Struct HardenConfig 

pub struct HardenConfig {

    pub new_user: Option<String>,
    pub ssh_port: Option<u64>,
    pub docker_install_url: Option<String>,
    pub docker_rootless: Option<bool>,
    pub swap_size_gb: Option<u32>,
    pub journald_max_use: Option<String>,
    pub timezone: Option<String>,
    pub unattended_security_upgrades: Option<bool>,
    pub fail2ban: Option<bool>,
    pub mosh: Option<bool>,
    pub sshd_ciphers: Option<String>,
    pub sshd_kex: Option<String>,
    pub sshd_macs: Option<String>,
    pub extra_ufw_allow: Option<Vec<String>>,
}

User overrides for dsc harden defaults. Every field is optional; anything left unset falls back to the built-in defaults applied in commands::harden::resolve_options. CLI flags override this block on a per-run basis.

Fields

new_user: Option<String>

Username for the new sudo-enabled non-root account. Default: discourse.

ssh_port: Option<u64>

SSH port to move the daemon to in stage 2. Default: 2227.

docker_install_url: Option<String>

URL to fetch the Docker installer from. Default: https://get.docker.com.

docker_rootless: Option<bool>

Whether to install Docker rootless. Default: true.

swap_size_gb: Option<u32>

Swap file size in GB. 0 to skip. Default: 2.

journald_max_use: Option<String>

Cap on journald disk use. Default: 500M.

timezone: Option<String>

Timezone to set via timedatectl. Default: UTC.

unattended_security_upgrades: Option<bool>

Whether to enable unattended security upgrades. Default: true.

fail2ban: Option<bool>

Whether to install fail2ban. Default: true.

mosh: Option<bool>

Whether to install mosh and open UDP 60000-61000. Default: false.

sshd_ciphers: Option<String>

Override sshd Ciphers line. Defaults to dsc’s policy overlay (drop legacy algorithms while preserving upstream defaults).

sshd_kex: Option<String>

Override sshd KexAlgorithms line. Defaults to dsc’s policy overlay (prefer PQ-hybrid first, disable legacy SHA-1 DH groups).

sshd_macs: Option<String>

Override sshd MACs line. Defaults to dsc’s policy overlay (disable legacy SHA-1/MD5 and short UMAC variants).

extra_ufw_allow: Option<Vec<String>>

Extra ufw allow rules applied after the standard set (e.g. ["3000/tcp", "192.168.1.0/24"]).

Trait Implementations

impl Clone for HardenConfig

fn clone(&self) -> HardenConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HardenConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HardenConfig

fn default() -> HardenConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for HardenConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for HardenConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.