railiance-infra/workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RAIL-HO-WP-0010	workplan	New reefs do not get 80/443 until a substrate grant exists	financials	railiance-infra	finished	codex	railiance	2026-08-15	2026-08-22	RMASTER-WP-0023 RAIL-HO-WP-0009 ADR-0008	9eed7d88-27a5-4fbe-b405-2a40aae832f3

RAIL-HO-WP-0010 — new-reef host ports

Intake from RMASTER-WP-0023-T05.

Goal

Host surface for new reefs: do not open 80/443 until the reef declaration carries a public substrate grant. 6443 stays operator-only (RAIL-HO-WP-0009). This is not the rapp admission desk. Nydus 2224 stays a named exception.

T01 — Fail-closed new-reef UFW

id: RAIL-HO-WP-0010-T01
status: done
priority: high
state_hub_task_id: "f4cc01f8-5b5e-4693-b389-9bd81e26a799"

Bootstrap / inventory for a new reef starts with SSH (and Nydus only if the provider requires it). 80/443 require a cited reef grant. Do not add per-rapp UFW rules on a shared ingress host.

Done when: a new reef playbook cannot open 80/443 without naming the grant, and 6443 cannot be opened by this path.

Outcome (2026-08-22): the base role now rejects 80/443 in generic UFW extras and delegates public-web admission to a reef declaration validator. Only ports 80 and 443 are accepted, each must have a matching public substrate grant with reason, approval date, and owner, and 6443 is unconditionally rejected. Goss receives only the resulting grant-backed port list.

Completion evidence

• python3 -m unittest discover -s tests -v: 5 tests passed.
• Live source validation against reef-railiance/declarations/reef.yaml for ports 80 and 443: passed.
• Ansible syntax validation remains unavailable on this workstation because ansible-playbook is not installed; no live firewall change was applied.