codex c84fe7a3de

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

Make the k3s API firewall allowlist declarative

The live host restricted 6443/tcp to specific operator addresses, added by hand,
while this role still declared the port open to Anywhere with no source
restriction. The declared config was weaker than reality: running the base role
would have REMOVED the restriction and exposed the Kubernetes API to the
internet. Security was tightened on the host and never fed back into the source
of truth.

Found 2026-08-11 while diagnosing lost cluster access, which turned out to be an
ISP lease rotation (89.244.90.246 -> .236) against a hand-maintained allowlist.

Changes:
- defaults: k3s_api_allowed_sources (empty = 6443 closed to all external
  sources, the safe failure; SSH unaffected so the host stays recoverable) and
  k3s_api_revoked_sources, so rotated addresses are pruned rather than left as
  standing grants to whoever the ISP reassigns them to
- tasks: grant approved sources, then remove any blanket rule, then revoke
  retired ones. Order matters - grants are added before the blanket rule is
  deleted so convergence never opens a window with no API access
- group_vars/all.yaml: the current operator address, plus the two stale grants
  (.246 rotated, 85.132.220.102 historic) marked for revocation
- docs/verification.md: state that 6443 is source-restricted rather than
  listing it as a plainly allowed port

Not yet converged against the live host - the role change is committed but
running it is a production action needing operator approval.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-11 23:56:28 +02:00

2.7 KiB

Raw Blame History

type

title

domain

repo

status

owner

topic_slug

created

updated

state_hub_workstream_id

RAIL-HO-WP-0008

workplan

Publish railiance01 resource and commercial evidence

financials

railiance-infra

ready

codex

railiance

2026-08-11

RESOURCE-WP-0003

7122657f-87c8-46b5-a725-a1af1ba0af12

RAIL-HO-WP-0008 — railiance01 resource and commercial evidence

Goal

Provide the non-secret infrastructure facts needed to maintain resource:hosteurope:railiance01 in resource-control without making resource-control authoritative for host provisioning or fin-hub's booked cost. Origin: RESOURCE-WP-0003-T04 delegated evidence gap.

T01 — Identify the provider resource and lifecycle

id: RAIL-HO-WP-0008-T01
status: todo
priority: high
state_hub_task_id: "cde55584-229d-4e27-8fc8-0f54d78c71ed"

Record the Host Europe product/service class, non-secret provider resource ID, account reference suitable for joins, country/region or residency evidence, order or commissioning date, renewal date, cancellation deadline, and contract term. Reference source evidence without committing invoices, credentials, customer numbers, or payment instruments.

Done when resource-control can update the provider and lifecycle fields with provenance, while unknown or restricted fields remain explicitly classified.

T02 — Publish host capacity and utilization evidence

id: RAIL-HO-WP-0008-T02
status: todo
priority: high
state_hub_task_id: "8b0e5547-23ae-4516-b6d7-9c196882d088"

Define a stable non-secret observation containing provisioned and usable CPU, memory, root/local storage, traffic allowance where known, and timestamped host-level utilization. Distinguish provider limits from operating-system and Kubernetes observations.

Done when at least one reproducible observation can be consumed by resource-control and its source and cadence are documented.

T03 — Record infrastructure operations labor and exit inputs

id: RAIL-HO-WP-0008-T03
status: todo
priority: medium
state_hub_task_id: "8bdaa96f-400b-455f-87db-d5c11e287142"

Define the recurring host-maintenance activities and measurable operator-labor inputs, plus the host replacement/cancellation evidence required before exit. Do not estimate another repository's workload labor.

Done when resource-control can separate host infrastructure, recurring labor, and migration effort in forecasts and optimization cases.

Acceptance

Provider identity and lifecycle evidence is non-secret and attributable.
Capacity and utilization observations have timestamps and provenance.
Host labor and exit inputs can be consumed without duplicating booked cost.

2.7 KiB Raw Blame History