Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

spec/server-baseline.yaml

@@ -1,99 +1,63 @@
-# Railiance Managed Node — Baseline Server Specification
-# This file is the authoritative source of truth for the target state of every
-# server managed by railiance-infra. All convergence roles and test assertions
-# MUST be derivable from this document.
-#
-# When you change something here, update the Ansible roles AND the Goss tests.
-# Format: human-readable YAML, kept technology-neutral.
+# Executable S1 host baseline. scripts/baseline_contract.py resolves this model
+# into the Ansible hostvars consumed by convergence and Goss verification.
+version: "2.0"
 
-version: "1.1"
-applies_to: all  # override per node group if needed
-
-# ---------------------------------------------------------------------------
-# Firewall
-# ---------------------------------------------------------------------------
-firewall:
-  engine: ufw
-  status: active
-  default_incoming: deny
-  default_outgoing: allow
-  # Hosts with ufw_manage: false (CoulombCore) keep their existing packet
-  # filter. Do not enable UFW there as a side effect of an unrelated converge.
-  rules:
-    - name: OpenSSH   # UFW app name; resolves to 22/tcp
-      action: allow
-    - name: k3s-api
-      port: 6443
-      proto: tcp
-      action: allow
-      sources: []   # tunnel-only (ADR-005); public allowlist stays empty
-    - name: flannel-vxlan
-      port: 8472
-      proto: udp
-      action: allow
-      sources: []   # omit while single-node; peer addresses only when multi-node
-    - name: nydus-ex-api
-      port: 2224
-      proto: tcp
-      action: allow
-      sources: anywhere   # HostEurope provider agent; required by the VPS platform
-
-# ---------------------------------------------------------------------------
-# SSH daemon
-# ---------------------------------------------------------------------------
-ssh:
-  permit_root_login: "no"
-  password_authentication: "no"
-  pubkey_authentication: "yes"
-  challenge_response_authentication: "no"
-  # Hardening is applied via drop-in: /etc/ssh/sshd_config.d/10-hardening.conf
-  # The cloud image default sshd_config is left in place; the drop-in overrides it.
-
-# ---------------------------------------------------------------------------
-# Services
-# ---------------------------------------------------------------------------
-services:
-  - name: ufw
-    enabled: true
-    running: true
-  - name: fail2ban
-    enabled: true
-    running: true
-  - name: ssh.socket
-    enabled: true
-    running: true
-    # Ubuntu 24.04 uses socket activation: ssh.service is disabled by design,
-    # triggered on demand by ssh.socket.
-
-# ---------------------------------------------------------------------------
-# Packages
-# ---------------------------------------------------------------------------
-packages:
-  installed:
-    - ufw
-    - fail2ban
-    - git
+defaults:
+  packages:
+    - apt-transport-https
+    - ca-certificates
     - curl
+    - git
     - vim
     - htop
-  binaries:
-    # Installed to /usr/local/bin/ by the sops_agent role, not via apt
-    - age
-    - sops
-
-# ---------------------------------------------------------------------------
-# Users
-# ---------------------------------------------------------------------------
-users:
-  - name: tegwick
+    - ufw
+    - fail2ban
+    - python3
+    - python3-venv
+  services:
+    - fail2ban
+    - ssh.socket
+  ssh_directives:
+    PasswordAuthentication: "no"
+    PermitRootLogin: "no"
+    PubkeyAuthentication: "yes"
+    ChallengeResponseAuthentication: "no"
+  user:
+    name: tegwick
     shell: /bin/bash
-    sudo: passwordless  # NOPASSWD:ALL via /etc/sudoers.d/tegwick — NOT via sudo group
-    ssh_key_auth: true
+    sudo: NOPASSWD
+  security:
+    histcontrol: ignorespace
+    fail2ban_jails:
+      - sshd
 
-# ---------------------------------------------------------------------------
-# Security baseline
-# ---------------------------------------------------------------------------
-security:
-  histcontrol: ignorespace  # set in /etc/profile.d/
-  fail2ban_jails:
-    - sshd
+profiles:
+  ufw-managed:
+    services:
+      - ufw
+    firewall:
+      mode: ufw
+      managed: true
+      verification:
+        command: ufw status
+        stdout:
+          - "Status: active"
+          - "OpenSSH.*ALLOW"
+
+  external-firewall:
+    services: []
+    firewall:
+      mode: external
+      managed: false
+      replacement_control:
+        description: >-
+          CoulombCore retains its iptables INPUT default-drop policy and
+          Plesk-era accept list until that surface is fully declared for UFW.
+        owner: railiance-infra
+        removal_condition: >-
+          Replace this exception after every required listener is declared and
+          an attended UFW migration plan proves no availability regression.
+      verification:
+        command: iptables -S INPUT
+        stdout:
+          - "^-P INPUT DROP$"