coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply Railiance01 firewall-only converge and close RAIL-HO-WP-0009
Some checks are pending
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / host-smoke (push) Successful in 0s
Details

Browse source 
Operator-approved playbooks/firewall.yaml --tags firewall removed the
three public 6443 grants. Live UFW now matches ADR-005 (OpenSSH + Nydus).
This commit is contained in:
codex 2026-08-15 17:57:17 +02:00
parent 4d9e77c968
commit d0e8f9f24e
4 changed files with 18 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Firewall declared-state integrity and k3s API exposure"
domain: financials
repo: railiance-infra
status: active
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-12"
@ -98,7 +98,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
```task
id: RAIL-HO-WP-0009-T02
status: wait
status: done
priority: high
state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
```
@ -148,11 +148,7 @@ operator-approved prune of those three grants. SSH stays; kubectl goes via
`k3s-api-railiance01` (`:16444`). CoulombCore is not touched
(`ufw_manage: false`).
Waiting on operator approval. Command:
```bash
make converge-firewall HOST=Railiance01
```
**Done 2026-08-15.** Operator approved. `ansible-playbook playbooks/firewall.yaml -l Railiance01 --tags firewall` deleted the three live 6443 grants (`.248`, `.236`, `.255`). Live UFW is now OpenSSH + Nydus 2224 only. SSH verified. `sudo k3s kubectl get nodes` → Ready v1.35.1+k3s1. Public `:6443` times out. Tunnel `k3s-api-railiance01` still answers on `:16444`.
```task
id: RAIL-HO-WP-0009-T03
@ -307,7 +303,6 @@ rollout) is not this repo.
## Outcome
T01, T03, T04, T05, T06 done. T02 waits on operator approval to run
`make converge-firewall HOST=Railiance01`, which will delete the three live
6443 grants and make the host match ADR-005. CoulombCore UFW is intentionally
not enabled.
Finished 2026-08-15. Declaration and live Railiance01 UFW now match ADR-005:
no public 6443 grants, no blanket VXLAN allow, Nydus 2224 declared. CoulombCore
UFW remains unmanaged (`ufw_manage: false`).