coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

46
ansible/inventory/group_vars/all.yaml
View file

@ -26,29 +26,37 @@ ops_bridge_user: tegwick
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"
# ---------------------------------------------------------------------------
# k3s API firewall allowlist (6443/tcp)
# k3s API firewall (6443/tcp) — tunnel only (ADR-005)
#
# The k3s API is NOT world-reachable. Only these sources may connect.
# Added 2026-08-11 after discovering the live host was source-restricted by hand
# while this repo still declared 6443 open to Anywhere — meaning a convergence
# run would have exposed the Kubernetes API to the internet.
# Public allowlist is empty. Reach the API over ops-bridge:
# bridge up k3s-api-railiance01 # local 16444
# bridge up k3s-api-coulombcore # local 16443
#
# These are operator egress addresses, not secrets. They are dynamic: when your
# ISP rotates the lease, MOVE the old entry to k3s_api_revoked_sources rather
# than deleting the line, so convergence prunes the stale grant instead of
# leaving it standing for whoever the address gets reassigned to.
#
# Durable alternative worth considering: reach the API over the ops-bridge SSH
# tunnel instead (see railiance-infra/docs/deploy-stack.md, the
# k3s-api-coulombcore pattern) and allow no public sources at all.
k3s_api_allowed_sources:
- address: "89.244.90.236"
comment: "k3s-api-operator-current"
- address: "89.244.90.255"
comment: "k3s-api-operator-current"
# Revoked addresses are pruned on a firewall-tagged converge so rotated or
# retired grants do not remain standing. Do not add new public sources here
# without amending ADR-005.
k3s_api_allowed_sources: []
k3s_api_revoked_sources:
- address: "89.244.90.248"
comment: "hand grant added 2026-08-12/15; retired by ADR-005"
- address: "89.244.90.236"
comment: "rotated ISP lease; retired by ADR-005"
- address: "89.244.90.255"
comment: "rotated ISP lease; retired by ADR-005"
- address: "89.244.90.246"
comment: "rotated ISP lease, superseded 2026-08-11"
- address: "85.132.220.102"
comment: "historic operator address, retired"
comment: "historic operator address; also the 2026-08-15 workstation lease"
# Single-node clusters need no public VXLAN grant. Set peer addresses here
# only when a second node must exchange Flannel frames (RAIL-BS-WP-0007).
flannel_vxlan_allowed_sources: []
# HostEurope Nydus agent — provider dashboard, root-password reset, backups.
# Required by the VPS platform (hosteurope/260308-dependency-nydus.md).
# Source-restricting it would break the provider; Anywhere is intentional.
ufw_extra_allowed:
- port: "2224"
proto: tcp
comment: "nydus-ex-api dashboard agent"