landfall 0.6.0 → 0.6.2

package/README.md

@@ -31,6 +31,7 @@ cd my-site && lf deploy -s vps      # live at https://my-site.203-0-113-7.sslip.
 - [Managing servers](#managing-servers)
 - [Traffic, certificates and checks](#traffic-certificates-and-checks)
 - [Server system](#server-system)
+- [Security](#security)
 - [Web UI](#web-ui)
 - [Using landfall from scripts and agents](#using-landfall-from-scripts-and-agents)
 - [Command reference](#command-reference)
@@ -40,7 +41,7 @@ cd my-site && lf deploy -s vps      # live at https://my-site.203-0-113-7.sslip.
 
 ## Install
 
-You need Node.js 22.4+ plus `ssh`, `ssh-copy-id` and `tar` on your machine. The server must run Ubuntu or Debian
+You need Node.js 22.4+ plus `ssh`, `ssh-copy-id` and `tar` on your machine (`rsync` makes redeploys faster). The server must run Ubuntu or Debian
 and accept a login as root or as a user with passwordless sudo. landfall installs Docker itself.
 
 ```sh
@@ -74,7 +75,7 @@ lf setup vps --host 203.0.113.7
 ```
 
 1. Creates `~/.ssh/landfall_vps` and installs it with `ssh-copy-id`. You type the root password once.
-2. Installs Docker, ufw (allowing ssh, 80 and 443, plus 443/udp for HTTP/3), fail2ban and unattended-upgrades.
+2. Installs Docker, rsync, ufw (allowing ssh, 80 and 443, plus 443/udp for HTTP/3), fail2ban and unattended-upgrades.
 3. Creates the user `deploy` in the docker group and disables ssh password login. Root keeps key-only access.
 4. Writes `Host vps` to `~/.ssh/config`, creating the file if needed. `ssh vps` now logs in as `deploy`.
 5. Starts Traefik, which gets Let's Encrypt certificates for every site.
@@ -164,6 +165,9 @@ The first deploy writes `.landfall.json`. Commit it:
 
 Local `.env*` files are never used on the server: each site has its own `.env` there. Pass variables with
 `-e`/`--env-file`, or later with `lf env`. `--env-file -` reads the lines from stdin, so secrets stay out of `ps`.
+Changed something locally? Run `lf deploy` again (or **Redeploy** in `lf ui`). When both sides have `rsync`, a redeploy sends
+only the files that changed and copies the rest from the live release on the server (files you removed stay
+removed); otherwise it uploads the whole folder. Either way it becomes a new release, so `lf rollback` still goes back.
 `--keep 10` keeps more releases. A deploy is refused when another Compose project on the server already uses the
 site's project name, since `docker compose` would otherwise take over its containers.
 
@@ -516,6 +520,19 @@ started service, puts a removed key back, bans an unbanned IP again or restores
 firewall does. Services work with systemd and OpenRC. The Docker log limit applies to containers created
 afterwards (and Docker restarts only with `--restart`), so redeploy or restart sites to apply it to them.
 
+## Security
+
+```sh
+lf security                       # ssh passwords, root login, firewall, fail2ban, automatic updates, pending reboot
+lf harden                         # all of: ssh (keys only), fail2ban, updates; or name the parts
+lf harden ssh                     # asks first; refuses while a user logs in with a password only (--force)
+lf keys add --generate -u anna    # new pair at ~/.ssh/<server>_anna, its public key on the server
+```
+
+`lf setup` and `lf server add` end with the same advice, and the web UI shows it on the system tab with a
+button per fix. Each fix is journaled, so `lf undo` takes it back. Automatic updates know apt
+(unattended-upgrades) and dnf (dnf-automatic). Without root or sudo landfall only checks sshd's settings.
+
 ## Web UI
 
 ```sh
@@ -612,7 +629,9 @@ lf undo -s box -y                           # revert the last run
 | `lf services restart\|start\|stop <service>` | Controls a service. Stopping ssh needs `--force`; stopping or restarting docker asks first. Start and stop can be undone. |
 | `lf services logs <service> [-f] [-n lines]` | Shows a service's log: journald, else its log file. |
 | `lf keys [--json]` | Lists the SSH keys in each user's `authorized_keys` (root and `/home/*`). ★ marks the key this machine logs in with. Alias: `keys ls`. |
-| `lf keys add <key\|file.pub> [--user u]` | Adds a public key, to the login user by default. Undoable. |
+| `lf keys add <key\|file.pub> [--user u] [--generate]` | Adds a public key, to the login user by default. `--generate` makes a new pair at `~/.ssh/<server>_<user>` instead. Undoable. |
+| `lf security [--json]` | Checks ssh password and root login, firewall, fail2ban, automatic updates and a pending reboot, and names the command that fixes each. |
+| `lf harden [ssh\|fail2ban\|updates…] [--force]` | Turns ssh passwords off, installs and starts fail2ban, turns on automatic security updates; all three without arguments. `ssh` refuses to lock out password-only users without `--force`. Undoable. |
 | `lf keys rm <fingerprint\|comment> [--user u]` | Removes a key by comment or fingerprint prefix. Refuses the key this machine uses without `--force`. Undoable. |
 | `lf bans [--json]` | Shows banned IPs per fail2ban jail. |
 | `lf unban <ip>` | Unbans an IP in every jail that bans it. Undo bans it again. |
@@ -711,7 +730,7 @@ On the server:
 /etc/ssh/sshd_config.d/00-landfall.conf   ssh hardening from `lf setup`
 ```
 
-`lf setup` also installs Docker with the compose plugin, ufw, fail2ban and unattended-upgrades, and creates the
+`lf setup` also installs Docker with the compose plugin, rsync, ufw, fail2ban and unattended-upgrades, and creates the
 `deploy` user (group docker). Before changing a file, landfall keeps a backup next to it as
 `.<file>.landfall-<run>` (the newest 10). `lf config` and the web UI's *Overview* list all of these places.