n0mad1k d687423c22 Add service accounts and systemd hardening ...

- cloudflared: create dedicated service account, run as non-root with
  ProtectSystem=strict and full hardening directives
- cloudflared: skip credentials overwrite when existing tunnel has valid
  credentials on disk; delete and recreate if credentials are missing
- wireguard: add systemd drop-in with ProtectHome, ProtectClock,
  ProtectHostname, ProtectKernelLogs, PrivateTmp

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-10 13:46:24 -04:00

..

tasks

Add service accounts and systemd hardening

2026-03-10 13:46:24 -04:00

main.yml

Harden WireGuard VPN configuration

2026-03-09 15:59:02 -04:00