nixos-config/docs/intent/full-system-audit-remediation.md

Intent: Remediate Selected Full-System Audit Findings

Context

This intent implements a selected subset of findings from the latest full-system audit.

The goal is to keep the changes minimal and focused. Findings that are known to be intentional, currently irrelevant, or intentionally deferred must not be changed as part of this intent.

Scope

Implement the following changes only.

1. Run Nix garbage collection daily

Configure the system so that Nix garbage collection runs once per day.

Keep this deliberately simple:

• run Nix garbage collection daily
• do not add a custom retention period
• do not add unnecessary cleanup policy or additional lifecycle logic
• prefer the normal declarative NixOS mechanism

The platform changes frequently, so the intent is simply to prevent old generations and unused store paths from accumulating indefinitely.

2. Disable the Codeberg mirror

The currently failing Codeberg mirroring is not needed for now.

Disable the Codeberg mirror / mirroring job so that the system stops repeatedly attempting to mirror to Codeberg.

Do not repair or redesign the Codeberg mirroring in this intent.

The desired state is simply: Codeberg mirroring is disabled until it is intentionally re-enabled in a future intent.

3. Remove orphaned GoToSocial data

Remove the obsolete / orphaned GoToSocial data identified by the audit.

GoToSocial is no longer expected to use this data, so it may be deleted.

Before deleting anything, make sure the target is in fact the GoToSocial data identified by the audit and not data belonging to another active service.

Do not introduce a new GoToSocial deployment or migration.

4. Protect the public LDAP user interface with Fail2ban

The LDAP web interface is intentionally publicly reachable because it is the user-facing interface through which users can, among other things, manage their own passwords.

Do not hide it behind an authentication middleware or make it private.

Instead, add Fail2ban protection against repeated failed login attempts.

Desired behavior:

• the interface remains publicly reachable
• failed authentication attempts can be detected reliably
• after 5 failed login attempts from the same IP, that IP is banned
• implement this using the existing NixOS configuration and Fail2ban in a maintainable way
• inspect the actual LDAP web application / backend logging first so the filter matches real failed-login log entries rather than assumptions

Choose a sensible ban duration using normal Fail2ban conventions unless an existing platform-wide convention already exists.

Do not weaken legitimate access to the user interface.

5. Bind MariaDB locally

MariaDB is used by the local WordPress deployment and does not need to listen publicly.

Change MariaDB so that it listens only on the local interface needed by WordPress, rather than on 0.0.0.0:3306.

The desired result is that MariaDB is not remotely reachable from the network while WordPress continues to function normally.

Prefer loopback/local-only binding unless the existing architecture demonstrates that a different local interface is required.

Explicitly Out of Scope

Do not address the following audit findings in this intent:

• Pinix availability: Pinix being offline is currently intentional.
• Forgejo bad object errors: defer investigation and repair for now.
• Codeberg mirroring repair: disable it only; do not fix it.
• any unrelated audit finding
• unrelated refactoring or cleanup discovered while implementing this intent

If something outside this scope appears important, document it rather than changing it.

Implementation Principles

• Keep changes minimal.
• Prefer declarative NixOS configuration wherever applicable.
• Inspect existing configuration before adding new mechanisms.
• Do not duplicate functionality that already exists.
• Preserve existing service behavior except for the explicitly requested changes.
• Operational deletion of the obsolete GoToSocial data is permitted.
• Do not perform unrelated upgrades.

Verification

After implementation, verify each requested outcome.

Nix garbage collection

Confirm that:

• a daily GC schedule exists
• the configured mechanism is enabled
• there is no unnecessary custom retention policy added

Codeberg mirror

Confirm that:

• Codeberg mirroring is disabled
• the system no longer schedules or repeatedly attempts that mirror operation
• other intended Forgejo functionality remains unaffected

GoToSocial data

Confirm that:

• the intended orphaned GoToSocial data has been removed
• no active unrelated service data was removed
• no active service now fails because of the deletion

LDAP / Fail2ban

Confirm that:

• the LDAP user interface remains reachable
• failed login attempts produce log entries that match the Fail2ban filter
• 5 failed attempts from one IP trigger the configured jail
• legitimate successful login remains possible
• the protection survives configuration rebuild/reboot through declarative configuration

Do not intentionally lock out normal administrative access during testing.

MariaDB

Confirm that:

• MariaDB no longer listens on 0.0.0.0:3306
• MariaDB is only reachable through the required local interface
• WordPress can still connect to MariaDB
• WordPress continues to function after the change

Deliverable

Implement the changes and provide a concise completion report containing:

• files/configuration changed
• runtime action performed, if any
• verification performed for each item
• any caveats or follow-up work discovered

Do not expand the scope without a separate intent.