coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refresh Current State: four-axis model, hosts supersession, open security work
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-12 00:05:13 +02:00
parent dffd6c561e
commit 35ddfa5f78
3 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
SCOPE.md
View file

@ -75,12 +75,23 @@ higher layer (Kubernetes, platform, etc.) can run.
- Status: maintained / productive
- Implementation: HostEurope substrate baseline active for `Railiance01` and
`CoulombCore`; server spec + test suite active; 5-repo stack architecture in
place; first reef rollout source map now defined
`CoulombCore`; server spec + test suite active; first reef rollout source map
defined. Railiance is classified along four repo-family axes (`railiance-*`,
`rail-*`, `rapp-*`, `reef-*`), of which five `railiance-*` repos cover S1–S5;
this file previously said "5-repo stack architecture", which predates that
model
- Stability: high for the current single-server and transitional two-server
substrate reality; proven in production on `92.205.62.239`
- Usage: foundation for all Railiance deployments; canonical S1 source for
higher-layer and future reef planning
higher-layer and future reef planning. `railiance-hosts` is **superseded** by
this repo and carries a banner saying so; its retirement is pending in
`railiance-master`
- **Open security work**: `RAIL-HO-WP-0009` — the base role declared the k3s API
open to Anywhere while the live host was source-restricted by hand, so
converging would have exposed the Kubernetes API. The allowlist is now
declarative (`k3s_api_allowed_sources` / `k3s_api_revoked_sources`) but
**has not yet been converged**, so the live host still carries two stale
grants to rotated operator addresses
---

6
WORK-RECORDS.md
View file

@ -11,6 +11,7 @@
| workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| workplan | RAIL-HO-WP-0008 | ready | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| workplan | RAIL-HO-WP-0009 | active | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
@ -27,3 +28,8 @@
| task | RAIL-HO-WP-0008-T01 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |

6
workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
View file

@ -13,6 +13,7 @@ related_repos:
- railiance-cluster
- railiance-platform
- railiance-master
state_hub_workstream_id: "ebf3c8d1-9066-4f13-a2d5-1da0409f2162"
---
# RAIL-HO-WP-0009 - Firewall declared-state integrity and k3s API exposure
@ -81,6 +82,7 @@ It must not:
id: RAIL-HO-WP-0009-T01
status: done
priority: high
state_hub_task_id: "9a000a00-7cfd-4798-803f-bf59359a09b7"
```
Make the allowlist declarative. Add `k3s_api_allowed_sources` (empty default —
@ -98,6 +100,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
id: RAIL-HO-WP-0009-T02
status: todo
priority: high
state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
```
Converge the base role against `railiance01` and confirm the resulting UFW state
@ -112,6 +115,7 @@ Verify SSH remains available throughout, and re-check `kubectl get nodes` after.
id: RAIL-HO-WP-0009-T03
status: todo
priority: high
state_hub_task_id: "3e835b96-736c-458c-91eb-04bfd4c7e0e7"
```
Audit the rest of the base role for the same class of defect: any place where
@ -129,6 +133,7 @@ remove it.
id: RAIL-HO-WP-0009-T04
status: todo
priority: medium
state_hub_task_id: "908630e8-e245-47f5-a060-3949250f522c"
```
Remove the k3s API from the public internet. Operator addresses rotate, so an
@ -144,6 +149,7 @@ and the tunnel becomes a dependency of every operator action.
id: RAIL-HO-WP-0009-T05
status: todo
priority: medium
state_hub_task_id: "81af8470-286c-440a-bbe7-b47a17ee6750"
```
Propose a declared-vs-live conformance check for firewall state, and route it to