Merge eeaaf12886 into 398acc6fe8

This provides consistency with DDoS protection services placed in front
of the services rather than the behavior changing based on whether DDoS
protection is active. This doesn't help with protecting against attacks
since they'll almost always be targeting ports with services active or
exhausting inbound bandwidth via UDP reflection attacks. This appears to
be the standard approach used by most large tech companies.

certbot/0.grapheneos.network

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name grapheneos.network \
     -d grapheneos.network \

certbot/0.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name grapheneos.org \
     -d grapheneos.org \

certbot/0.releases.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name releases.grapheneos.org \
     -d releases.grapheneos.org \

certbot/attestation.app

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name attestation.app \
     -d attestation.app \

certbot/discuss.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name discuss.grapheneos.org \
     -d discuss.grapheneos.org

certbot/grapheneos.social

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name grapheneos.social \
     -d grapheneos.social \

certbot/matrix.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name matrix.grapheneos.org \
     -d matrix.grapheneos.org \

certbot/mta-sts.mail.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name mta-sts.mail.grapheneos.org \
     -d mail.grapheneos.org \

certbot/staging.attestation.app

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name staging.attestation.app \
     -d staging.attestation.app

certbot/staging.grapheneos.org

@@ -1,5 +1,5 @@
 certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
-    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" --elliptic-curve secp384r1 \
     --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
     --cert-name staging.grapheneos.org \
     -d staging.grapheneos.org

nftables/nftables-attestation.conf

@@ -49,7 +49,7 @@ table inet filter {
         tcp dport { 22, 80, 443 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-discuss.conf

@@ -49,7 +49,7 @@ table inet filter {
         tcp dport { 22, 80, 443 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-mail.conf

@@ -61,7 +61,7 @@ table inet filter {
         tcp dport { 22, 25, 80, 443, 465, 993 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-matrix.conf

@@ -49,7 +49,7 @@ table inet filter {
         tcp dport { 22, 80, 443 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-network.conf

@@ -59,7 +59,7 @@ table inet filter {
         iif lo accept
         udp dport 123 accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-ns1.conf

@@ -52,7 +52,7 @@ table inet filter {
         iif lo accept
         udp dport 53 accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-ns2.conf

@@ -3,6 +3,8 @@
 flush ruleset
 
 table inet filter {
+    define ip-anycast = 198.251.90.93
+
     define ip-allowlist-ssh = {
         198.98.53.141, # 0.ns2.grapheneos.org
     }
@@ -46,8 +48,7 @@ table inet filter {
 
         udp dport 53 notrack accept
 
-        # reject SSH packets via anycast IP
-        tcp dport 22 ip daddr 198.251.90.93 reject with tcp reset
+        tcp dport 22 ip daddr $ip-anycast drop
 
         # handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
         tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over 1024/second burst 128 packets counter notrack accept
@@ -63,7 +64,7 @@ table inet filter {
         iif lo accept
         udp dport 53 accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-social.conf

@@ -49,7 +49,7 @@ table inet filter {
         tcp dport { 22, 80, 443 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {

nftables/nftables-web.conf

@@ -59,7 +59,7 @@ table inet filter {
         tcp dport { 22, 80, 443 } goto input-tcp-service
         iif lo accept
         meta l4proto { icmp, ipv6-icmp } accept
-        ct state vmap { new : goto graceful-reject, established : accept, related : accept }
+        ct state vmap { new : drop, established : accept, related : accept }
     }
 
     chain input-tcp-service {