4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
99 lines
3.2 KiB
YAML
99 lines
3.2 KiB
YAML
# Railiance Managed Node — Baseline Server Specification
|
|
# This file is the authoritative source of truth for the target state of every
|
|
# server managed by railiance-infra. All convergence roles and test assertions
|
|
# MUST be derivable from this document.
|
|
#
|
|
# When you change something here, update the Ansible roles AND the Goss tests.
|
|
# Format: human-readable YAML, kept technology-neutral.
|
|
|
|
version: "1.1"
|
|
applies_to: all # override per node group if needed
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Firewall
|
|
# ---------------------------------------------------------------------------
|
|
firewall:
|
|
engine: ufw
|
|
status: active
|
|
default_incoming: deny
|
|
default_outgoing: allow
|
|
# Hosts with ufw_manage: false (CoulombCore) keep their existing packet
|
|
# filter. Do not enable UFW there as a side effect of an unrelated converge.
|
|
rules:
|
|
- name: OpenSSH # UFW app name; resolves to 22/tcp
|
|
action: allow
|
|
- name: k3s-api
|
|
port: 6443
|
|
proto: tcp
|
|
action: allow
|
|
sources: [] # tunnel-only (ADR-005); public allowlist stays empty
|
|
- name: flannel-vxlan
|
|
port: 8472
|
|
proto: udp
|
|
action: allow
|
|
sources: [] # omit while single-node; peer addresses only when multi-node
|
|
- name: nydus-ex-api
|
|
port: 2224
|
|
proto: tcp
|
|
action: allow
|
|
sources: anywhere # HostEurope provider agent; required by the VPS platform
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SSH daemon
|
|
# ---------------------------------------------------------------------------
|
|
ssh:
|
|
permit_root_login: "no"
|
|
password_authentication: "no"
|
|
pubkey_authentication: "yes"
|
|
challenge_response_authentication: "no"
|
|
# Hardening is applied via drop-in: /etc/ssh/sshd_config.d/10-hardening.conf
|
|
# The cloud image default sshd_config is left in place; the drop-in overrides it.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Services
|
|
# ---------------------------------------------------------------------------
|
|
services:
|
|
- name: ufw
|
|
enabled: true
|
|
running: true
|
|
- name: fail2ban
|
|
enabled: true
|
|
running: true
|
|
- name: ssh.socket
|
|
enabled: true
|
|
running: true
|
|
# Ubuntu 24.04 uses socket activation: ssh.service is disabled by design,
|
|
# triggered on demand by ssh.socket.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
packages:
|
|
installed:
|
|
- ufw
|
|
- fail2ban
|
|
- git
|
|
- curl
|
|
- vim
|
|
- htop
|
|
binaries:
|
|
# Installed to /usr/local/bin/ by the sops_agent role, not via apt
|
|
- age
|
|
- sops
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Users
|
|
# ---------------------------------------------------------------------------
|
|
users:
|
|
- name: tegwick
|
|
shell: /bin/bash
|
|
sudo: passwordless # NOPASSWD:ALL via /etc/sudoers.d/tegwick — NOT via sudo group
|
|
ssh_key_auth: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Security baseline
|
|
# ---------------------------------------------------------------------------
|
|
security:
|
|
histcontrol: ignorespace # set in /etc/profile.d/
|
|
fail2ban_jails:
|
|
- sshd
|