Skip to main content
← back to extensions

Server Host

@randybias/server-hostv2026.10.17.4beta· 9d agoBEHAVIORSACCEPTED WARNINGS
01README

Harden a freshly provisioned Linux host over SSH in three phases: base packages and users, an nftables firewall rendered from inputs, and an SSH lockdown. The target and every phase input are method arguments, and the firewall and lockdown phases arm a host-side revert timer before they change anything unless commit cancels it.

02Behaviors1
@randybias/server-hostv2026.10.17.4server_host.ts
fn apply_base()
DESTRUCTIVE. Idempotent. Install the named base packages, create the admin user and authorized keys, write sysctl and journald settings, then set the time zone and enable time sync. Replaces the managed authorized_keys file, so an empty list revokes the managed keys. Returns the operations applied and the ones whose inputs changed; an unchanged re-run emits no commands.
fn render_firewall()
READ-ONLY. Render the deterministic nftables ruleset for the given inputs, with CIDRs and ports sorted, and return its text and SHA-256. Makes no remote call.
fn apply_firewall()
DESTRUCTIVE. Pre-check the rendered ruleset with nft, snapshot the current one, arm a host-side revert timer, then apply it with nft; a wrong ruleset can cut management access, so the host restores the snapshot unless commit cancels the timer. Idempotent: a matching ruleset that is still live is a no-op. Refuses while an earlier revert is still active or firing.
fn lockdown()
DESTRUCTIVE. Restrict the SSH port to management_cidrs, pre-checking the ruleset, snapshotting the current one and arming a host-side revert timer before the change. Returns the revert token and expiry; unless commit cancels the timer the host restores the snapshot.
fn commit()
DESTRUCTIVE. Removes automatic recovery. Cancel the armed revert after confirming the host is still reachable. Probes that the timer is still active and the live ruleset still matches the armed revert, refuses when it does not, and treats a failed cancellation as fatal; only then is the revert recorded as committed.
fn forget()
DESTRUCTIVE. Delete what this model recorded for a host that no longer exists: its phase state, revert record and pending revokes. Makes no remote call; run it after the machine is gone, never to clear a live host's record.
fn get()
READ-ONLY. Probe the host and record what it sees as the observation resource: revert timer and expiry, managed ruleset hash, drift and SSH exposure. A failed probe is an error, not an observation.
fn sync()
READ-ONLY. Probe the host and record the observation resource, including drift between the recorded state and the live ruleset and revert timer. A failed probe is an error, not an observation.

Resources

host_state(infinite)— Recorded base and firewall phase state for one host
revert(1d)— An armed host-side revert timer and the snapshot it restores
observation(infinite)— What get or sync last saw on the host: revert timer and expiry, managed ruleset hash, drift and SSH exposure
firewall_render(1d)— A rendered nftables ruleset and its SHA-256
03Previous Versions2
2026.10.17.3

Modified 1 behaviors

2026.10.17.1
04Stats
A
93 / 100
Downloads
2
Archive size
79.4 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License1/2partial

    no SPDX license declared

  • Verified public repository2/2earned
Repository
https://github.com/randybias/swamp-extensions

06Platforms
07Labels
#linux#hardening#firewall#nftables#ssh#sysctl#lockdown#remote