Rate the security of my config

[HydraulicGoose]

This is the best setup that I could come up with. Please let me know if there are any improvements I could make.

I'm running copyparty and crowdsec with caddy-crowdsec-geo reverse proxy in rootless podman quadlets (Fedora server with SELinux). I'm using geo-blocking to allow only US ips, and crowdsec to block malicious ips.

To login as admin, I have to be on my local network, connect with an alternate subdomain, and be on a whitelisted local ip. No other users exist.

I created a public upload-only share inside /public with a very, very long url. Should be safe for people to upload since it has dthumb, etc. I use filekeys to share files, and shares to share folders.

copyparty.conf

[global]

  # listen on socket for caddy
  i: unix:770:/run/copypartypublic/party.sock

  # enable shares (uses something other than /shares to cut down on bots)
  shr: /warehouselightning

  # enable social media embeds
  og-ua: (Discord|Twitter|Slack)bot

  # indexing
  e2dsa         # enables file indexing on upload and scans mounted volumes (required for rate limiting)

  # ui
  ansi          # display colors in console
  gsel          # select files in grid by ctrl-click
  ui-filesz:6c  # default filesize type in ui
  grid          # show grid/thumbnails by default
  theme: 2      # pm-monokai theme

  # Disable https (performance)
  http-only

  # Use public url when creating share links
  shr-site: https://copyparty.mydomain.com

  # security
  ipr: my_local_pc_ip,my_local_phone_ip=myuser     # only allow myuser to login only from these ips (only accessible from admin.mydomain.com, which only resolves on my local network)
  lo: /cfg/logs/cpp-%Y-%m%d-%H%M%S.txt.xz  # enables logging to disk
  logout: 720        # logout clients after 1 month of inactivity
  no-dav             # disables webdav support
  force-js           # make it harder for some search engines to index
  no-robots          # tell search engines to not index copyparty
  xvol               # disable symlinks, except to volumes the user has access to (security)
  xdev               # stay within the filesystem of the volume root; do not descend into other devices (symlink or bind-mount to another HDD)
  nih                # removes the server hostname from directory listings
  hist: /cfg/hists/  # store hists (folder databases) in /cfg/hists. For speed, but also for security, so dotfile users cant see databases
  vol-or-crash       # if a volume's folder does not exist on the HDD, then burst into flames
  vague-403          # send 404 instead of 403 (security through ambiguity, very enterprise)
  df: 50g            # ensure 50gb free space by rejecting upload requests
  du-who: a          # only allow admin users to see top left disk space
  shr-who: a         # only lets admin users create shares (can be overwritten per volume)
  dotpart            # hides uploads from directory listings while they're still incoming
  no-html            # disables html, because markdown files can be malicious
  ls: **,*,ln,p,r    # does a scan on startup for any dangerous symlinks
  no-readme          # disables readmes since I don't need them. *logues are still enabled
  no-mtag-ff         # uses mutagen to grab music tags instead of FFmpeg, which is safer and faster but less accurate (mutagen is disabled though)


  # Enables password hashing
  ah-alg: argon2
  ah-salt: SALT1

  # Dir/filekey salts
  fk-salt: SALT2
  dk-salt: SALT3
  # Options needed for caddy
  rproxy: 1                 # associate client with ip as reported by caddy
  xff-hdr: x-forwarded-for  # if reverse-proxied, which http header to read the client's real ip from (default: x-forwarded-for)
  xff-src: lan              # trust connections originating from private/LAN address ranges. should be safe since copyparty can only be accessed through caddy, and Network=none in the podman quadlet


# --- Users:
[accounts]
  myuser: HASH1

# --- Root folder (no access)
# --- Makes mydomain.com open the file browser and not the control-panel 
[/]
  /w

  accs:
    r: @acct         # all logged in users have read access (so opening main url shows root instead of wecome screen)

  flags:
    shr-who: no      # lets no user create shares
    no_readme        # disable readmes
    no_logues        # disable logues

# --- Private folder without filekeys. Used for uploads that should only be viewable via share link.
[/private]
  /w/private

  accs:
    rwmda.: myuser  # perms: read/write/move/delete/admin/dotfiles

  flags:
    no_readme       # disable readmes
    no_logues       # disable logues

# --- My personal upload folder. Has thumbnails and processing enabled, so it's only safe for me to upload here.
[/personal]
  /w/personal

  accs:
    rwmda.: myuser  # perms: read/write/move/delete/admin/dotfiles
    g: *            # * can see filekeys

  flags:
    no_readme       # disable readmes
    no_logues       # disable logues
    fka: 32         # filekeys

# --- public upload folder with thumbnails and processing disabled. should be safe to upload even malicious files.
# public is only for upload share links, which don't support users create their own share links from file they upload.
# if a user needs to create share links, create a new user with their own folder.
[/public]
  /w/public

  accs:
    rwmda.: myuser  # perms: read/write/delete/admin/dotfiles
    g: *            # * can see filekeys

  flags:
    d2t             # disables metadata collection for security
    vmaxb: 100g     # max volume size is 100g
    maxn: 250,1800  # each IP can upload 250 files in 30 minutes
    maxb: 2g,120    # each IP can upload 2gb over 2 minutes
    plainreadme     # show readmes as plaintext for security
    plainlogues     # show logues as plaintext for security

    dthumb          # disables thumbnails and audio transcoding to stop copyparty from running FFmpeg/Pillow/VIPS on uploaded files for security
    du_who: auth    # logged in users can see disk space
    fka: 32         # filekeys

copyparty.container

[Container]
Image=docker.io/0x464e/patentparty:iv-latest
ContainerName=copyparty
# Automatic updates because I care more about security than uptime (an update breaking copyparty is acceptable)
AutoUpdate=registry

# Run container with a user namespace that maps to the same user id as the one running in the container
# All files are owned by copyparty user, so user inside the container also needs to be copyparty user
UserNS=keep-id

# Security options
ReadOnly=true
Tmpfs=/tmp:noexec,nosuid,nodev
NoNewPrivileges=true
DropCapability=ALL

# Communicates via socket, so network is not needed
Network=none

Environment=LD_PRELOAD=/usr/lib/libmimalloc-secure.so.2
# ensures log-messages are not delayed (but can reduce speed a tiny bit)
Environment=PYTHONUNBUFFERED=1

Volume=/data/containerspublic/copyparty/copyparty_config:/cfg:Z
Volume=/data/uploads/copypartypublic:/w:Z
Volume=%t/copypartypublic:/run/copypartypublic:z

StopTimeout=15

[Service]
# More security options
ProtectProc=invisible
RemoveIPC=yes
ProcSubset=pid

# Breaks auto starting after reboot
#RestrictRealtime=yes
#LockPersonality=yes 
#SystemCallArchitectures=native
#RestrictSUIDSGID=yes

# Basic ram and cpu limits
MemoryMax=4G
MemorySwapMax=4G
CPUQuota=400%

Restart=always

[Unit]
After=caddy.service

[Install]
WantedBy=default.target

Caddyfile

# Certs
(inttls) {
    tls /data/certs/*.mydomain.com/fullchain.cer /data/certs/*.mydomain.com/*.mydomain.com.key
}

# Global settings (compression/security)'
(common) {

    log
    encode

    header {
      Strict-Transport-Security "max-age=31536000; includeSubDomains"
      X-Content-Type-Options "nosniff"
      Referrer-Policy "strict-origin-when-cross-origin"
      Permissions-Policy "geolocation=(), microphone=(), camera=()"
      -Server
    }

}


{
    # forces the CrowdSec directive to be executed first
    order crowdsec first

    # Disables admin endpoint
    admin off

    # Disable auto_https because it probably breaks with socket activation
    auto_https disable_redirects

    # Make socket activation work
    default_bind fd/4 {
        protocols h1 h2
    }

  crowdsec {
    api_url http://192.168.1.12:8081
    api_key my_api_key
    ticker_interval 15s
    enable_hard_fails  # Fail caddy if crowdsec api is unreachable
  }

}


# Redirect http to https
http:// {
    bind fd/3 {
        protocols h1
    }
    redir https://{host}{uri}
}
# COPYPARTY PUBLIC
copyparty.mydomain.com {
    import inttls
    import common

    crowdsec

    log {
        output file /var/log/caddy/access.log
        format json
        level DEBUG
    }

    @mygeofilter {
        maxmind_geolocation {
            db_path "/data/maxmind_database/GeoLite2-Country.mmdb"
            allow_countries US
        }
    }

    reverse_proxy @mygeofilter unix//run/copypartypublic/party.sock {

        transport http {
            versions 1.1
        }
    }

}

# COPYPARTY ADMIN
copyparty.local.mydomain.com {
    import inttls
    import common

    reverse_proxy unix//run/copypartypublic/party.sock {

        transport http {
            versions 1.1
        }
    }
}

# CROWDSEC UI
crowdsec.local.mydomain.com {
    import inttls
    import common

    reverse_proxy 192.168.1.12:3000 {

        transport http {
            versions 1.1
        }
    }
}

caddy.container

[Container]
ContainerName=caddy
Image=ghcr.io/serfriz/caddy-crowdsec-geoip:latest
GroupAdd=keep-groups
AutoUpdate=registry

# Security options
ReadOnly=true
Tmpfs=/tmp:noexec,nosuid,nodev
NoNewPrivileges=true
DropCapability=ALL
# Breaks without bind service
AddCapability=CAP_NET_BIND_SERVICE

Network=crowdsec.network

Label=com.centurylinklabs.watchtower.enable=true
Label=diun.ignore=true

Volume=/data/containerspublic/caddy/caddy:/etc/caddy:Z
Volume=/data/containerspublic/caddy/caddy_site:/srv:Z
Volume=/data/containerspublic/caddy/caddy_data:/data:Z
Volume=/data/containerspublic/caddy/caddy_config:/config:Z

Volume=/data/containerspublic/caddy/caddy_logs:/var/log/caddy:z
Volume=/data/maxmind_database:/data/maxmind_database:ro,z
Volume=/data/certs/mydomain.com:/data/certs/mydomain.com:ro,z
Volume=/data/certs/*.mydomain.com/:/data/certs/*.mydomain.com/:ro,z

# Mounts for services that use a socket
Volume=%t/copypartypublic:/run/copypartypublic:z

[Service]
# More security options
ProtectProc=invisible
RemoveIPC=yes
ProcSubset=pid

# Breaks auto starting after reboot
#RestrictRealtime=yes
#LockPersonality=yes 
#SystemCallArchitectures=native
#RestrictSUIDSGID=yes

# Basic ram and cpu limits
MemoryMax=4G
MemorySwapMax=4G
CPUQuota=400%

Restart=always

# Creates a folder for each service that needs a socket
ExecStartPre=/usr/bin/mkdir -p %t/copypartypublic

[Unit]
After=caddy.socket crowdsec.service
Requires=caddy.socket crowdsec.service

[Install]
WantedBy=default.target

caddy.socket

[Socket]

# fd/3
ListenStream=192.168.1.12:8080

# fd /4
ListenStream=192.168.1.12:8443
# (firewalld forwards 80/443 to 8080/8443 on ipv4 only, so I can use ipv6 for a caddy instance for my local services)

[Install]
WantedBy=sockets.target

crowdsec.container

[Container]
Image=docker.io/crowdsecurity/crowdsec:latest

ContainerName=crowdsec
AutoUpdate=registry

# Security options
ReadOnly=true
Tmpfs=/tmp:noexec,nosuid,nodev
NoNewPrivileges=true
DropCapability=ALL

Network=crowdsec.network

PublishPort=8081:8080
PublishPort=6060:6060

Environment=COLLECTIONS=crowdsecurity/linux COLLECTIONS=crowdsecurity/caddy

Volume=/data/containerspublic/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:Z,ro
Volume=/data/containerspublic/crowdsec/crowdsec_logs:/var/log/nginx:Z
Volume=/data/containerspublic/crowdsec/crowdsec_db:/var/lib/crowdsec/data:Z
Volume=/data/containerspublic/crowdsec/crowdsec_config:/etc/crowdsec:Z

Volume=/data/containerspublic/caddy/caddy_logs/:/data/containerspublic/caddy/caddy_logs/:z

[Service]
# More security options
ProtectProc=invisible
RemoveIPC=yes
ProcSubset=pid

# Breaks auto starting after reboot
#RestrictRealtime=yes
#LockPersonality=yes
#SystemCallArchitectures=native
#RestrictSUIDSGID=yes

# Basic ram and cpu limits
MemoryMax=4G
MemorySwapMax=4G
CPUQuota=400%

Restart=always

[Unit]
After=crowdsec-network.service
Wants=crowdsec-network.service

[Install]
WantedBy=default.target

crowdsec.network

[Network]
NetworkName=crowdsec
# Can only communicate with containers on same network
Options=isolate=true
Subnet=10.89.1.0/24
Gateway=10.89.1.1

crowdsec_ui.container

[Container]
Image=ghcr.io/theduffman85/crowdsec-web-ui:latest
ContainerName=crowdsec_web_ui

Environment=CONFIG_INSTANCE_LAPI_URL=http://192.168.1.12:8081
Environment=CONFIG_INSTANCE_LAPI_AUTH_USERNAME=crowdsec-web-ui
Environment=CONFIG_INSTANCE_LAPI_AUTH_PASSWORD=my_password
Environment=CONFIG_INSTANCE_METRICS_URL=http://192.168.1.12:6060/metrics

# Security options
ReadOnly=true
Tmpfs=/tmp:noexec,nosuid,nodev
NoNewPrivileges=true
DropCapability=ALL
AddCapability=CAP_CHOWN
AddCapability=CAP_SETUID
AddCapability=CAP_SETGID

PublishPort=3000:3000

Volume=/data/containerspublic/crowdsec_ui/crowdsec_ui_data:/app/data:Z

Network=crowdsec.network

[Service]
# More security options
ProtectProc=invisible
RemoveIPC=yes
ProcSubset=pid

# Breaks auto starting after reboot
#RestrictRealtime=yes
#LockPersonality=yes
#SystemCallArchitectures=native
#RestrictSUIDSGID=yes

# Basic ram and cpu limits
MemoryMax=4G
MemorySwapMax=4G
CPUQuota=400%

Restart=always

[Install]
WantedBy=default.target

[Unit]
After=crowdsec-network.service
Wants=crowdsec-network.service

[kamaeff]

Looks… hardened.

I'm curious: you already use crowdsec, why no crowdsec-appsec?

[kamaeff]

Oh and I would add these exceptions to crowdsec rules to avoid false-positives bans:
https://copyparty.eu/cli/#g-nonsus-urls

[HydraulicGoose]

I'm curious: you already use crowdsec, why no crowdsec-appsec?

I got lazy and didn't feel like setting it up. I'll probably get around to it eventually.

Oh and I would add these exceptions to crowdsec rules to avoid false-positives bans:

If I'm understanding you correctly, any urls I add to --nonsus-urls should also be added to crowdsec rules?

[kamaeff]

Oh and I would add these exceptions to crowdsec rules to avoid false-positives bans:

If I'm understanding you correctly, any urls I add to --nonsus-urls should also be added to crowdsec rules?

Something like that.
These are urls that are expected to be 404/403 and these 4xx shouldn't lead to ban.
E.g. copyparty doesn't serve apple-touch-icon, but Safari and iOS PWA can send bunch of requests trying to fetch these icons. These requests generate multiple 404s and trigger crowdsec http-probing scenario (not sure, maybe other scenarios get triggered too), which leads to false positives: legit clients get banned.

Afaik there are multiple possible solutions to avoid such false positives, postoverflows are one of them.