95e3361598
The conformance checker existed but had not run since 2026-03-09, and its firewall assertion matched /6443\/tcp.*ALLOW/ - asserting the port was allowed but not from whom. It passed identically whether the API was restricted to one operator address or open to the entire internet, which is precisely the drift that went undetected. goss/baseline.yaml is now a template rendered per host from the same inventory declaration that converges the host, so the assertion cannot drift from what it checks. It asserts each declared source is present, that no revoked source retains access, and that 6443 is never ALLOW Anywhere. verify.yaml gained the vars_files the bootstrap play already had - without it the firewall assertions rendered empty and silently asserted nothing, which is worse than no check. Result on Railiance01: 32 assertions, 31 pass. The one failure is a real find and is recorded as T06 - Flannel VXLAN is declared open to Anywhere with no source restriction, the same defect pattern as the k3s rule. It is currently absent from the host, so converging would INTRODUCE the exposure rather than fix drift. Must be resolved before RAIL-BS-WP-0007 multi-node HA needs working VXLAN. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .githooks | ||
| ansible | ||
| capabilities/playbooks | ||
| cloudinit | ||
| contrib | ||
| docs | ||
| goss | ||
| hosteurope | ||
| infra/forgejo-restore-drill | ||
| inventory | ||
| keys | ||
| registry | ||
| reports | ||
| scripts | ||
| secrets | ||
| spec | ||
| state-hub-inbox | ||
| terraform/hetzner | ||
| tools | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| .sops.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| sbom-tools.yaml | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
railiance-infra
Tagline: Git-driven automation for secure, self-reliant servers.
railiance-infra is the canonical S1 ownership repo for the Railiance
infrastructure substrate. It provisions and manages servers on HostEurope and
Hetzner Cloud entirely from Git. It combines Terraform for lifecycle
management, cloud-init for first-boot configuration, and Ansible for
convergence. All secrets live in-repo encrypted with SOPS and are unlocked
with your single age master key (which you keep in your password manager).
The minimal server registry in inventory/servers.yaml is the source of truth.
Future reef-* repos will model purpose-bound substrate boundaries such as
reef-railiance or reef-ops-workstations, but the source-backed S1
inventory, hardening baseline, and OS convergence facts stay here.
Quickstart
- Clone Repo: clone the repo
- Prerequisites: terraform >= 1.7, ansible >= 2.16, age, sops.
- Secrets Management: Generate master key (age), provide it to sops and provide your SSH key.
- Setup Provider: Create account, select payment option, establish API token.
- Provisioning: Plan and apply
inventory/servers.yamlto add hosts with terraform. - Convergence: Setup security and tooling with ansible.
🚀 0. Clone Repo
First, clone this repository to your workstation:
git clone https://<your-gitea-host>/coulomb/railiance-infra.git
cd railiance-infra
📦 1. Prerequisites
To use railiance-infra, make sure you have the following tools installed on
your workstation:
- Git → for version control
- age → for key management and encryption (Install guide)
- SOPS → for managing encrypted secrets (SOPS GitHub)
- Terraform → for provisioning infrastructure (Terraform Downloads)
- Ansible → for server configuration (Ansible Installation Guide)
- Make → to run the included
Makefiletasks
Example installation (Ubuntu/Debian)
# System tools
sudo apt update
sudo apt install -y git make ansible
# Terraform
sudo apt install -y wget unzip
wget https://releases.hashicorp.com/terraform/1.9.5/terraform_1.9.5_linux_amd64.zip
unzip terraform_1.9.5_linux_amd64.zip
sudo mv terraform /usr/local/bin/
# age
sudo apt install age
# SOPS Get the latest release (example: v3.10.2 — check GitHub for updates)
wget https://github.com/getsops/sops/releases/download/v3.10.2/sops_3.10.2_amd64.deb
sudo apt install ./sops_3.10.2_amd64.deb
🔑 2. Secrets Management
Generate Age Masterkey and establish SOPS
This project uses SOPS with age for secret encryption.
To set up your own key and configure SOPS, follow the guide here:
SSH Access Preparations
Learn how to add your SSH key and test connectivity after provisioning:
➡️ SSH Access & Connectivity Test
TL;DR
- put your public key into keys/admin_ssh.pub
💻 3. Setup Provider
You need register an account and set it up for API access:
- register
- choose payment method
- generate api-key
- store api-key in secrets safely
🚀 4. Provisioning
How to declare hosts and bring them up on Hetzner:
TL;DR
- Define servers in inventory/servers.yaml (name, region, type, image, ssh_user, labels/role).
- Provision with make tf-apply (or make apply to also run Ansible).
- One-shot helper: scripts/hcloud_new_server.sh --type ... --region ....
💻 5. Convergence
After provisioning a server with Terraform, railiance-infra uses
Ansible to converge hosts into a secure,
baseline state.
This includes admin user setup, SSH hardening, firewall rules, essential tooling, and secret handling.
📖 See the full guide here: Convergence Documentation