coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

10
SCOPE.md
View file

@ -86,12 +86,10 @@ higher layer (Kubernetes, platform, etc.) can run.
higher-layer and future reef planning. `railiance-hosts` is **superseded** by
this repo and carries a banner saying so; its retirement is pending in
`railiance-master`
- **Open security work**: `RAIL-HO-WP-0009` — the base role declared the k3s API
open to Anywhere while the live host was source-restricted by hand, so
converging would have exposed the Kubernetes API. The allowlist is now
declarative (`k3s_api_allowed_sources` / `k3s_api_revoked_sources`) but
**has not yet been converged**, so the live host still carries two stale
grants to rotated operator addresses
- **Open security work**: `RAIL-HO-WP-0009` — k3s API is declared tunnel-only
(ADR-005). Live `Railiance01` still has three public 6443 grants until an
operator-approved `make converge-firewall HOST=Railiance01`. CoulombCore
UFW stays unmanaged (`ufw_manage: false`)
---