coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refresh Current State: four-axis model, hosts supersession, open security work
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-12 00:05:13 +02:00
parent dffd6c561e
commit 35ddfa5f78
3 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
View file

@ -13,6 +13,7 @@ related_repos:
- railiance-cluster
- railiance-platform
- railiance-master
state_hub_workstream_id: "ebf3c8d1-9066-4f13-a2d5-1da0409f2162"
---
# RAIL-HO-WP-0009 - Firewall declared-state integrity and k3s API exposure
@ -81,6 +82,7 @@ It must not:
id: RAIL-HO-WP-0009-T01
status: done
priority: high
state_hub_task_id: "9a000a00-7cfd-4798-803f-bf59359a09b7"
```
Make the allowlist declarative. Add `k3s_api_allowed_sources` (empty default —
@ -98,6 +100,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
id: RAIL-HO-WP-0009-T02
status: todo
priority: high
state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
```
Converge the base role against `railiance01` and confirm the resulting UFW state
@ -112,6 +115,7 @@ Verify SSH remains available throughout, and re-check `kubectl get nodes` after.
id: RAIL-HO-WP-0009-T03
status: todo
priority: high
state_hub_task_id: "3e835b96-736c-458c-91eb-04bfd4c7e0e7"
```
Audit the rest of the base role for the same class of defect: any place where
@ -129,6 +133,7 @@ remove it.
id: RAIL-HO-WP-0009-T04
status: todo
priority: medium
state_hub_task_id: "908630e8-e245-47f5-a060-3949250f522c"
```
Remove the k3s API from the public internet. Operator addresses rotate, so an
@ -144,6 +149,7 @@ and the tunnel becomes a dependency of every operator action.
id: RAIL-HO-WP-0009-T05
status: todo
priority: medium
state_hub_task_id: "81af8470-286c-440a-bbe7-b47a17ee6750"
```
Propose a declared-vs-live conformance check for firewall state, and route it to