coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

44
ansible/roles/base/defaults/main.yml
View file

@ -1,6 +1,12 @@
---
# Base role defaults.
# When false, this role will not enable or rewrite UFW. Use that for hosts
# whose live packet filter is not UFW (CoulombCore: iptables INPUT DROP with
# a Plesk-era accept list). Enabling UFW there is an availability decision,
# not a side effect of an unrelated converge.
ufw_manage: true
# Source addresses permitted to reach the k3s API (6443/tcp).
#
# WHY THIS EXISTS
@ -10,21 +16,45 @@
# config WEAKER than reality: re-running this role would have removed the
# restriction and exposed the Kubernetes API to the internet. Found 2026-08-11.
#
# The allowlist is therefore declared here and converged, not hand-edited.
# Operator addresses rotate (dynamic ISP leases). An allowlist is a treadmill:
# each rotation is either an outage or a stale grant to whoever the ISP
# reassigns the address to. RAIL-HO-WP-0009-T04 therefore keeps this list
# empty. Reach the API over the ops-bridge SSH tunnel
# (`k3s-api-railiance01`, local port 16444; `k3s-api-coulombcore`, 16443).
# See docs/adr/ADR-005-k3s-api-tunnel-only.md.
#
# Deliberately empty by default. A host that sets no sources gets NO public
# access to 6443 — which is the safe failure. SSH (22) is unaffected, so a host
# converged with an empty list is always recoverable.
#
# Set the real values in inventory/group_vars/all.yaml. Each entry:
# Each entry, if any:
# - address: "203.0.113.10"
# comment: "k3s-api-operator-workstation"
k3s_api_allowed_sources: []
# Source addresses whose k3s API access must be REMOVED on convergence.
#
# Operator addresses rotate (dynamic ISP leases). Without this, every rotation
# leaves a standing grant to an address the ISP has since reassigned to someone
# else. Move an address here when it stops being yours; convergence then prunes
# it rather than leaving it to accumulate.
# Move an address here when it stops being yours (or when the public
# allowlist is retired); convergence then prunes it.
k3s_api_revoked_sources: []
# Source addresses permitted to send Flannel VXLAN (8472/udp).
#
# Empty by default. A single-node cluster does not need a public VXLAN
# grant; adding an unrestricted 8472/udp allow would expose the pod network
# to injection. Set this to the other nodes' addresses only when the cluster
# becomes multi-node (RAIL-BS-WP-0007 / ThreePhoenix HA).
#
# Each entry:
# - address: "203.0.113.20"
# comment: "flannel-vxlan-peer"
flannel_vxlan_allowed_sources: []
# Extra UFW allows that are not k3s. Used for provider agents that must stay
# reachable (HostEurope Nydus on 2224/tcp). Empty by default so a Hetzner
# host does not inherit a HostEurope-only hole.
#
# Each entry:
# - port: "2224"
# proto: tcp
# comment: "nydus-ex-api dashboard agent"
ufw_extra_allowed: []