Kaburu Wiki

# Freenet/Hyphanet P2P Node — REMOVED 2026-07-26

## Status: removed

Steve decided to remove the node after the security review. Not core business; risk profile (runs as root, public dashboard on business domain, identity linkage) made the attack surface unacceptable per his rule “if it can be compromised, then it goes.”

### What was removed

- Service stopped and disabled (`systemctl stop/disable freenet`) - Systemd unit `/etc/systemd/system/freenet.service` removed, daemon reloaded - Binary directory `/opt/freenet/` removed (54MB Rust binary) - OLS vhost directory `/home/freenet.kaburu.co/` removed (was empty) - Cloudflare DNS A record for `freenet.kaburu.co` deleted (API verified: 0 records, success: True) - Port 7509 freed - 2.4GB RAM reclaimed

### Verification (2026-07-26)

- `pgrep -af freenet` → no process - `ss -tlnp | grep 7509` → no listener - `ls /opt/freenet` → No such file or directory - Cloudflare API: 0 records for `freenet.kaburu.co` in `kaburu.co` zone

## Original install context

- Installed 2026-07-24 by a previous Gwen/DeepSeek session - Original assumption: “simple relay of sorts” — actual risk profile not assessed at install - Steve's own words on removal: “I shouldn't have installed it, my bad”

1. Runs as root. The systemd unit has `User=root`. Any unpatched RCE in Freenet = full Hetzner VPS compromise. Single point of failure for the whole box. 2. Publicly visible dashboard on a business-tied domain. `freenet.kaburu.co` is on Cloudflare. Anyone hitting that URL gets the full Freenet admin dashboard. Even with webtoken protection on settings, node identity, peer count, datastore size, and operational details are visible to any visitor. Also creates a traceable link between Kaburu MSP and the Freenet anonymity network. 3. No datastore cap. Will silently consume disk indefinitely. Already 2.3GB RAM after 31 minutes of uptime. Competes with LiteSpeed, MySQL, Wordfence scans for resources. 4. Hetzner abuse surface. Freenet has historically been used to distribute illegal content (CSAM, etc). Hetzner sees the traffic at the network edge, and Hetzner does terminate accounts for abuse complaints. With Freenet on a business-tied IP, complaints land on Steve. 5. Domain registration linkage. WHOIS for `freenet.kaburu.co` is publicly visible and tied to Kaburu MSP identity.

## Steve's decision rule (2026-07-26)

“If it can be compromised, then it goes. I thought it was a simple relay of sorts, didn't realise it opened an attack surface.”

Implication: Running Freenet as `root` on a business IP/domain is an unacceptable risk given the compromise path. The node should either be hardened (non-root user, localhost-only dashboard via SSH tunnel, datastore cap, separate identity) or removed entirely.

## Options (all documented for Steve to pick from later)

Current state: D. Decision pending.

## Original install context (per wiki log 2026-07-24)

“Freenet P2P node: Installed v0.2.105 on kaburusvr at /opt/freenet/. Systemd service running, 12MB RAM, 2 peers connected. Dashboard on port 7509. DNS created (freenet.kaburu.co → 49.13.202.144, Cloudflare proxied). VHOST proxy config written — SSL pending.”

Installed during a previous session, before the risk profile was understood. Steve assumed “simple relay” — the actual attack surface (root + public dashboard + business-domain linkage) was not assessed at install time.

## If Steve decides “kill it” later

```bash # SSH to kaburusvr sudo systemctl stop freenet sudo systemctl disable freenet sudo rm /etc/systemd/system/freenet.service sudo rm -rf /opt/freenet # Remove DNS record in Cloudflare: freenet.kaburu.co # Remove the Freenet OLS vhost config (created 2026-07-25 by DeepSeek): # /home/freenet.kaburu.co/public_html/ (was already empty as of 2026-07-26) ```

## If Steve decides “harden it” (option B)

1. Create dedicated `freenet` user: `useradd -r -d /opt/freenet -s /usr/sbin/nologin freenet` 2. `chown -R freenet:freenet /opt/freenet` 3. Edit `/etc/systemd/system/freenet.service`: change `User=root` to `User=freenet`, add `MemoryMax=4G`, add `Restart=on-failure` cap 4. Edit Freenet config to cap datastore (2-5GB), bind FProxy to 127.0.0.1 only 5. Move Cloudflare DNS to a separate subdomain not tied to `kaburu.co`/`kaburu.cc`/`kaburu.co.uk` family 6. Add Cloudflare Access (free tier, 50 users) in front of `freenet.kaburu.co` for the dashboard 7. Access dashboard via SSH tunnel: `ssh -L 7509:127.0.0.1:7509 root@kaburusvr` then open `http://127.0.0.1:7509` locally 8. Add `freenet` to the daily report's resource section so RAM growth is visible

## Related log entries

- 2026-07-24: Freenet node installed (DeepSeek session) - 2026-07-25: Freenet OLS vhost + SSL fix (DeepSeek session) - 2026-07-26: Security review, decision pending (this session)