cali-ops-server-security
Installation
SKILL.md
Server Security Audit & Hardening
6-layer security model for private servers behind Tailscale.
Security Layers
Internet → CloudFlare → UFW → Tailscale → SSH → Docker → App
| Layer | Purpose | Tool |
|---|---|---|
| 1. CloudFlare | CDN, DDoS, SSL, WAF, hide real IP | CloudFlare DNS + Tunnel |
| 2. UFW | Port filtering, default deny | UFW firewall |
| 3. Tailscale | WireGuard tunnel, private network | Tailscale |
| 4. SSH | Authentication, access control | OpenSSH / Tailscale SSH |
| 5. Docker | Container isolation, socket security | Docker Engine |
| 6. Application | Process isolation, env vars, volumes | Docker Compose |