railiance-infra/ansible/playbooks/verify.yaml

---
# verify.yaml — Deploy Goss, run baseline assertions, fetch TAP results.
# Exit code mirrors Goss: 0 = all pass, non-zero = failures.
#
# Usage:
#   ansible-playbook ansible/playbooks/verify.yaml -u admin
#   make verify

- hosts: all
  become: true
  gather_facts: true
  # Same declaration the bootstrap play converges from. Without this the
  # firewall assertions render empty and silently assert nothing.
  vars_files:
    - ../inventory/group_vars/all.yaml
  roles:
    - role: goss
feat: implement WP-0002 — Goss test suite, verify playbook, and ADR-002 - goss/baseline.yaml: assertions for all spec/server-baseline.yaml items (packages, services, SSH config, UFW rules, admin user, fail2ban, HISTCONTROL) - goss/vars/baseline-vars.yaml: parameterised ports and paths - ansible/roles/goss/: installs Goss binary (v0.4.9), deploys tests, runs assertions in TAP format, fetches report to reports/ - ansible/playbooks/verify.yaml: playbook wrapping the goss role - Makefile: add 'make verify' target; update 'make status' with hint - docs/adr/ADR-002: formal repo boundary — railiance-hosts vs railiance-bootstrap - workplans/RAIL-HO-WP-0002: registered workstream 8fed53c2, T03–T06 done Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-09 12:38:48 +01:00			`---`
			`# verify.yaml — Deploy Goss, run baseline assertions, fetch TAP results.`
			`# Exit code mirrors Goss: 0 = all pass, non-zero = failures.`
			`#`
			`# Usage:`
			`# ansible-playbook ansible/playbooks/verify.yaml -u admin`
			`# make verify`

			`- hosts: all`
			`become: true`
			`gather_facts: true`
Tighten the Goss firewall assertion and render it from the declaration The conformance checker existed but had not run since 2026-03-09, and its firewall assertion matched /6443\/tcp.*ALLOW/ - asserting the port was allowed but not from whom. It passed identically whether the API was restricted to one operator address or open to the entire internet, which is precisely the drift that went undetected. goss/baseline.yaml is now a template rendered per host from the same inventory declaration that converges the host, so the assertion cannot drift from what it checks. It asserts each declared source is present, that no revoked source retains access, and that 6443 is never ALLOW Anywhere. verify.yaml gained the vars_files the bootstrap play already had - without it the firewall assertions rendered empty and silently asserted nothing, which is worse than no check. Result on Railiance01: 32 assertions, 31 pass. The one failure is a real find and is recorded as T06 - Flannel VXLAN is declared open to Anywhere with no source restriction, the same defect pattern as the k3s rule. It is currently absent from the host, so converging would INTRODUCE the exposure rather than fix drift. Must be resolved before RAIL-BS-WP-0007 multi-node HA needs working VXLAN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-12 03:28:35 +02:00			`# Same declaration the bootstrap play converges from. Without this the`
			`# firewall assertions render empty and silently assert nothing.`
			`vars_files:`
			`- ../inventory/group_vars/all.yaml`
feat: implement WP-0002 — Goss test suite, verify playbook, and ADR-002 - goss/baseline.yaml: assertions for all spec/server-baseline.yaml items (packages, services, SSH config, UFW rules, admin user, fail2ban, HISTCONTROL) - goss/vars/baseline-vars.yaml: parameterised ports and paths - ansible/roles/goss/: installs Goss binary (v0.4.9), deploys tests, runs assertions in TAP format, fetches report to reports/ - ansible/playbooks/verify.yaml: playbook wrapping the goss role - Makefile: add 'make verify' target; update 'make status' with hint - docs/adr/ADR-002: formal repo boundary — railiance-hosts vs railiance-bootstrap - workplans/RAIL-HO-WP-0002: registered workstream 8fed53c2, T03–T06 done Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-09 12:38:48 +01:00			`roles:`
			`- role: goss`