Hostveil documentation
Hostveil finds the security mistakes on your self-hosted Linux server, explains them in plain language, and fixes them safely — with a preview, a backup, and one-command rollback. One binary, no config file, no cloud account.
Self-hosting is booming, and a single misconfiguration on a home server — Jellyfin, Nextcloud, a game server, a self-hosted AI agent like OpenClaw or Hermes Agent — can turn into a serious breach. Hostveil is a guided hardening tool for exactly those hosts. Point it at a Linux server: it scans the highest-impact areas, merges everything into one 0–100 score, explains each finding without jargon, and walks you through fixing it — showing the exact change, backing up the original first, and letting you undo any fix with one command.
Nothing is changed blindly. Every fix is previewed before it runs, the original file is backed up to a checkpoint, and hostveil rollback restores it byte-for-byte. Every interface drives the same engine, so a fix applied anywhere is reversible everywhere.
Every judgement Hostveil makes is written down somewhere you can check it.
Auto-fix, Review and Manual: the three tests a fix has to pass, and the four steps that settle which kind you are shown.
High, Medium and Low: the three definitions, and what each domain is worth.
The score: the arithmetic in full, a worked example from a real scan, and what a given score is called.
The names in --json and SARIF: every value a machine reads.
New here? Start with these
- Installation → One command to install, plus optional tools (Docker, Trivy, Ollama) and what each unlocks.
- Quick start → Scan, understand a finding, apply a fix, and roll it back — the full loop in a few minutes.
- What it checks → Docker/Compose, SSH, firewall, auto-updates, and optional image CVEs — what each looks at.
- Scoring → How findings become one 0–100 number, what each domain is worth, and what the score cannot tell you.
- Measured results → What Lynis, Docker’s CIS benchmark and an off-host TCP scan saw before and after Hostveil’s fixes.
- Fixing & rollback → Auto, Review, and Manual fixes; how preview, backup, history, and rollback work.
Reference
- Interfaces → The TUI, the localhost web dashboard, and the scriptable CLI — one shared engine.
- Environment variables → Every variable Hostveil reads, honours from your shell, or sets for the commands it runs.
- CLI reference → Every subcommand and flag: scan, fix, rollback, history, explain, and serve.
-
AI explanations →
Optional, advisory-only, local-first second opinions with
explain --ai. - Contributing → Build from source, run the checks, the repo layout, and how to add a new check.
- Roadmap → How detection coverage has grown, what's next, what's under exploration, and what's not planned on purpose.