4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
12 lines
226 B
Django/Jinja
12 lines
226 B
Django/Jinja
[Unit]
|
|
Description=Hourly Railiance Goss baseline (RAIL-HO-WP-0009-T05)
|
|
|
|
[Timer]
|
|
OnBootSec=5min
|
|
OnUnitActiveSec=1h
|
|
RandomizedDelaySec=5min
|
|
Persistent=true
|
|
Unit=railiance-goss-baseline.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|