you're up late, operator

nightshift — auditable host hardening

a from-scratch host hardening toolkit, in plain bash

what it is

Host hardening you can actually read. Every part of it is plain bash you can open and inspect — no opaque binaries, no obfuscation, no phone-home, no auto-update you did not ask for.

Per-source flood protection, blocklists from three feeds, fail2ban integration, and a themed status / dashboard / TUI — all sitting on one shared, tested data layer.

install

The recommended way — fetch it, read it, then run it. The whole point of this project is that nothing about it is a black box, and the install should not ask you to take that on faith.

audit first

  $ curl -fsSLO https://nightshift.akkun.space/install.sh
  # read it. that is the point.
  $ sudo bash install.sh

Or, if you'd rather not read it — the one-liner:

one-liner

  $ curl -fsSL https://nightshift.akkun.space/install.sh | sudo bash

the three tiers

nightshift status

one screen, no dependencies. blocks, services, load.

nightshift dash

live gauges. press q to quit.

nightshift tui

menus. drill into the blocklist. ban and unban.

what it looks like

  $ monitor   ● active   enabled
  $ firewall  ● active   enabled
  $ cpu       ▃▃░░░░░░░░░░░░░░   8.0%
  $ ram       ▃▃▃▃▃░░░░░░░░░░░   31.0%
  $ blockv4  9323
  $ flood     0 now   0 drops
  $ allow     ● yes

what it defends against

per-source rate limits — one hostile address is throttled on its own, instead of filling a shared bucket that drops everyone else.
timed auto-ban — a SYN flooder is added to a set that evicts itself in 2 minutes. nothing accumulates, nothing is permanent.
blocklists — three feeds, with entries that retire cleanly.
kernel hardening — sysctls, annotated, revertable.

● Honest limit: this defends against resource exhaustion — SYN floods, connection floods. It cannot defend against volumetric DDoS. Once an attack saturates the uplink, no rule on the box sees the packets. That needs upstream mitigation.

safety properties

● Validates with nft -c before applying. A bad feed cannot leave a half-applied firewall.

● Your IP is always allowlisted. If it cannot determine your address, it refuses to build rather than guess.

● Owns exactly one nftables table. Never touches ufw, firewalld or docker.

● No auto-update, no silent auto-bans from a binary you cannot read.

uninstall

clean removal

  $ sudo systemctl disable --now nightshift-monitor nightshift-blocklist.timer nightshift-firewall
  $ sudo nft delete table inet nightshift
  $ sudo rm /usr/local/bin/nightshift /usr/local/bin/nightshift-{status,dash,tui,firewall,monitor}
  $ sudo rm -rf /usr/local/lib/nightshift
  $ sudo rm /etc/systemd/system/nightshift-*