Hardening and server mode · HOMELAB // k3s

Overview

Area	Setting
updates	`unattended-upgrades` (security), manual `full-upgrade` periodically
time	`chrony`, timezone Europe/Prague
firewall	`ufw`: deny incoming by default, explicit allow list
power	lid switch ignored, battery capped at ~60 %
memory	swap disabled (Kubernetes requirement)

1. Updates and time

shell @ server

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y unattended-upgrades chrony
sudo timedatectl set-timezone Europe/Prague

unattended-upgrades applies security updates only; run full-upgrade occasionally and reboot when /var/run/reboot-required exists.

2. Firewall

shell @ server

sudo ufw allow OpenSSH        # before enabling, or the session is cut off
sudo ufw enable

Port / network	Purpose
`22/tcp`	SSH
`6443/tcp`	Kubernetes API
`80/tcp`, `443/tcp`	Traefik ingress
`10.42.0.0/16`	k3s pod network
`10.43.0.0/16`	k3s service network

Nothing is reachable from the internet regardless: there is no port forwarding on the router.

3. Lid switch

config @ server

# /etc/systemd/logind.conf.d/lid.conf
[Login]
HandleLidSwitch=ignore
HandleLidSwitchExternalPower=ignore
HandleLidSwitchDocked=ignore

A drop-in file instead of editing logind.conf, so package updates never overwrite it. Takes effect after reboot.

4. Swap off

shell @ server

sudo swapoff -a
sudo sed -i '/swap/ s/^/#/' /etc/fstab
sudo rm -f /swap.img

Kubernetes schedules pods by memory requests; swap would hide real memory pressure. Without swap the OOM killer acts instead, which is why every pod has a memory limit.

5. Battery conservation

shell @ server

echo 1 | sudo tee /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode
echo 'w /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode - - - - 1' | sudo tee /etc/tmpfiles.d/battery.conf

The ideapad_laptop driver stops charging at ~60 %; systemd-tmpfiles re-applies it on every boot.

Verify

shell @ server

sudo ufw status verbose
free -h | grep Swap                       # Swap: 0B 0B 0B
cat /sys/bus/platform/drivers/ideapad_acpi/VPC2004:00/conservation_mode   # 1
timedatectl | grep -E "Time zone|synchronized"