V8.00.000.2025.06.17
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 34s
🔁 Render Graphviz Diagrams. / 🔁 Render Graphviz Diagrams. (push) Successful in 24s
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m35s
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 34s
🔁 Render Graphviz Diagrams. / 🔁 Render Graphviz Diagrams. (push) Successful in 24s
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m35s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
90
README.md
90
README.md
@@ -1,3 +1,89 @@
|
||||
# CISS.debian.installer
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
[](https://git.coresecret.dev/msw/CISS.debian.installer)
|
||||
|
||||
[](https://eupl.eu/1.2/en/)
|
||||
[](https://opensource.org/license/eupl-1-2)
|
||||
[](https://www.gnu.org/software/bash/)
|
||||
[](https://shellcheck.net/)
|
||||
[](https://github.com/mvdan/sh)
|
||||
[](https://google.github.io/styleguide/shellguide.html)
|
||||
|
||||
[](https://docs.gitea.com/)
|
||||
[](https://www.jetbrains.com/store/?section=personal&billing=yearly)
|
||||
[](https://keepassxc.org/)
|
||||
[](https://www.netcup.com/de)
|
||||
[](https://coresecret.eu/)
|
||||
[](https://x.com/coresecret_eu)
|
||||
[](https://coresecret.eu/spenden/#sepa)
|
||||
[](https://coresecret.eu/spenden/#bitcoin)
|
||||
[](https://coresecret.eu/contact/#simplex)
|
||||
|
||||
CISS Debian Installer
|
||||
# 1. CISS.debian.installer
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
|
||||
**Master Version**: 8.00<br>
|
||||
**Build**: V8.00.000.2025.06.17<br>
|
||||
|
||||
This is a digitally signed, self-verifying shell script for installing a hardened Debian Bookworm server environment, based on
|
||||
the latest server and service hardening best practices. Compared to the original Debian installer, this installer offers much
|
||||
greater flexibility in terms of custom partitioning schemes and is more reliable than the Calamares suite.<br>
|
||||
|
||||
Check out more:
|
||||
* [CenturionNet Services](https://coresecret.eu/cnet/)
|
||||
* [CenturionDNS Resolver](https://eddns.eu/)
|
||||
* [CenturionDNS Blocklist](https://dns.eddns.eu/blocklists/centurion_titanium_ultimate.txt)
|
||||
* [CenturionNet Status](https://uptime.coresecret.eu/)
|
||||
* [CenturionMeet](https://talk.e2ee.li/)
|
||||
* [Contact the author](https://coresecret.eu/contact/)
|
||||
|
||||
## 1.1. Preliminary Remarks
|
||||
|
||||
### 1.1.1. HSM
|
||||
Please note that all my signing keys are stored in an HSM and that the signing environment is air-gapped. The next step is to
|
||||
move to a room-gapped environment. ^^
|
||||
|
||||
### 1.1.2. DNSSEC, HSTS, TLS
|
||||
|
||||
Please note that `coresecret.dev` is included in the [(HSTS Preload List)](https://hstspreload.org/) and always serves the headers:
|
||||
````nginx configuration pro
|
||||
add_header Expect-CT "max-age=86400, enforce" always;
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
````
|
||||
|
||||
* Additionally, the entire zone is dual-signed with **DNSSEC**. See the current **DNSSEC** status at: **[DNSSEC Audit Report](/docs/AUDIT_DNSSEC.md)**
|
||||
* A comprehensive TLS audit of the **`git.coresecret.dev`** Gitea server is also available. See: **[TLS Audit Report](/docs/AUDIT_TLS.md)**
|
||||
* The infrastructure of the **`CISS.debian.installer`** building system is visualized here. See: **[Centurion Net](/docs/CNET.md)**
|
||||
|
||||
### 1.1.3. Gitea Action Runner Hardening
|
||||
|
||||
The CI runners operate on a dedicated host system located in a completely separate Autonomous System (AS). This host is solely
|
||||
dedicated to providing CI runners and does not perform any other tasks. Each runner is hermetically isolated from others using
|
||||
non-privileged, shell-less user accounts with no direct login capability. Additionally, each runner executes within its own
|
||||
separate directory tree, employs `DynamicUser` features, and adheres to strict systemd hardening policies
|
||||
(achieving a ``systemd-analyze security``rating of **``2.6``**). Docker containers used by runners do not run in privileged
|
||||
mode. Security is further enhanced through the use of both UFW software firewalls and dedicated hardware firewall appliances.
|
||||
|
||||
### 1.2. Keywords
|
||||
|
||||
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
|
||||
"MAY", and "OPTIONAL" in this document are to be interpreted as described in [[BCP 14](https://www.rfc-editor.org/info/bcp14)],
|
||||
[[RFC2119](https://datatracker.ietf.org/doc/html/rfc2119)], [[RFC8174](https://datatracker.ietf.org/doc/html/rfc8174)] when,
|
||||
and only when, they appear in all capitals, as shown here.
|
||||
|
||||
# 6. Licensing & Compliance
|
||||
|
||||
This repository is fully SPDX-compliant. All source files include appropriate SPDX license identifiers and headers to ensure
|
||||
clear and unambiguous licensing. You can verify compliance by reviewing the top of each file, which follows the SPDX
|
||||
standard for license expressions and metadata.
|
||||
|
||||
# 7. Disclaimer
|
||||
|
||||
This README is provided "as-is" without any warranty. Review your organization's policies before deploying to production.
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
|
||||
Reference in New Issue
Block a user