Security Hardening

Trigger

Use this skill when the user wants to:

• Configure or modify UFW firewall rules on the Pi
• Set up or tune fail2ban jails for SSH, Nginx, or other services
• Lock down SSH to key-only authentication
• Harden Docker containers (non-root users, read-only filesystems, capability dropping)
• Secure Vaultwarden, Nginx Proxy Manager, or other exposed services
• Protect the Docker socket from unauthorized access
• Audit the current security posture of the home lab

Required Inputs

• Target Pi hostname or IP
• Which services are externally exposed (if any)
• Whether a reverse proxy (Nginx Proxy Manager) is in front of services
• Current firewall state (or willingness to enable UFW)