Editing Ov.430.ch Host Reconnaissance Report (section)

== Executive Summary ==

<code>ov.430.ch</code> is a Debian 13 VPS hosted at:

<pre>
IPv4: 83.228.241.25
IPv6: 2001:1600:18:102::26f
hostname: ov-9520b2
</pre>

The host exposes:

* SSH on <code>22/tcp</code>.
* Caddy on <code>80/tcp</code>, <code>443/tcp</code>, and QUIC <code>443/udp</code>.
* <code>systemd-resolved</code> LLMNR on <code>5355/tcp</code> and <code>5355/udp</code> for IPv4 and IPv6.
* Mindustry Java service on <code>6567/tcp</code>, <code>6567/udp</code>, and <code>20151/udp</code>.
* Docker-published MediaWiki backend on host <code>8080/tcp</code>, clearly open on IPv6 and locally reachable on IPv4.

The current application stack:

<pre>
Caddy 2.6.2 -> Docker-published MediaWiki container -> Apache 2.4.67 -> PHP 8.3.32 -> MediaWiki 1.46.0 -> MariaDB 12.3.2
</pre>

Highest-value fixes:

# Disable or firewall public LLMNR on <code>5355/tcp</code> and <code>5355/udp</code>.
# Stop publishing MediaWiki container port <code>8080</code> to public interfaces; bind it to <code>127.0.0.1</code> or put Caddy on the Docker network.
# If Mindustry is intended public, document and intentionally allow <code>6567/tcp</code>, <code>6567/udp</code>, and <code>20151/udp</code>; otherwise close them.
# Add HSTS to Caddy.
# Add firewall policy in <code>DOCKER-USER</code> or host firewall rules, because Docker currently exposes port mappings without an explicit deny layer.
# Review whether public account creation/editing on <code>ov.430.ch</code> is intentional.