Add comprehensive systemd security hardening

- PrivateDevices: Private /dev with minimal devices
- ProtectKernelTunables/Modules/Logs: Prevent kernel tampering
- ProtectControlGroups/Clock: Protect system resources
- ProtectProc/ProcSubset: Hide other processes
- RestrictRealtime: No realtime scheduling
- RestrictSUIDSGID: Prevent SUID/SGID files
- LockPersonality: Prevent execution domain changes
- RestrictAddressFamilies: Only allow TCP/IP + Unix sockets
- SystemCallArchitectures: Native architecture only

These restrictions significantly reduce attack surface while
maintaining full application functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: baocin

deploy/install.sh

@@ -139,6 +139,19 @@ ProtectHome=true
 ReadWritePaths=/var/lib/gitvet
 ReadOnlyPaths=/etc/letsencrypt
 PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectProc=invisible
+ProcSubset=pid
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target

deploy/update.sh

@@ -205,12 +205,27 @@ Environment="SEMGREP_SEND_METRICS=off"
 ExecStart=/opt/gitvet/gitvet-server -listen :80 -tls-listen :443 -tls-cert /etc/letsencrypt/live/git.vet/fullchain.pem -tls-key /etc/letsencrypt/live/git.vet/privkey.pem -ssh-listen :22 -enable-ssh=true -db /var/lib/gitvet/data/gitvet.db -cache-dir /var/lib/gitvet/cache -opengrep SCANNER_PATH_PLACEHOLDER
 Restart=always
 RestartSec=5
+
+# Security hardening
 NoNewPrivileges=true
 ProtectSystem=strict
 ProtectHome=true
 ReadWritePaths=/var/lib/gitvet
 ReadOnlyPaths=/etc/letsencrypt
 PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectProc=invisible
+ProcSubset=pid
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target