DevSecOps
Explore Dev Corner articles and subtopics in DevSecOps. This hub page collects practical builds, tools, and engineering guides for sovereign local AI.
Topic breadth
3
Active builds, guides, and subtopic coverage.
Subtopics
Server Hardening
View topicHarden Linux servers for sovereign production: CIS Benchmark implementation, sysctl kernel parameter tuning, unnecessary service removal, and automated hardening with Ansible.
Firewall & Network Security
View topicSovereign network perimeter security: nftables ruleset design, UFW for simple use cases, Suricata IDS/IPS configuration, fail2ban, and network segmentation for self-hosted stacks.
SSH & Access Control
View topicHarden SSH for sovereign server access: key-only authentication, sshd_config hardening, 2FA with TOTP, bastion host architecture, and certificate-based SSH with a self-hosted CA.
TLS & Certificates
View topicSovereign TLS management: Let's Encrypt with Certbot and ACME.sh, internal PKI with step-ca, mTLS for service-to-service auth, certificate pinning, and TLS 1.3 configuration.
CVE & Vulnerability Management
View topicSovereign vulnerability management: CVE triage with EPSS and CISA KEV, container scanning with Trivy and Grype, patch automation, and building a private vulnerability intelligence pipeline.
Supply Chain Security
View topicSecure your software supply chain: SBOM generation (Syft, Trivy), image signing with Cosign and Sigstore, dependency provenance, and EU Cyber Resilience Act (CRA 2026) compliance.