b93af8cc78
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
63 lines
1.5 KiB
YAML
63 lines
1.5 KiB
YAML
# Executable S1 host baseline. scripts/baseline_contract.py resolves this model
|
|
# into the Ansible hostvars consumed by convergence and Goss verification.
|
|
version: "2.0"
|
|
|
|
defaults:
|
|
packages:
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- curl
|
|
- git
|
|
- vim
|
|
- htop
|
|
- ufw
|
|
- fail2ban
|
|
- python3
|
|
- python3-venv
|
|
services:
|
|
- fail2ban
|
|
- ssh.socket
|
|
ssh_directives:
|
|
PasswordAuthentication: "no"
|
|
PermitRootLogin: "no"
|
|
PubkeyAuthentication: "yes"
|
|
ChallengeResponseAuthentication: "no"
|
|
user:
|
|
name: tegwick
|
|
shell: /bin/bash
|
|
sudo: NOPASSWD
|
|
security:
|
|
histcontrol: ignorespace
|
|
fail2ban_jails:
|
|
- sshd
|
|
|
|
profiles:
|
|
ufw-managed:
|
|
services:
|
|
- ufw
|
|
firewall:
|
|
mode: ufw
|
|
managed: true
|
|
verification:
|
|
command: ufw status
|
|
stdout:
|
|
- "Status: active"
|
|
- "OpenSSH.*ALLOW"
|
|
|
|
external-firewall:
|
|
services: []
|
|
firewall:
|
|
mode: external
|
|
managed: false
|
|
replacement_control:
|
|
description: >-
|
|
CoulombCore retains its iptables INPUT default-drop policy and
|
|
Plesk-era accept list until that surface is fully declared for UFW.
|
|
owner: railiance-infra
|
|
removal_condition: >-
|
|
Replace this exception after every required listener is declared and
|
|
an attended UFW migration plan proves no availability regression.
|
|
verification:
|
|
command: iptables -S INPUT
|
|
stdout:
|
|
- "^-P INPUT DROP$"
|