3c38b0625a
89.244.90.255 appeared in the live allowlist mid-session. Verified legitimate: SSH pubkey auth as tegwick from that address on 2026-08-02, and UFW BLOCK entries on 6443 immediately before it was granted. Now declared. Both stale grants are deleted from the live host, so the security goal of T02 is met and the live 6443 allowlist matches the declaration exactly. Full convergence deliberately held: --check reports 11 changes, mostly unrelated to the firewall, including MemoryMax=1500M on user-1000.slice which could OOM running agent workloads, plus an sshd restart. That is a separate decision, and the base role has no tags so convergence cannot be scoped to UFW alone. Records both follow-ons. The allowlist drifting again by hand during the session that was fixing allowlist drift is now recorded as the strongest argument for T04, removing the API from the public internet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
54 lines
2.5 KiB
YAML
54 lines
2.5 KiB
YAML
# Ansible group vars — applied to all managed hosts.
|
|
#
|
|
# custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
|
|
#
|
|
# HOW TO SET THIS:
|
|
# 1. Generate the keypair on the workstation (one-time):
|
|
# cd ~/the-custodian && make custodian-keygen
|
|
# This creates ~/.ssh/id_custodian_agent (private, never committed)
|
|
# and writes the public key to:
|
|
# ~/railiance-infra/ansible/inventory/group_vars/all.yaml ← this file
|
|
#
|
|
# 2. Commit the updated all.yaml (public key only — safe to commit).
|
|
#
|
|
# 3. Deploy to all managed hosts:
|
|
# cd ~/railiance-infra && make provision-custodian-agent
|
|
#
|
|
# The key below is a placeholder — replace by running `make custodian-keygen`.
|
|
|
|
custodian_agent_user: tegwick
|
|
custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
|
|
|
|
# ops-bridge tunnel key — injected by the base role so ops-bridge connectivity
|
|
# is available as early as SSH infrastructure is up.
|
|
# Private key lives at ~/.ssh/id_ops on the workstation. Never commit the private key.
|
|
ops_bridge_user: tegwick
|
|
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# k3s API firewall allowlist (6443/tcp)
|
|
#
|
|
# The k3s API is NOT world-reachable. Only these sources may connect.
|
|
# Added 2026-08-11 after discovering the live host was source-restricted by hand
|
|
# while this repo still declared 6443 open to Anywhere — meaning a convergence
|
|
# run would have exposed the Kubernetes API to the internet.
|
|
#
|
|
# These are operator egress addresses, not secrets. They are dynamic: when your
|
|
# ISP rotates the lease, MOVE the old entry to k3s_api_revoked_sources rather
|
|
# than deleting the line, so convergence prunes the stale grant instead of
|
|
# leaving it standing for whoever the address gets reassigned to.
|
|
#
|
|
# Durable alternative worth considering: reach the API over the ops-bridge SSH
|
|
# tunnel instead (see railiance-infra/docs/deploy-stack.md, the
|
|
# k3s-api-coulombcore pattern) and allow no public sources at all.
|
|
k3s_api_allowed_sources:
|
|
- address: "89.244.90.236"
|
|
comment: "k3s-api-operator-current"
|
|
- address: "89.244.90.255"
|
|
comment: "k3s-api-operator-current"
|
|
|
|
k3s_api_revoked_sources:
|
|
- address: "89.244.90.246"
|
|
comment: "rotated ISP lease, superseded 2026-08-11"
|
|
- address: "85.132.220.102"
|
|
comment: "historic operator address, retired"
|