coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
This commit is contained in:
codex 2026-08-15 15:41:59 +02:00
parent 434121be99
commit 4d9e77c968
29 changed files with 793 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/verification.md
View file

@ -10,11 +10,13 @@ a reproducible, CI-friendly pass/fail verdict.
of every managed node. It covers:
- **Firewall** — UFW active, default deny inbound, required ports allowed
(SSH 22/tcp, Flannel VXLAN 8472/udp). The k3s API (6443/tcp) is
**source-restricted**, not world-open: only addresses in
`k3s_api_allowed_sources` may reach it, and `k3s_api_revoked_sources` is
pruned on convergence. A host with an empty allowlist has 6443 closed to all
external sources — the safe failure, recoverable over SSH.
(SSH 22/tcp; HostEurope Nydus 2224/tcp). The k3s API (6443/tcp) is
**tunnel-only** (ADR-005): `k3s_api_allowed_sources` is empty, and
`k3s_api_revoked_sources` is pruned on a firewall-tagged converge. Flannel
VXLAN (8472/udp) is omitted while the cluster is single-node; peer
addresses go in `flannel_vxlan_allowed_sources` when a second node appears.
Hosts with `ufw_manage: false` (CoulombCore) are not rewritten. A host with
an empty 6443 allowlist is recoverable over SSH.
- **SSH daemon** — root login disabled, password auth disabled, pubkey auth enabled
- **Services** — ufw, fail2ban, ssh.socket enabled and running
- **Packages** — ufw, fail2ban, git, curl, vim, htop (age and sops installed as binaries)
@ -56,7 +58,8 @@ you need a structured, automatable check.
## Goss test file
`goss/baseline.yaml` contains one Goss assertion per spec item. The mapping is:
`goss/baseline.yaml.j2` is rendered per host from the same inventory lists
that converge UFW. The mapping is:
| spec section | Goss resource |
|---|---|
@ -73,8 +76,11 @@ you need a structured, automatable check.
1. Add the desired state to `spec/server-baseline.yaml`
2. Add the Ansible task to `ansible/roles/base/tasks/main.yml`
3. Add the Goss assertion to `goss/baseline.yaml`
4. Run `make converge && make verify` to confirm
3. Add the Goss assertion to `goss/baseline.yaml.j2`
4. Run `make converge-firewall` and `make verify-host HOST=…` to confirm
An hourly on-host timer (`railiance-goss-baseline.timer`) reruns the last
rendered baseline. See `docs/conformance-loop.md`.
## Reports