coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply Railiance01 firewall-only converge and close RAIL-HO-WP-0009
Some checks are pending
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / host-smoke (push) Successful in 0s
Details

Browse source 
Operator-approved playbooks/firewall.yaml --tags firewall removed the
three public 6443 grants. Live UFW now matches ADR-005 (OpenSSH + Nydus).
This commit is contained in:
codex 2026-08-15 17:57:17 +02:00
parent 4d9e77c968
commit d0e8f9f24e
4 changed files with 18 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

5
SCOPE.md
View file

@ -86,9 +86,8 @@ higher layer (Kubernetes, platform, etc.) can run.
higher-layer and future reef planning. `railiance-hosts` is **superseded** by
this repo and carries a banner saying so; its retirement is pending in
`railiance-master`
- **Open security work**: `RAIL-HO-WP-0009` — k3s API is declared tunnel-only
(ADR-005). Live `Railiance01` still has three public 6443 grants until an
operator-approved `make converge-firewall HOST=Railiance01`. CoulombCore
- **Firewall posture**: `RAIL-HO-WP-0009` finished. k3s API is tunnel-only
(ADR-005); live `Railiance01` UFW matches the declaration. CoulombCore
UFW stays unmanaged (`ufw_manage: false`)
---