coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2044 commits 1 branch 0 tags 1.7 MiB
Commit graph

2044 commits

This branch
This branch
All branches
Author SHA1 Message Date
custodian-sync
dffd6c561e chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Updated by fix-consistency on 2026-08-12:
  - update .custodian-brief.md for railiance-infra
 2026-08-12 00:02:14 +02:00
codex
f4a7805cca Open RAIL-HO-WP-0009: firewall declared-state integrity and k3s API exposure
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Records the security defect found 2026-08-11: this repo declared 6443/tcp open
to Anywhere while the live host was source-restricted by hand, so converging the
base role would have exposed the Kubernetes API to the internet. A hardening run
that de-hardens, undetected because nothing compares declared UFW state to live
UFW state.

T01 (declarative allowlist) is done. T02 converges it - production action,
approval required, and until it runs the host still carries two stale grants to
addresses the ISP may have reassigned. T03 audits the role for the same class of
defect and asks about the undeclared 2224/tcp open to Anywhere. T04 proposes
removing the API from the public internet via the ops-bridge tunnel pattern
already documented for CoulombCore. T05 routes a declared-vs-live conformance
check to the unowned Q7 loop.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 00:01:39 +02:00
codex
c84fe7a3de Make the k3s API firewall allowlist declarative
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
The live host restricted 6443/tcp to specific operator addresses, added by hand,
while this role still declared the port open to Anywhere with no source
restriction. The declared config was weaker than reality: running the base role
would have REMOVED the restriction and exposed the Kubernetes API to the
internet. Security was tightened on the host and never fed back into the source
of truth.

Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an
ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist.

Changes:
- defaults: k3s_api_allowed_sources (empty = 6443 closed to all external
  sources, the safe failure; SSH unaffected so the host stays recoverable) and
  k3s_api_revoked_sources, so rotated addresses are pruned rather than left as
  standing grants to whoever the ISP reassigns them to
- tasks: grant approved sources, then remove any blanket rule, then revoke
  retired ones. Order matters - grants are added before the blanket rule is
  deleted so convergence never opens a window with no API access
- group_vars/all.yaml: the current operator address, plus the two stale grants
  (.246 rotated, 85.132.220.102 historic) marked for revocation
- docs/verification.md: state that 6443 is source-restricted rather than
  listing it as a plainly allowed port

Not yet converged against the live host - the role change is committed but
running it is a production action needing operator approval.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-11 23:56:28 +02:00
custodian-sync
88e71f7bd1 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-08-11:
  - update .custodian-brief.md for railiance-infra
 2026-08-11 14:45:48 +02:00
codex
6508a853e4 Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's
preliminary governing license, per target-revenue's
workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full
specialist legal review is deferred until out of beta (target-revenue
SCOPE.md §1). No Phase is yet declared for this repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-30 00:53:42 +02:00
codex
a5f16c79e1 Rename first home reef target to reef-railiance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
2026-07-26 09:00:32 +02:00
codex
e176738fad Define S1 reef rollout handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
2026-07-25 15:13:41 +02:00
custodian-sync
992e42a232 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Updated by fix-consistency on 2026-07-25:
  - update .custodian-brief.md for railiance-infra
 2026-07-25 15:01:04 +02:00
custodian-sync
1d8c0c65fb chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Updated by fix-consistency on 2026-07-25:
  - update .custodian-brief.md for railiance-infra
 2026-07-25 15:00:40 +02:00
codex
fba5485bbd Add first reef rollout workplan
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
2026-07-25 10:54:29 +02:00
custodian-sync
ae660d275f chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Updated by fix-consistency on 2026-07-25:
  - update .custodian-brief.md for railiance-infra
 2026-07-25 10:19:35 +02:00
tegwick
c23bea897e chore: archive finished RAIL-HO-WP-0005 (Forgejo production migration)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 15s
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-14 00:33:10 +02:00
custodian-sync
1f1a3bcab4 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-14:
  - update .custodian-brief.md for railiance-infra
 2026-07-14 00:32:39 +02:00
tegwick
5d5cac8bad RAIL-HO-WP-0005: finished (descoped) — Forgejo migration complete
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
T04/T09 closed on descope: encrypted off-cluster backup + passed restore drill
(RAILIANCE-WP-0013) meet migration safety bar; residual CNPG barman ScheduledBackup
hardening handed to a backup followup. Migration re-verified 2026-07-14.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-14 00:31:49 +02:00
custodian-sync
6042f75eda chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-10:
  - update .custodian-brief.md for railiance-infra
 2026-07-10 15:23:35 +02:00
tegwick
ebd572e63c Sync RAIL-HO-WP-0006 State Hub IDs from fix-consistency
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
2026-07-09 12:00:52 +02:00
tegwick
23226b1e8a Add RAIL-HO-WP-0006 registry ref cleanup workplan (finished)
Some checks are pending
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / host-smoke (push) Waiting to run
Details
2026-07-09 11:59:08 +02:00
tegwick
6ce65d09b6 WP-0005: resolve bootstrap alias, note OCI/npm migration
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Document railiance-bootstrap → railiance-cluster hub resolution and layer-repo
registry ref migration in workplan and retirement checklist.
 2026-07-09 11:38:14 +02:00
custodian-sync
810a6de51f chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 7s
Details 
Updated by fix-consistency on 2026-07-09:
  - update .custodian-brief.md for railiance-infra
 2026-07-09 11:32:44 +02:00
tegwick
1404e56c0e WP-0005 T12: Option A — keep Gitea fallback, 30-day window
Some checks failed
CI Smoke / host-smoke (push) Successful in 2s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details 
Operator decision: retain coulombcore Gitea Helm as read-only fallback with a
30-day rollback window (2026-07-08 → 2026-08-07). Mark T12 done; update
rollback runbook and retirement checklist.
 2026-07-09 11:32:25 +02:00
tegwick
040ccccc8e WP-0005: T12 prep checklist, backup gate 4/7, doc refresh 
Update workplan with Jul 9 cron success (4/7 gate, ETA Jul 12), add Gitea
retirement dependency scan and operator checklist, and align deploy-stack,
restore-drill evidence, and migration inventory with post-cutover state.
 2026-07-09 10:34:44 +02:00
tegwick
0c3968a108 CUST-WP-0055 T07: add archive workplan terminology grandfather note
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-08 20:26:37 +02:00
tegwick
c6f7fe865f docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
2026-07-08 17:15:30 +02:00
custodian-sync
336862ba0a chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-08:
  - update .custodian-brief.md for railiance-infra
 2026-07-08 15:36:54 +02:00
tegwick
96678c210d Complete RAIL-HO-WP-0005 T11 production cutover
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Gitea org archived (79/79), package push disabled, ArgoCD repointed to Forgejo,
and rollback runbook added. Mark T11 done; T12 remains after stabilization.
 2026-07-08 15:36:22 +02:00
tegwick
b3a065a1c9 Update RAIL-HO-WP-0005: migration ladder complete, backup cron fixed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Mark T01 and T10 done after paginated forge comparison shows 0 Gitea-only
repos and all State Hub remotes on Forgejo. Advance T11 to progress with
per-repo cutover complete; Gitea read-only marking awaits operator signoff.

Refresh forgejo-migration-inventory.md with 2026-07-08 closure addendum.
Document backup cron PATH fix and 3/7 gate status after manual run.
 2026-07-08 15:20:19 +02:00
custodian-sync
36fcfd4d85 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-08:
  - update .custodian-brief.md for railiance-infra
 2026-07-08 15:20:04 +02:00
tegwick
c90d697db0 Regenerate agent instructions from state-hub templates (CUST-WP-0055 T01)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Sync AGENTS.md, CLAUDE.md, and .claude/rules from updated project_rules
templates: workplan-first session protocol, legacy terminology footnote,
and GET /workplans/ examples.
 2026-07-08 14:50:35 +02:00
tegwick
eda797bd37 WP-0005: promote tier-2 tooling repos and refresh hub drift
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Promote ops-bridge, open-reuse, and artifact-store to Forgejo (wave-2).
Re-patch all Forgejo-hosted registered hub remotes after drift. Update
workplan and inventory: backup gate 2/7, Forgejo org 20 repos, hub 16/46.
 2026-07-08 00:29:07 +02:00
tegwick
ef886f66ea WP-0005: wave-2 queue, promote ihp-railiance-probe, smaller restore chunks
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Document tier-2/3 promotion queue; note ihp-railiance-probe tier-1 promotion;
align restore drill chunk size with backup tooling.
 2026-07-08 00:11:12 +02:00
tegwick
826fd93603 Advance WP-0005 T01/T10: Gitea inventory and hub drift cleared
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 35s
Details 
Record partial Gitea org inventory, 40-repo migration gap, and patch
ops-warden hub remote_url so all Forgejo-hosted registrations align.
 2026-07-08 00:03:48 +02:00
tegwick
1da9c3269b Pass Nextcloud backup restore drill for Forgejo (T09)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 9s
Details 
Decrypt production forgejo-dump artifact, restore 14 repos in isolated
namespace, and harden restore script for large chunked copy and drill mailer stub.
 2026-07-07 22:44:55 +02:00
custodian-sync
8ea13a065b chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 22:10:38 +02:00
tegwick
6d05f8b6e9 Update WP-0005: T07 done, tier-2.5 hub remote_url patched
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details 
Mark package registry task complete after npm probe; document hub drift
resolution for six tier-2.5 repos and current backup gate status.
 2026-07-07 22:10:00 +02:00
custodian-sync
136fd1a47a chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 20:55:36 +02:00
custodian-sync
0614aa5337 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 19:54:05 +02:00
tegwick
b06ceb6b82 WP-0005 T04/T09: note forgejo-backup automation in railiance-platform
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 12s
Details 
Makefile targets and operator doc landed; cron and 7-day gate remain.
 2026-07-07 17:19:19 +02:00
custodian-sync
b515a5c10a chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 17:00:51 +02:00
tegwick
a62df364aa Close RAIL-HO-WP-0005-T02; record cutover Option A on WP-0005
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 22s
Details 
Staged per-repo cutover is the official T11 mode. T02 design decisions complete.
 2026-07-07 17:00:05 +02:00
tegwick
7658c7be3a Record T02 backup Option A on WP-0005 (Nextcloud lane)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 8s
Details 
Unblocks T04/T09 implementation wording; cutover mode remains the last T02 item.
 2026-07-07 16:55:13 +02:00
tegwick
fb07daef3a Record T02 package scope decision (Option C) on WP-0005
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 42s
Details 
OCI plus npm and generic at launch; PyPI/Go/Maven/Helm as inventory proves.
T07 scope updated; T02 backup and cutover decisions remain open.
 2026-07-07 16:47:15 +02:00
custodian-sync
9fbc1bac93 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 16:40:48 +02:00
tegwick
d27bcb1a59 Mark RAIL-HO-WP-0005-T06 done after SMTP delivery verified
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
IONOS mail via OpenBao/ESO and smtp.ionos.de STARTTLS confirmed with operator
test email and forgot-password delivery.
 2026-07-07 16:40:12 +02:00
tegwick
1cfc5d7b81 Record IONOS SMTP decision for RAIL-HO-WP-0005 T02/T06
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Operator confirmed IONOS mail for coulomb.social; update workplan gates and
point implementation to railiance-apps Forgejo mailer docs.
 2026-07-07 02:04:33 +02:00
tegwick
48610117c7 Update RAIL-HO-WP-0005 with Forgejo cutover progress and mark T08 done
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Sync the workplan file with State Hub (fix-consistency backing link), record
2026-07-06 state-hub tier-3 cutover evidence, refresh the Forgejo org
inventory snapshot, and close T08 now that Actions criteria are met.
 2026-07-07 01:50:57 +02:00
custodian-sync
5fbf583843 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-07:
  - update .custodian-brief.md for railiance-infra
 2026-07-07 01:50:45 +02:00
tegwick
d755cd613f Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-06 19:50:53 +02:00
tegwick
3e992d2551 RAIL-HO-WP-0005: link tier-3 remote_url sweep playbook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Playbook drafted in the-custodian; tier-3 execution still gated on state-hub
promotion and scheduled backups.
 2026-07-04 13:21:41 +02:00
tegwick
c664aebd1d RAIL-HO-WP-0005: record tier 2.5 railiance stack Forgejo promotion
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Inventory and workplan updates for enablement templates, tegwick SSH, and
railiance-* repos canonical on forgejo-remote.
 2026-07-04 12:51:05 +02:00
tegwick
67beab1525 Add Forgejo CI smoke workflow (enablement template)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
2026-07-04 12:49:52 +02:00