UFW is entirely inactive on CoulombCore - no firewall on a host running ArgoCD,
the registry and databases - while the declared baseline says UFW active with
default deny. Same defect class as the k3s finding but in the opposite
direction: the declaration is stronger than reality, and equally undetected.
Not an emergency (6443 unreachable from outside, 22/443/80 the expected
surface), but converging that host would enable UFW on a frozen production
system and needs its own decision.
Full convergence of Railiance01 carries 11 changes, most unrelated to the
firewall and none ever applied, including a user-slice memory cap that could OOM
running agent workloads. The base role has no tags, so convergence cannot be
scoped - adding tags folded into this task.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
89.244.90.255 appeared in the live allowlist mid-session. Verified legitimate:
SSH pubkey auth as tegwick from that address on 2026-08-02, and UFW BLOCK
entries on 6443 immediately before it was granted. Now declared.
Both stale grants are deleted from the live host, so the security goal of T02 is
met and the live 6443 allowlist matches the declaration exactly.
Full convergence deliberately held: --check reports 11 changes, mostly unrelated
to the firewall, including MemoryMax=1500M on user-1000.slice which could OOM
running agent workloads, plus an sshd restart. That is a separate decision, and
the base role has no tags so convergence cannot be scoped to UFW alone. Records
both follow-ons.
The allowlist drifting again by hand during the session that was fixing
allowlist drift is now recorded as the strongest argument for T04, removing the
API from the public internet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Records the security defect found 2026-08-11: this repo declared 6443/tcp open
to Anywhere while the live host was source-restricted by hand, so converging the
base role would have exposed the Kubernetes API to the internet. A hardening run
that de-hardens, undetected because nothing compares declared UFW state to live
UFW state.
T01 (declarative allowlist) is done. T02 converges it - production action,
approval required, and until it runs the host still carries two stale grants to
addresses the ISP may have reassigned. T03 audits the role for the same class of
defect and asks about the undeclared 2224/tcp open to Anywhere. T04 proposes
removing the API from the public internet via the ops-bridge tunnel pattern
already documented for CoulombCore. T05 routes a declared-vs-live conformance
check to the unowned Q7 loop.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
