From 3d1bd75b6ba1b3f20877b9f6b2d6f01d77fae1c9 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 12 Aug 2026 02:00:17 +0200 Subject: [PATCH] Record two further drift findings in T03 UFW is entirely inactive on CoulombCore - no firewall on a host running ArgoCD, the registry and databases - while the declared baseline says UFW active with default deny. Same defect class as the k3s finding but in the opposite direction: the declaration is stronger than reality, and equally undetected. Not an emergency (6443 unreachable from outside, 22/443/80 the expected surface), but converging that host would enable UFW on a frozen production system and needs its own decision. Full convergence of Railiance01 carries 11 changes, most unrelated to the firewall and none ever applied, including a user-slice memory cap that could OOM running agent workloads. The base role has no tags, so convergence cannot be scoped - adding tags folded into this task. Co-Authored-By: Claude Opus 5 --- WORK-RECORDS.md | 2 +- ...irewall-declared-state-and-api-exposure.md | 20 +++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index aecc7ec..07c4ba2 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -29,7 +29,7 @@ | task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | | task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | | task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | -| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | +| task | RAIL-HO-WP-0009-T02 | progress | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | | task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | | task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | | task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | diff --git a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md index 6c9301f..a8d64f7 100644 --- a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md +++ b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md @@ -159,6 +159,26 @@ Note during the same session: port `2224/tcp` is open to Anywhere on this role at all. Establish whether it is intended, and either declare it or remove it. +**Second finding, 2026-08-12: UFW is entirely inactive on `CoulombCore`.** +`ufw status` returns `Status: inactive` — no firewall at all, on a host running +ArgoCD, the container registry and databases. The declared baseline +(`docs/verification.md`) says "UFW active, default deny inbound". Not an +emergency: 6443 is not reachable from outside (k3s appears bound locally or a +provider firewall is in front), and 22/443/80 are the expected surface. But it +is the same defect class as the k3s finding, in the opposite direction — the +declaration is *stronger* than reality here, and equally undetected. + +Converging `CoulombCore` would **enable UFW on a frozen production host**, which +is a real availability risk and must not be done casually. Treat as its own +decision. + +**Third finding: full convergence carries unrelated drift.** `--check` against +`Railiance01` reports 11 changes, most of them not firewall-related and none +ever applied — an sshd restart, `MemoryMax=1500M` / `MemorySwapMax=512M` on +`user-1000.slice`, PAM `nproc` caps, swappiness, timezone. The user-slice memory +cap in particular could OOM running agent workloads. The base role has **no +tags**, so convergence cannot be scoped. Add tags as part of this task. + ```task id: RAIL-HO-WP-0009-T04 status: todo