Security Hardening

Prerequisites

• Dedicated service identity
• Protected config and secret files
• TLS or trusted proxy boundary
• Database users scoped to Oriel databases

Steps

Use a dedicated service user:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin oriel

Protect config:

sudo install -m 0640 -o root -g oriel oriel.example.toml /etc/oriel/oriel.toml

Prefer environment variables or external secret management for:

• ORIEL_METADATA_DSN
• ORIEL_CLICKHOUSE_DSN
• ORIEL_AUTH_COOKIE_SECRET
• ORIEL_AUTH_OIDC_<SLUG>_CLIENT_SECRET

Use TLS or bind plaintext listeners to loopback behind a proxy. Avoid server.insecure = true outside local or tightly controlled networks.

Use the shipped systemd units as the hardening baseline. They set:

• NoNewPrivileges=true
• ProtectSystem=strict
• ProtectHome=true
• PrivateTmp=true
• Empty capability sets
• ReadWritePaths=/var/lib/oriel

Verify

oriel --config /etc/oriel/oriel.toml doctor
systemctl cat oriel.service
curl -fsS http://localhost:6743/readyz

Review audit logs after role, token, workspace, and member changes.

Rollback/Recover

• Revoke leaked API or ingest tokens immediately.
• Rotate auth.cookie_secret only with awareness that in-flight OIDC login transactions may be affected.
• If a hardening option blocks a needed file path, add a narrow allowlist rather than broadening filesystem access.