coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record two further drift findings in T03
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
UFW is entirely inactive on CoulombCore - no firewall on a host running ArgoCD,
the registry and databases - while the declared baseline says UFW active with
default deny. Same defect class as the k3s finding but in the opposite
direction: the declaration is stronger than reality, and equally undetected.
Not an emergency (6443 unreachable from outside, 22/443/80 the expected
surface), but converging that host would enable UFW on a frozen production
system and needs its own decision.

Full convergence of Railiance01 carries 11 changes, most unrelated to the
firewall and none ever applied, including a user-slice memory cap that could OOM
running agent workloads. The base role has no tags, so convergence cannot be
scoped - adding tags folded into this task.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-12 02:00:17 +02:00
parent 31f19b8674
commit 3d1bd75b6b
2 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -29,7 +29,7 @@
| task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T02 | progress | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |

20
workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
View file

@ -159,6 +159,26 @@ Note during the same session: port `2224/tcp` is open to Anywhere on
this role at all. Establish whether it is intended, and either declare it or
remove it.
**Second finding, 2026-08-12: UFW is entirely inactive on `CoulombCore`.**
`ufw status` returns `Status: inactive` — no firewall at all, on a host running
ArgoCD, the container registry and databases. The declared baseline
(`docs/verification.md`) says "UFW active, default deny inbound". Not an
emergency: 6443 is not reachable from outside (k3s appears bound locally or a
provider firewall is in front), and 22/443/80 are the expected surface. But it
is the same defect class as the k3s finding, in the opposite direction — the
declaration is *stronger* than reality here, and equally undetected.
Converging `CoulombCore` would **enable UFW on a frozen production host**, which
is a real availability risk and must not be done casually. Treat as its own
decision.
**Third finding: full convergence carries unrelated drift.** `--check` against
`Railiance01` reports 11 changes, most of them not firewall-related and none
ever applied — an sshd restart, `MemoryMax=1500M` / `MemorySwapMax=512M` on
`user-1000.slice`, PAM `nproc` caps, swappiness, timezone. The user-slice memory
cap in particular could OOM running agent workloads. The base role has **no
tags**, so convergence cannot be scoped. Add tags as part of this task.
```task
id: RAIL-HO-WP-0009-T04
status: todo