coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-infra/ansible/inventory/group_vars/all.yaml

63 lines
2.7 KiB
YAML
Raw Normal View History

feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity Establishes a dedicated SSH keypair for the Custodian automation agent: - ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent) - ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars - ansible/playbooks/bootstrap.yaml: custodian_agent role added - Makefile: provision-custodian-agent / provision-custodian-agent-host targets Keypair generation: cd ~/the-custodian && make custodian-keygen Then deploy: cd ~/railiance-infra && make provision-custodian-agent The private key lives at ~/.ssh/id_custodian_agent — never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:21:57 +01:00
# Ansible group vars — applied to all managed hosts.
#
feat(custodian-agent): add custodian agent public key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 Generated 2026-03-27 via make custodian-keygen. Private key at workstation only (~/.ssh/id_custodian_agent), never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:22:45 +01:00
# custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity Establishes a dedicated SSH keypair for the Custodian automation agent: - ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent) - ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars - ansible/playbooks/bootstrap.yaml: custodian_agent role added - Makefile: provision-custodian-agent / provision-custodian-agent-host targets Keypair generation: cd ~/the-custodian && make custodian-keygen Then deploy: cd ~/railiance-infra && make provision-custodian-agent The private key lives at ~/.ssh/id_custodian_agent — never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:21:57 +01:00
#
# HOW TO SET THIS:
# 1. Generate the keypair on the workstation (one-time):
# cd ~/the-custodian && make custodian-keygen
# This creates ~/.ssh/id_custodian_agent (private, never committed)
# and writes the public key to:
# ~/railiance-infra/ansible/inventory/group_vars/all.yaml ← this file
#
# 2. Commit the updated all.yaml (public key only — safe to commit).
#
# 3. Deploy to all managed hosts:
# cd ~/railiance-infra && make provision-custodian-agent
#
# The key below is a placeholder — replace by running `make custodian-keygen`.
custodian_agent_user: tegwick
feat(custodian-agent): add custodian agent public key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 Generated 2026-03-27 via make custodian-keygen. Private key at workstation only (~/.ssh/id_custodian_agent), never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:22:45 +01:00
custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
feat(ansible): inject ops-bridge key in base role at bootstrap Add ops_bridge_pubkey to group_vars/all.yaml (public key only, safe to commit) and inject it via ansible.posix.authorized_key in the base role, immediately after SSH hardening. This ensures ops-bridge tunnel connectivity is available as soon as SSH infrastructure is up on any managed host — no manual key provisioning required for new nodes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 23:52:54 +01:00
# ops-bridge tunnel key — injected by the base role so ops-bridge connectivity
# is available as early as SSH infrastructure is up.
# Private key lives at ~/.ssh/id_ops on the workstation. Never commit the private key.
ops_bridge_user: tegwick
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"
Make the k3s API firewall allowlist declarative The live host restricted 6443/tcp to specific operator addresses, added by hand, while this role still declared the port open to Anywhere with no source restriction. The declared config was weaker than reality: running the base role would have REMOVED the restriction and exposed the Kubernetes API to the internet. Security was tightened on the host and never fed back into the source of truth. Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist. Changes: - defaults: k3s_api_allowed_sources (empty = 6443 closed to all external sources, the safe failure; SSH unaffected so the host stays recoverable) and k3s_api_revoked_sources, so rotated addresses are pruned rather than left as standing grants to whoever the ISP reassigns them to - tasks: grant approved sources, then remove any blanket rule, then revoke retired ones. Order matters - grants are added before the blanket rule is deleted so convergence never opens a window with no API access - group_vars/all.yaml: the current operator address, plus the two stale grants (.246 rotated, 85.132.220.102 historic) marked for revocation - docs/verification.md: state that 6443 is source-restricted rather than listing it as a plainly allowed port Not yet converged against the live host - the role change is committed but running it is a production action needing operator approval. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:56:28 +02:00
# ---------------------------------------------------------------------------
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
# k3s API firewall (6443/tcp) — tunnel only (ADR-005)
Make the k3s API firewall allowlist declarative The live host restricted 6443/tcp to specific operator addresses, added by hand, while this role still declared the port open to Anywhere with no source restriction. The declared config was weaker than reality: running the base role would have REMOVED the restriction and exposed the Kubernetes API to the internet. Security was tightened on the host and never fed back into the source of truth. Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist. Changes: - defaults: k3s_api_allowed_sources (empty = 6443 closed to all external sources, the safe failure; SSH unaffected so the host stays recoverable) and k3s_api_revoked_sources, so rotated addresses are pruned rather than left as standing grants to whoever the ISP reassigns them to - tasks: grant approved sources, then remove any blanket rule, then revoke retired ones. Order matters - grants are added before the blanket rule is deleted so convergence never opens a window with no API access - group_vars/all.yaml: the current operator address, plus the two stale grants (.246 rotated, 85.132.220.102 historic) marked for revocation - docs/verification.md: state that 6443 is source-restricted rather than listing it as a plainly allowed port Not yet converged against the live host - the role change is committed but running it is a production action needing operator approval. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:56:28 +02:00
#
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
# Public allowlist is empty. Reach the API over ops-bridge:
# bridge up k3s-api-railiance01 # local 16444
# bridge up k3s-api-coulombcore # local 16443
Make the k3s API firewall allowlist declarative The live host restricted 6443/tcp to specific operator addresses, added by hand, while this role still declared the port open to Anywhere with no source restriction. The declared config was weaker than reality: running the base role would have REMOVED the restriction and exposed the Kubernetes API to the internet. Security was tightened on the host and never fed back into the source of truth. Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist. Changes: - defaults: k3s_api_allowed_sources (empty = 6443 closed to all external sources, the safe failure; SSH unaffected so the host stays recoverable) and k3s_api_revoked_sources, so rotated addresses are pruned rather than left as standing grants to whoever the ISP reassigns them to - tasks: grant approved sources, then remove any blanket rule, then revoke retired ones. Order matters - grants are added before the blanket rule is deleted so convergence never opens a window with no API access - group_vars/all.yaml: the current operator address, plus the two stale grants (.246 rotated, 85.132.220.102 historic) marked for revocation - docs/verification.md: state that 6443 is source-restricted rather than listing it as a plainly allowed port Not yet converged against the live host - the role change is committed but running it is a production action needing operator approval. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:56:28 +02:00
#
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
# Revoked addresses are pruned on a firewall-tagged converge so rotated or
# retired grants do not remain standing. Do not add new public sources here
# without amending ADR-005.
k3s_api_allowed_sources: []
Make the k3s API firewall allowlist declarative The live host restricted 6443/tcp to specific operator addresses, added by hand, while this role still declared the port open to Anywhere with no source restriction. The declared config was weaker than reality: running the base role would have REMOVED the restriction and exposed the Kubernetes API to the internet. Security was tightened on the host and never fed back into the source of truth. Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist. Changes: - defaults: k3s_api_allowed_sources (empty = 6443 closed to all external sources, the safe failure; SSH unaffected so the host stays recoverable) and k3s_api_revoked_sources, so rotated addresses are pruned rather than left as standing grants to whoever the ISP reassigns them to - tasks: grant approved sources, then remove any blanket rule, then revoke retired ones. Order matters - grants are added before the blanket rule is deleted so convergence never opens a window with no API access - group_vars/all.yaml: the current operator address, plus the two stale grants (.246 rotated, 85.132.220.102 historic) marked for revocation - docs/verification.md: state that 6443 is source-restricted rather than listing it as a plainly allowed port Not yet converged against the live host - the role change is committed but running it is a production action needing operator approval. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:56:28 +02:00
k3s_api_revoked_sources:
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
- address: "89.244.90.248"
comment: "hand grant added 2026-08-12/15; retired by ADR-005"
- address: "89.244.90.236"
comment: "rotated ISP lease; retired by ADR-005"
- address: "89.244.90.255"
comment: "rotated ISP lease; retired by ADR-005"
Make the k3s API firewall allowlist declarative The live host restricted 6443/tcp to specific operator addresses, added by hand, while this role still declared the port open to Anywhere with no source restriction. The declared config was weaker than reality: running the base role would have REMOVED the restriction and exposed the Kubernetes API to the internet. Security was tightened on the host and never fed back into the source of truth. Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist. Changes: - defaults: k3s_api_allowed_sources (empty = 6443 closed to all external sources, the safe failure; SSH unaffected so the host stays recoverable) and k3s_api_revoked_sources, so rotated addresses are pruned rather than left as standing grants to whoever the ISP reassigns them to - tasks: grant approved sources, then remove any blanket rule, then revoke retired ones. Order matters - grants are added before the blanket rule is deleted so convergence never opens a window with no API access - group_vars/all.yaml: the current operator address, plus the two stale grants (.246 rotated, 85.132.220.102 historic) marked for revocation - docs/verification.md: state that 6443 is source-restricted rather than listing it as a plainly allowed port Not yet converged against the live host - the role change is committed but running it is a production action needing operator approval. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:56:28 +02:00
- address: "89.244.90.246"
comment: "rotated ISP lease, superseded 2026-08-11"
- address: "85.132.220.102"
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
comment: "historic operator address; also the 2026-08-15 workstation lease"
# Single-node clusters need no public VXLAN grant. Set peer addresses here
# only when a second node must exchange Flannel frames (RAIL-BS-WP-0007).
flannel_vxlan_allowed_sources: []
# HostEurope Nydus agent — provider dashboard, root-password reset, backups.
# Required by the VPS platform (hosteurope/260308-dependency-nydus.md).
# Source-restricting it would break the provider; Anywhere is intentional.
ufw_extra_allowed:
- port: "2224"
proto: tcp
comment: "nydus-ex-api dashboard agent"
Reference in a new issue Copy permalink