Security and hardening

nightshipd’s security rests on two things: the data directory as the root of trust, and a reverse proxy for TLS. Here’s the checklist for a production server.

Lock the data directory

Local write access to the data directory can mint an admin token offline, so it is the root of trust. Keep it owner-only (chmod 700); the systemd unit’s UMask=0077 keeps new files 600/700.

Terminate TLS; never expose plain HTTP

Put Caddy or nginx in front and keep nightshipd’s own port off the public internet — see Terminate TLS with a reverse proxy.

Scope every credential

Give CI a publisher token limited to its channels — a leaked one can’t touch users, other channels, or admin state.
Prefer invites over sharing tokens: single-use and time-boxed.
Tokens are stored hashed and shown once; revoke instantly with token delete.
For Tide, the bucket write key is scoped to one bucket, and clients hold no standing credentials at all.

Harden the service

The provided systemd unit already sets NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, and friends. Keep them.

Brute-force protection (built in, on by default)

The server rate-limits itself — there is nothing to install and no proxy module to build. Two budgets per client:

5 per minute on the unauthenticated POSTs that carry a credential or send mail: invite redemption, the first-run claim, access requests and the SSO handoff. Counted whether they succeed or fail, because spamming an access request doesn’t look like a failure.
30 per minute on requests that arrive with a missing or wrong token.
A request with a valid token is never counted, so CI bursts are never throttled.

Over budget answers 429 with a Retry-After header. Behind a reverse proxy the client is the first X-Forwarded-For hop — trusted only because your proxy connects over loopback, so it can’t be spoofed from outside. A request from the machine itself with no such header is exempt, which keeps local tooling working. Already limiting at your own edge or WAF? Start the server with --rate-limit off.

Size for your builds

Cargo uploads are buffered in memory up to 2 GB per build, so size the host’s RAM accordingly for large Cargo builds. (Tide streams chunks and doesn’t have this ceiling.)

Back up

A recoverable server is a secure server — keep scheduled, owner-only backups of the data directory (Back up and restore).

← All guides