v0.6.0

What's Changed

• docs: guide server setup with a visual README by @cn0ss in #14
• fix: confirm only real logins, bind the admin rule to its address, and close the other scan findings by @cn0ss in #15

Full Changelog: v0.5.2...v0.6.0

v0.5.2

What's Changed

• ci: run the nftables check and both e2e tests on every pull request by @cn0ss in #12
• fix: wizard texts wrap instead of being cut off, and the reboot wait shows progress by @cn0ss in #13

Full Changelog: v0.5.1...v0.5.2

v0.5.1

What's Changed

• feat: paste the tunnel's install command, not just its token by @cn0ss in #11

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's Changed

• fix: a network card with a public address faces the internet by @cn0ss in #10
• fix: the wizard waits for a cancelled run to clean up by @cn0ss in #7
• feat: install.sh checks the signed provenance when gh is installed by @cn0ss in #9
• feat: signed build provenance for every release, notes per pull request by @cn0ss in #8

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Changelog

• 286685d: Merge pull request #6 from niklas-schmidt-dev/cloudflare-tunnel (@cn0ss)
• 146d499: feat: Cloudflare Tunnel as the stronger web option, with no open web port (@cn0ss)
• a4e21dc: feat: reboot at the end and check that the lockdown comes back (@cn0ss)
• 7f97c91: fix: bound the reboot wait, retry a login into the old boot, keep the password when hardening was skipped (@cn0ss)
• 1851cb9: fix: ensure CA certificates before fetching the cloudflared apt repository (@cn0ss)
• 8b81389: fix: interruptible Tailscale SSH check, port 22, intact summary colours, no Tailscale SSH switching over the tailnet (@cn0ss)
• 4f908e4: fix: tunnel readiness from our own cloudflared only, remove a deselected tunnel, always ensure curl (@cn0ss)
• 9bc3e7c: fix: turn Tailscale SSH on last, and update the system before installing (@cn0ss)

v0.3.0

Changelog

• b1e7933: security: close the audit's open leads on uplinks, boot persistence, ufw and login links (@cn0ss)
• f0545a6: security: fix audit findings in host-key trust, rollback, sshd hardening and login confirmation (@cn0ss)

v0.2.0

Changelog

• 3e69792: here: run secure-setup on the server itself, interactively or at first boot (@cn0ss)

v0.1.0

Changelog

• b69787c: secure-setup: guided VPS lockdown with Tailscale, nftables and Cloudflare (Niklas schmidtniklas86@gmail.com)