railiance-infra/ansible/inventory/group_vars/all.yaml

# Ansible group vars — applied to all managed hosts.
#
# custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
#
# HOW TO SET THIS:
#   1. Generate the keypair on the workstation (one-time):
#        cd ~/the-custodian && make custodian-keygen
#      This creates ~/.ssh/id_custodian_agent (private, never committed)
#      and writes the public key to:
#        ~/railiance-infra/ansible/inventory/group_vars/all.yaml  ← this file
#
#   2. Commit the updated all.yaml (public key only — safe to commit).
#
#   3. Deploy to all managed hosts:
#        cd ~/railiance-infra && make provision-custodian-agent
#
# The key below is a placeholder — replace by running `make custodian-keygen`.

custodian_agent_user: tegwick
custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"

# ops-bridge tunnel key — injected by the base role so ops-bridge connectivity
# is available as early as SSH infrastructure is up.
# Private key lives at ~/.ssh/id_ops on the workstation. Never commit the private key.
ops_bridge_user: tegwick
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"

# ---------------------------------------------------------------------------
# k3s API firewall allowlist (6443/tcp)
#
# The k3s API is NOT world-reachable. Only these sources may connect.
# Added 2026-08-11 after discovering the live host was source-restricted by hand
# while this repo still declared 6443 open to Anywhere — meaning a convergence
# run would have exposed the Kubernetes API to the internet.
#
# These are operator egress addresses, not secrets. They are dynamic: when your
# ISP rotates the lease, MOVE the old entry to k3s_api_revoked_sources rather
# than deleting the line, so convergence prunes the stale grant instead of
# leaving it standing for whoever the address gets reassigned to.
#
# Durable alternative worth considering: reach the API over the ops-bridge SSH
# tunnel instead (see railiance-infra/docs/deploy-stack.md, the
# k3s-api-coulombcore pattern) and allow no public sources at all.
k3s_api_allowed_sources:
  - address: "89.244.90.236"
    comment: "k3s-api-operator-current"
  - address: "89.244.90.255"
    comment: "k3s-api-operator-current"

k3s_api_revoked_sources:
  - address: "89.244.90.246"
    comment: "rotated ISP lease, superseded 2026-08-11"
  - address: "85.132.220.102"
    comment: "historic operator address, retired"