4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
1.7 KiB
1.7 KiB
🔧 Server Convergence
After provisioning servers with Terraform, railiance-infra uses Ansible
to bring them into a secure and usable baseline state.
This process is called convergence.
What Convergence Does
When you run make converge, Ansible connects to all declared hosts and applies baseline roles:
- User setup → ensures the
adminuser exists with your SSH key and passwordless sudo - Firewall → configures
ufwwith deny incoming, SSH, declared extras (Nydus), and a tunnel-only k3s API (ADR-005). Usemake converge-firewall HOST=Railiance01to apply only those tasks. - Hardening → basic SSH daemon hardening, disable root login, disable password auth
- Tooling → installs essential packages (htop, vim, git, curl, fail2ban, etc.)
- SOPS agent → ensures decryption tooling (
age,sops) is available on the host
Running Convergence
make converge
This will:
- Decrypt secrets locally (with your age key)
- Run the Ansible playbooks against all hosts in your
inventory/servers.yaml - Apply the baseline security and tooling configuration
Verifying
After convergence, run the automated test suite to assert the node matches the baseline spec:
make verify
This runs Goss assertions against all hosts and exits non-zero on failure.
TAP reports are written to reports/. See docs/verification.md for details.
For a quick human-readable summary without assertions:
make status
Notes
- Convergence is idempotent: re-running it will not break your server.
- Only your workstation (control node) needs the age private key; hosts never see it.
- Additional roles (e.g. WireGuard, Kubernetes, apps) can be layered later.