railiance-infra/ansible/roles/goss/templates/railiance-goss-baseline.service.j2

[Unit]
Description=Railiance declared-vs-live Goss baseline
Documentation=file:///etc/goss/baseline.yaml

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/goss-baseline-check
Nice=10
# The wrapper records TAP even when assertions fail.
SuccessExitStatus=0 1
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01. 2026-08-15 15:41:59 +02:00			`[Unit]`
			`Description=Railiance declared-vs-live Goss baseline`
			`Documentation=file:///etc/goss/baseline.yaml`

			`[Service]`
			`Type=oneshot`
			`ExecStart=/usr/local/sbin/goss-baseline-check`
			`Nice=10`
			`# The wrapper records TAP even when assertions fail.`
			`SuccessExitStatus=0 1`