Initial commit

syncthing/sync/Security_Plans.txt

@@ -0,0 +1,69 @@
+Cloud Security Steps
+
+[01] Configure Cloudflare Tunnel (cloudflared)
+- Set up a named tunnel on your Raspberry Pi.
+- Only expose required services (Nextcloud, optionally Pi-hole) through the tunnel.
+- Run cloudflared as a systemd service to ensure it starts automatically.
+
+[02] Configure HTTPS / SSL
+- Ensure "Full (strict)" SSL mode is used in Cloudflare.
+- Install Cloudflare Origin Certificate on the Pi.
+- Verify all traffic is served over HTTPS.
+
+[03] Secure SSH on Raspberry Pi
+- Disable SSH password login.
+- Disable root login via SSH.
+- Use SSH keys for authentication only.
+- Restrict SSH access to trusted IPs if possible.
+
+[04] Configure Raspberry Pi firewall
+- Default deny all incoming connections.
+- Allow only outbound traffic necessary for updates and cloudflared tunnel.
+- Optionally restrict access to Pi-hole (DNS) or Nextcloud ports internally.
+
+[05] Secure Nextcloud
+- Set trusted domains in Nextcloud configuration.
+- Enforce HTTPS only.
+- Move Nextcloud data directory outside web root.
+- Ensure correct file permissions on Nextcloud data.
+- Configure database to accept connections only from localhost.
+- Set strong database password.
+
+[06] Nextcloud Web Security Settings
+- Enable 2FA for all admin and important users.
+- Enable brute-force protection app.
+- Enable strong password policy app.
+- Disable or uninstall unused apps.
+- Configure HSTS headers: 
+   - Enable HSTS headers (max-age 15552000)
+   - Include Subdomains only if all HTTPS
+   - Preload OFF
+   - Enable No-Sniff header
+
+[07] Cloudflare Zero Trust / Access Policies
+- Enable Zero Trust access.
+- Require authentication (Google/GitHub/email) to access Nextcloud.
+- Apply policies only to allowed users.
+- Enable Web Application Firewall (WAF) in Cloudflare.
+- Add rate-limiting rules for login pages.
+
+[08] Verify tunnel and DNS
+- Confirm Cloudflare Tunnel routes Nextcloud (and Pi-hole if needed) correctly.
+- Ensure your home IP is not exposed.
+- Test that Nextcloud is accessible via the domain only through Cloudflare.
+
+[09] Backups / Credential Security
+- Set up encrypted backups of Nextcloud data and database.
+- Backup /etc/cloudflared/config.yml and Nextcloud config.
+- Store SSH keys and Cloudflare certificates securely.
+- Test restoration of at least one backup.
+
+[10] Test Security Headers
+- Verify HSTS and No-Sniff headers are active using curl or https://securityheaders.com.
+- Ensure browsers enforce HTTPS and MIME sniffing prevention.
+
+
+
+
+glances token
+CF-Access-Client-Secret: f7908c8d9e1206284dfbcb43a29106ff9c50ec9b9397a08d0420a6a6d3cec061