4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
10 lines
258 B
Django/Jinja
10 lines
258 B
Django/Jinja
[Unit]
|
|
Description=Railiance declared-vs-live Goss baseline
|
|
Documentation=file:///etc/goss/baseline.yaml
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/goss-baseline-check
|
|
Nice=10
|
|
# The wrapper records TAP even when assertions fail.
|
|
SuccessExitStatus=0 1
|