docs(reuse): establish reviewed NetKingdom security capabilities
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
codex
parent
ef64e324b6
commit
c42797a2dd
2 changed files with 60 additions and 67 deletions
|
|
@ -1,9 +1,7 @@
|
|||
---
|
||||
id: capability.railiance.infra-provisioning
|
||||
name: RailianceHosts Infrastructure Provisioning
|
||||
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
|
||||
cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
|
||||
of truth.
|
||||
name: Host convergence and security baseline
|
||||
summary: Ansible inventory, firewall, SSH bootstrap and baseline verification.
|
||||
owner: railiance-infra
|
||||
status: draft
|
||||
domain: financials
|
||||
|
|
@ -12,20 +10,26 @@ tags:
|
|||
- terraform
|
||||
- ansible
|
||||
- infrastructure
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
maturity:
|
||||
discovery:
|
||||
current: D4
|
||||
target: D5
|
||||
confidence: high
|
||||
rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
|
||||
setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
|
||||
as source of truth — an unusually complete operational README among the swept repos.
|
||||
rationale: README documents a complete, concrete quickstart (clone, prerequisites,
|
||||
SOPS/age secrets setup, provider setup, terraform apply, ansible convergence)
|
||||
with a specific inventory file (`inventory/servers.yaml`) as source of truth
|
||||
— an unusually complete operational README among the swept repos.
|
||||
availability:
|
||||
current: A2
|
||||
target: A3
|
||||
confidence: high
|
||||
rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
|
||||
already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
||||
rationale: 'Source interface assessed 2026-10-14: Ansible inventory, firewall,
|
||||
SSH bootstrap and baseline verification. Availability describes the delivery
|
||||
form, not production acceptance. Current hosts differ from the retained Hetzner
|
||||
provisioning path.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C2
|
||||
|
|
@ -42,41 +46,39 @@ external_evidence:
|
|||
confidence: low
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- reproducibility not independently re-verified via a live provisioning run in this sweep
|
||||
- reproducibility not independently re-verified via a live provisioning run in
|
||||
this sweep
|
||||
discovery:
|
||||
intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
|
||||
cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
|
||||
OAS Stack.
|
||||
intent: Ansible inventory, firewall, SSH bootstrap and baseline verification
|
||||
includes:
|
||||
- Terraform server lifecycle management
|
||||
- cloud-init first-boot configuration
|
||||
- Ansible convergence playbooks
|
||||
- SOPS+age encrypted secrets in-repo
|
||||
- Ansible inventory, firewall, SSH bootstrap and baseline verification
|
||||
excludes:
|
||||
- Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
|
||||
- platform services (see railiance-platform)
|
||||
- Current hosts differ from the retained Hetzner provisioning path
|
||||
assumptions: []
|
||||
use_cases: []
|
||||
use_cases:
|
||||
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity'
|
||||
- 'U10: Operator recovers identity, custody or data with independently held recovery
|
||||
material'
|
||||
- 'U13: Platform owner deploys and rolls back a workload with explicit substrate
|
||||
and custody bindings'
|
||||
research_memos: []
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A3
|
||||
current_artifacts:
|
||||
- Terraform configs
|
||||
- Ansible playbooks
|
||||
- scripts/
|
||||
- tools/
|
||||
- SCOPE.md
|
||||
target_artifacts: []
|
||||
consumption_modes:
|
||||
- cli (terraform/ansible)
|
||||
- gitops
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
depends_on: []
|
||||
supports: []
|
||||
related_to: []
|
||||
related_to:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- README.md
|
||||
- SCOPE.md
|
||||
tests:
|
||||
- sbom-tools.yaml
|
||||
|
|
@ -86,46 +88,36 @@ evidence:
|
|||
incidents: []
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
|
||||
- Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity
|
||||
- Operator recovers identity, custody or data with independently held recovery material
|
||||
- Platform owner deploys and rolls back a workload with explicit substrate and custody
|
||||
bindings
|
||||
not_recommended_for:
|
||||
- needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
|
||||
for shared services)
|
||||
- Current hosts differ from the retained Hetzner provisioning path
|
||||
known_limitations:
|
||||
- reproducibility not independently re-verified via a live provisioning run in this sweep
|
||||
- Current hosts differ from the retained Hetzner provisioning path
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
promotion_history: []
|
||||
---
|
||||
|
||||
# RailianceHosts Infrastructure Provisioning
|
||||
# Host convergence and security baseline
|
||||
|
||||
## Overview
|
||||
Ansible inventory, firewall, SSH bootstrap and baseline verification.
|
||||
|
||||
`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
||||
## Reuse boundary
|
||||
|
||||
## Assessment notes
|
||||
Current hosts differ from the retained Hetzner provisioning path.
|
||||
|
||||
### Discovery
|
||||
## Supported use cases
|
||||
|
||||
README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.
|
||||
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
|
||||
- U10: Operator recovers identity, custody or data with independently held recovery material
|
||||
- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings
|
||||
|
||||
### Availability
|
||||
## Evidence and integration
|
||||
|
||||
Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
||||
- [SCOPE.md](../../SCOPE.md)
|
||||
|
||||
### Completeness
|
||||
|
||||
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
|
||||
(reuse-surface). No external consumer feedback exists yet; levels reflect
|
||||
scope-vs-intent documentation quality, not internal code quality.
|
||||
|
||||
### Reliability
|
||||
|
||||
No production consumer telemetry exists yet; reliability level is
|
||||
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
|
||||
|
||||
## Promotion checklist
|
||||
|
||||
- [x] ID follows `capability.<domain>.<name>` pattern
|
||||
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
|
||||
- [x] `external_evidence` is populated separately from `maturity`
|
||||
- [ ] Relations reference valid capability IDs (none yet)
|
||||
- [x] Index entry added in `registry/indexes/capabilities.yaml`
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
|
|||
|
|
@ -1,22 +1,23 @@
|
|||
version: 1
|
||||
updated: '2026-07-06'
|
||||
updated: '2026-10-14'
|
||||
domain: helix_forge
|
||||
capabilities:
|
||||
- id: capability.railiance.infra-provisioning
|
||||
name: RailianceHosts Infrastructure Provisioning
|
||||
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
|
||||
cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
|
||||
of truth.
|
||||
vector: D4 / A2 / C2 / R1
|
||||
name: Host convergence and security baseline
|
||||
summary: Ansible inventory, firewall, SSH bootstrap and baseline verification.
|
||||
domain: financials
|
||||
status: draft
|
||||
owner: railiance-infra
|
||||
path: registry/capabilities/capability.railiance.infra-provisioning.md
|
||||
tags:
|
||||
- railiance
|
||||
- terraform
|
||||
- ansible
|
||||
- infrastructure
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D4 / A2 / C2 / R1
|
||||
path: registry/capabilities/capability.railiance.infra-provisioning.md
|
||||
consumption_modes:
|
||||
- cli (terraform/ansible)
|
||||
- gitops
|
||||
- CLI
|
||||
- source
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue