Editing Ov.430.ch Host Reconnaissance Report (section)

=== Medium Priority ===

==== Add HSTS ====

Finding:

* HSTS is not configured.

Recommended Caddy header:

<pre>
header Strict-Transport-Security "max-age=31536000; includeSubDomains"
</pre>

Use a shorter rollout first if desired:

<pre>
header Strict-Transport-Security "max-age=86400"
</pre>

==== Reduce version disclosure ====

Finding:

Headers expose:

<pre>
Server: Caddy
Server: Apache/2.4.67 (Debian)
X-Powered-By: PHP/8.3.32
</pre>

Recommendation:

* Remove <code>X-Powered-By</code> in PHP/Apache configuration.
* Do not rely on header hiding for security, but reduce unnecessary precise version hints.

==== Review MediaWiki anonymous permissions ====

Finding:

* Public API exposes users, groups, recent changes, siteinfo, versions, and extensions.
* The page config has indicated anonymous editability in previous HTML checks.

Recommendation:

If <code>ov.430.ch</code> should be public-editable, leave this alone but monitor abuse.

If not:

<pre>
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['writeapi'] = false;
</pre>

Also review upload settings, because <code>maxuploadsize</code> is <code>104857600</code>.

==== Add firewall policy ====

Finding:

<pre>
INPUT ACCEPT
DOCKER-USER -j RETURN
</pre>

Recommendation:

* Define an explicit host firewall policy.
* Use <code>DOCKER-USER</code> for Docker-published ports, since Docker inserts NAT/filter rules.
* Permit only intended public services:
** <code>22/tcp</code> if SSH must be public
** <code>80/tcp</code>
** <code>443/tcp</code>
** <code>443/udp</code> if HTTP/3 is desired
** Mindustry ports if desired