Guided security hardening for self-hosters

The security mistakes on your home server, found and fixed for you.

Hostveil finds the misconfigurations that get self-hosted Linux servers hacked, explains them in plain language, and fixes them — with a preview, a backup, and one-command rollback.

Install Source
Security score 68/100 Every fix raises the score immediately
HighDatabase exposed to the internetcompose.ds018
HighSSH permits root loginssh.rootlogin
MediumAutomatic updates are offupdates.disabled
curl -fsSL https://hostveil.seolcu.com/install.sh | bash && hostveil
1 binaryNo SaaS, no database, no account — it runs on the host you control
Native checksSSH, firewall, and updates without extra tools
Signed releasesAn SBOM and build provenance on every archive
Rollback readyEvery fix backs up first and can be undone

Why Hostveil

A guide, not another report.

Hostveil turns opaque host state into a prioritized list of concrete, plain-language problems — and then walks you through fixing them safely.

Plain language

Understand the risk without the jargon.

Each finding says what is wrong, why it matters, and how to fix it — in one scored 0–100 snapshot across every checked area.

Fix with a safety net

Preview, back up, apply, roll back.

Every automated fix shows the exact change first and backs up the file before touching it. Changed your mind? hostveil rollback restores the original.

Self-hosted by design

No agents, no cloud upload, no account.

Reads your Compose files and host configuration locally. Native checks mean nothing extra to install for SSH, firewall, and update hardening.

Optional, on your terms

Add CVE scanning and local AI when you want.

Trivy image scanning is used if present and skipped cleanly if not. AI explanations are opt-in and default to a local model — nothing leaves the host.

Coverage

The home-server mistakes that actually get you hacked.

Exposed databases, a Docker socket handed to a container, root SSH login, no firewall, unpatched packages — Hostveil checks the highest-impact paths together, deeply.

Docker & Compose

Privileged mode, host networking, Docker socket mounts, exposed datastores and admin panels, missing no-new-privileges, unsafe bind mounts, and hardcoded secrets — from a native audit of your Compose files.

SSH, firewall & updates

Native checks for root login and password auth in sshd_config, whether a firewall is actually active, and whether automatic security updates are enabled. No external audit tool required.

Image CVEs (optional)

When Trivy is installed, Hostveil scans the images your Compose services run and models "no patch available yet" as a first-class state — no misleading perfect score when the scan didn't run.

Product

Terminal-first, browser-friendly.

Run the TUI by default, or serve the same scan over localhost when a browser is better for review. Both drive the exact same fix-and-rollback engine, and both ship the same five color themes.

Hostveil terminal UI — findings with severity filters and multi-select
TUIKeyboard-driven findings with severity and domain filters, multi-select, plain-language detail, and fix preview.
Hostveil web dashboard — score, coverage notice, filter chips, and the overview of the scan
Web UILocalhost dashboard: score and per-domain axes, what changed since the last scan, filter chips, and an overview that reads the scan back to you.

Measured

Seven ports answered from off the host. Then one.

Hostveil's own score going up after Hostveil's own fixes proves nothing, so a seeded server was measured by tools that have never heard of it: Lynis, Docker's CIS benchmark, and a TCP scan from another machine. Before the fixes, and after accepting every one it offered.

Ports answering from off the host

Before
7
After
1

CIS Docker Benchmark checks passing

Before
16
After
20

Lynis hardening index

Before
57
After
80

Hostveil score

Before
29
After
60

One real server running Nextcloud, Jellyfin, Portainer and their datastores, every port on 0.0.0.0, root SSH login allowed, no firewall. Every file the fixes touched was restored byte for byte on rollback. How this was measured, and what did not move →

Roadmap

Coverage doesn’t stop here.

Four detection domains have shipped as named releases so far. More are next — and a few things are ruled out on purpose.

  1. 3.1.0AI agent runtimes
  2. 3.6.0Kernel hardening
  3. 3.8.0Docker daemon
  4. 3.9.0Service hardening
  5. NextMore agent runtimes, more proxies, wider distro coverage
Full roadmap →

Workflow

Scan, understand, apply, recover.

  1. 01Scan locally

    Run hostveil on your Linux server. Docker or Trivy absent? Those areas are skipped gracefully.

  2. 02Understand

    Findings are prioritized by severity with a plain-language explanation of what and why. A clean host shows Clean, not a hollow 100.

  3. 03Apply fixes

    Auto for the clearly-safe fix, Review when there are real alternatives, Manual when the tool should guide instead of mutate.

  4. 04Roll back anytime

    Every applied fix is backed up first and reversible
    through hostveil rollback.

Install

One command, then scan.

The installer downloads the release binary, verifies checksums, and installs hostveil. Trivy is optional — install it later if you want image CVE scanning.

Latest release Docs 
# Install or update hostveil
curl -fsSL https://hostveil.seolcu.com/install.sh | bash

# Terminal UI (default)
hostveil

# Web UI on localhost
hostveil serve

# Scan, then fix everything safe
hostveil scan
hostveil fix --all

FAQ

Common questions.

Does it upload my data?

No. Hostveil runs locally. Even the optional AI
explanations default to a model on your own machine.

Will a fix break my server?

You see the exact change before it applies, the original is
backed up first, and hostveil rollback undoes it.

What if a fix has tradeoffs?

It is a Review fix, not Auto. Hostveil shows independent
alternatives and makes you choose.

Do I need Docker or Trivy?

No. SSH, firewall, and update checks run natively. Docker
and Trivy checks are used when present and skipped if not.