rcourtman 97f9de6c95 feat(security): Enhance systemd hardening directives ...

Adds additional systemd security directives for defense in depth:
- MemoryDenyWriteExecute=true (prevents RWX memory)
- RestrictRealtime=true (denies realtime scheduling)
- ProtectHostname=true (hostname protection)
- ProtectKernelLogs=true (kernel log protection)
- SystemCallArchitectures=native (native syscalls only)

These directives provide additional layers to slow/prevent
post-compromise exploitation of the proxy process.

Related to security audit 2025-11-07.

2025-11-07 17:09:47 +00:00

..

dev

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

lib

feat: add shared script library system and refactor docker-agent installer

2025-10-20 15:13:38 +00:00

systemd

feat: add automatic SSH key cleanup when nodes are removed

2025-10-18 07:03:05 +00:00

tests

feat: add shared script library system and refactor docker-agent installer

2025-10-20 15:13:38 +00:00

.go-version

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

backup-claude-md.sh

Fix critical version embedding issues for 4.26 release

2025-11-06 11:42:52 +00:00

build-release.sh

Add Windows ARM64 support for host agent (related to #654)

2025-11-07 12:18:57 +00:00

bundle.manifest

feat: add shared script library system and refactor docker-agent installer

2025-10-20 15:13:38 +00:00

bundle.sh

feat: add shared script library system and refactor docker-agent installer

2025-10-20 15:13:38 +00:00

clean-mock-alerts.sh

Add guest agent caching and update doc hints (refs #560)

2025-10-16 08:15:49 +00:00

cleanup.sh

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

codex-router.sh

Update Pulse install flow and related components

2025-10-21 19:58:53 +00:00

create-sensor-user.sh

security: complete Phase 1 sensor proxy hardening

2025-10-20 15:13:37 +00:00

docker-build.sh

security: complete Phase 1 sensor proxy hardening

2025-10-20 15:13:37 +00:00

harden-sensor-proxy.sh

security: complete Phase 1 sensor proxy hardening

2025-10-20 15:13:37 +00:00

hot-dev.sh

chore: snapshot current changes

2025-11-02 22:47:55 +00:00

install-container-agent.sh

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

install-docker-agent-v2.sh

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

install-docker-agent.sh

Improve Alpine Linux support and agent startup validation

2025-11-05 19:01:09 +00:00

install-docker.sh

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

install-go-toolchain.sh

Fix settings security tab navigation

2025-10-11 23:29:47 +00:00

install-host-agent.ps1

Add Windows ARM64 support for host agent (related to #654)

2025-11-07 12:18:57 +00:00

install-host-agent.sh

chore: snapshot current changes

2025-11-02 22:47:55 +00:00

install-sensor-proxy.sh

Add SMART temperature collection for physical disks (related to #652)

2025-11-07 11:46:57 +00:00

package-helm-chart.sh

release: prepare v4.25.0

2025-10-22 10:46:18 +00:00

pulse-auto-update.sh

Refactor: Code cleanup and localStorage consolidation

2025-11-04 21:50:46 +00:00

pulse-proxy-rotate-keys.sh

refactor: Rename pulse-temp-proxy to pulse-sensor-proxy

2025-10-13 13:17:05 +00:00

pulse-sensor-cleanup.sh

Fix temperature monitoring for standalone Proxmox nodes and add multi-arch sensor proxy builds

2025-11-05 19:41:09 +00:00

pulse-sensor-proxy.service

feat(security): Enhance systemd hardening directives

2025-11-07 17:09:47 +00:00

run-tests-mock.sh

Adopt multi-token auth across docs, UI, and tooling

2025-10-14 15:47:49 +00:00

secure-sensor-files.sh

security: complete Phase 1 sensor proxy hardening

2025-10-20 15:13:37 +00:00

setup-log-forwarding.sh

security: complete Phase 1 sensor proxy hardening

2025-10-20 15:13:37 +00:00

sync-production-config.sh

refactor: remove legacy DISABLE_AUTH flag and enhance authentication UX

2025-10-27 19:46:51 +00:00

test-vm-disk.sh

Update Proxmox guest agent permissions docs and tooling (refs #548)

2025-10-14 10:21:52 +00:00

toggle-mock.sh

refactor: remove legacy DISABLE_AUTH flag and enhance authentication UX

2025-10-27 19:46:51 +00:00

uninstall-host-agent.ps1

feat: add native Windows service support and expandable host details

2025-10-23 22:11:56 +00:00

uninstall-host-agent.sh

feat: enhance macOS/Linux agent installation to match Windows quality

2025-10-23 22:23:23 +00:00

validate-release.sh

Add Windows ARM64 support for host agent (related to #654)

2025-11-07 12:18:57 +00:00