railiance-infra/goss/baseline.yaml.j2

# Goss baseline assertions for railiance managed nodes.
# Derived from spec/server-baseline.yaml — keep in sync.
# Run: goss -g /etc/goss/baseline.yaml validate
#
# THIS IS A TEMPLATE. It is rendered per host from inventory variables, so the
# firewall assertions below are generated from the SAME declaration that
# converges the host (k3s_api_allowed_sources in group_vars/all.yaml). That is
# deliberate: a hand-written assertion drifts from the declaration it is meant
# to check, which is exactly how RAIL-HO-WP-0009 happened.

package:
  ufw:
    installed: true
  fail2ban:
    installed: true
  git:
    installed: true
  curl:
    installed: true
  vim:
    installed: true
  htop:
    installed: true

# age and sops are binary installs, not apt packages — checked via command below

service:
  ufw:
    enabled: true
    running: true
  fail2ban:
    enabled: true
    running: true
  # Ubuntu 24.04 uses socket activation: ssh.service is disabled by design,
  # ssh.socket keeps it running. Assert the socket is enabled.
  ssh.socket:
    enabled: true
    running: true

file:
  /etc/ssh/sshd_config.d/10-hardening.conf:
    exists: true
    contents:
      - "PermitRootLogin no"
      - "PasswordAuthentication no"
      - "PubkeyAuthentication yes"

user:
  tegwick:
    exists: true
    # sudo access is via /etc/sudoers.d/tegwick (NOPASSWD), not group membership
    shell: /bin/bash

command:
  "ufw status":
    exit-status: 0
    stdout:
      - "Status: active"
      - /OpenSSH.*ALLOW/
{% for src in k3s_api_allowed_sources | default([]) %}
      - '/6443\/tcp\s+ALLOW\s+{{ src.address | regex_escape }}/'
{% endfor %}
      - /8472\/udp.*ALLOW/

  # The k3s API must never be reachable from Anywhere. The previous assertion
  # matched /6443\/tcp.*ALLOW/, which passes identically whether the API is
  # restricted to one operator address or open to the entire internet — it
  # asserted that the port was allowed, not from whom.
  "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+Anywhere' || true":
    exit-status: 0
    stdout:
      - "0"

{% for src in k3s_api_revoked_sources | default([]) %}
  # Revoked operator source must not retain access: {{ src.comment | default('') }}
  "ufw status | grep -Ec '6443/tcp[[:space:]]+ALLOW[[:space:]]+{{ src.address }}' || true":
    exit-status: 0
    stdout:
      - "0"
{% endfor %}
  "grep NOPASSWD /etc/sudoers.d/tegwick":
    exit-status: 0
    stdout:
      - "NOPASSWD"
  "grep -r HISTCONTROL /etc/profile.d/":
    exit-status: 0
    stdout:
      - "ignorespace"
  "fail2ban-client status sshd":
    exit-status: 0
    stdout:
      - "Status for the jail: sshd"
  "test -x /usr/local/bin/age":
    exit-status: 0
  "test -x /usr/local/bin/sops":
    exit-status: 0