Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01. |
||
|---|---|---|
| .. | ||
| base | ||
| custodian_agent/tasks | ||
| goss | ||
| resource_limits | ||
| sops_agent/tasks | ||
| ssh_ca_host | ||
| swapfile/tasks | ||
| wireguard/tasks | ||