coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/deploy-stack.md
View file

@ -120,7 +120,8 @@ After S2 is up, establish the persistent tunnels from the workstation:
```bash
bridge up state-hub-coulombcore # state-hub HTTP (port 18000 remote)
bridge up state-hub-mcp-coulombcore # state-hub MCP (port 18001 remote)
bridge up k3s-api-coulombcore # k3s API (port 16443 local)
bridge up k3s-api-coulombcore # CoulombCore k3s API (port 16443 local)
bridge up k3s-api-railiance01 # Railiance01 k3s API (port 16444 local)
```
Verify: `bridge status` shows all three connected.