railiance-infra/ansible/roles/goss/templates/railiance-goss-baseline.timer.j2

[Unit]
Description=Hourly Railiance Goss baseline (RAIL-HO-WP-0009-T05)

[Timer]
OnBootSec=5min
OnUnitActiveSec=1h
RandomizedDelaySec=5min
Persistent=true
Unit=railiance-goss-baseline.service

[Install]
WantedBy=timers.target
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01. 2026-08-15 15:41:59 +02:00			`[Unit]`
			`Description=Hourly Railiance Goss baseline (RAIL-HO-WP-0009-T05)`

			`[Timer]`
			`OnBootSec=5min`
			`OnUnitActiveSec=1h`
			`RandomizedDelaySec=5min`
			`Persistent=true`
			`Unit=railiance-goss-baseline.service`

			`[Install]`
			`WantedBy=timers.target`