coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/convergence.md
View file

@ -9,7 +9,9 @@ This process is called **convergence**.
When you run `make converge`, Ansible connects to all declared hosts and applies baseline roles:
- **User setup** → ensures the `admin` user exists with your SSH key and passwordless sudo
- **Firewall** → configures `ufw` with sensible defaults (deny incoming, allow SSH)
- **Firewall** → configures `ufw` with deny incoming, SSH, declared extras
(Nydus), and a tunnel-only k3s API (ADR-005). Use
`make converge-firewall HOST=Railiance01` to apply only those tasks.
- **Hardening** → basic SSH daemon hardening, disable root login, disable password auth
- **Tooling** → installs essential packages (htop, vim, git, curl, fail2ban, etc.)
- **SOPS agent** → ensures decryption tooling (`age`, `sops`) is available on the host