost_protocol privacy toolkit	2026-03-04 09:13:16 -05:00

Author

SHA1

Message

Date

n0mad1k

20bcecbcec

Harden WireGuard VPN configuration

- Add IPv6 ip6tables rules to prevent IPv6 traffic leaks (forwarding was
  enabled but only IPv4 masquerade existed)
- Tighten FORWARD chain: only allow wg0→internet and established return,
  instead of blanket ACCEPT from wg0
- Scope NAT masquerade to VPN subnet only
- Block VPN clients from server-local services (SSH/80/443) via INPUT rules
- Set UFW DEFAULT_FORWARD_POLICY=ACCEPT (required for VPN routing; base
  hardening sets default deny which blocks forwarded packets)
- Add SaveConfig = false to prevent runtime state overwriting config
- Add reload ufw handler

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-09 15:59:02 -04:00

n0mad1k

7484a0e034

Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-09 15:45:24 -04:00

ghost

973cede31f

Initial release: ghost_protocol privacy toolkit

2026-03-04 09:13:16 -05:00

3 Commits