The exposed surface stays deliberate.

The review combined network reconnaissance, web testing, configuration inspection, CI security checks, service-hardening analysis, monitoring validation and restore exercises. Early findings drove remediation of exposed management paths, missing web controls and credential handling.

The 24 September refresh found only documented public listeners, no failed security workflow and no direct Internet access to the administration and observability services checked. Residual risks remained documented rather than treated as closed by default.

The April self-assessment identified an RCON credential exposed through exporter command-line arguments, a directly reachable map origin, missing or inconsistent security headers, web-server version disclosure and HTTP-only origin traffic. Several protocol disclosures and the public voice-chat port were accepted as operating constraints.

Later work upgraded the exporter to read the credential from a restricted environment file, removed the direct map port from public firewalls, added TLS and response headers, disabled server tokens, and routed health monitoring around the map server’s documented HEAD behavior.

The September evidence run found the intended web, SSH and two game listeners reachable. Grafana, Uptime Kuma, the status API origin, BlueMap origin, Prometheus, Alertmanager, Node Exporter, both game exporters and both RCON listeners were not directly reachable from the Internet.

Unauthenticated requests to the two administrative web hostnames redirected to Cloudflare Access. The public site and API returned the expected transport and browser security headers.

CodeQL, Checkov, lint and tests, ZAP DAST and the VPS deployment workflow all completed successfully for the recorded commit. Systemd exposure scores for three custom services moved from 9.2 UNSAFE to 2.8–3.2 OK after hardening.

Full-extraction restore drills completed for both then-active game profiles and removed their scratch directories. Prometheus and Loki rules loaded without evaluation failures, and both firing and resolved ntfy delivery were confirmed.

Volumetric traffic against public game protocols remains an upstream network risk; generic per-IP limiting was rejected because it could disrupt players behind shared NAT without preventing link saturation. Protocol-required version disclosure and the public voice path also remain accepted constraints when enabled.

Chat-content retention remains a privacy decision, reviewed configuration paths were not yet selected for the optional integrity baseline, and GitHub account two-factor status required owner confirmation outside the technical evidence run.

The review supports a dated conclusion that public exposure was reduced to intended service paths and that recovery, alerting and administrative access controls were exercised. It does not guarantee the absence of vulnerabilities or cover provider infrastructure outside the project’s authority.

Profile changes should trigger a new listener inventory, restore drill and web-control check so the security record follows the active deployment rather than the name of the service.