c3486be3c2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
109 lines
4.3 KiB
Markdown
109 lines
4.3 KiB
Markdown
---
|
|
id: RPF-WP-0047
|
|
type: workplan
|
|
title: "bao.coulomb.social: static not-publicly-available page with a trusted certificate"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: railiance-platform
|
|
topic_slug: railiance
|
|
created: "2026-09-24"
|
|
updated: "2026-09-24"
|
|
related: [RPF-WP-0025, RMASTER-WP-0020]
|
|
state_hub_workstream_id: "6ab44339-66d3-522b-9d34-fc9ff6f20d1b"
|
|
---
|
|
|
|
## Why
|
|
|
|
The founder decided on 2026-09-23 (relayed by user-engine, hub message
|
|
`7d8982c2`) that OpenBao stays non-public. The RMASTER-WP-0020-T09 /
|
|
RPF-WP-0025-T03 retraction stands. But the published name must not present a
|
|
self-signed Traefik certificate and a bare 404. **Requested end state:** a
|
|
static page saying the resource is not publicly available, over a trusted
|
|
certificate. It names no internal host, port, tunnel or version, offers no
|
|
login form or redirect, and proxies nothing to OpenBao. This reverses the DNS
|
|
withdrawal handed to railiance-infra on 2026-09-22; a hold was sent
|
|
(`a4bca724`). A static notice is not an exposure grant under ADR-0008.
|
|
|
|
## T01 Build the page and manifests
|
|
|
|
```task
|
|
id: RPF-WP-0047-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "caa019c6-dfdb-5f17-b860-67e1feaebd51"
|
|
```
|
|
|
|
`argocd/platform-addons/bao-notice/` holds:
|
|
|
|
- A namespace `bao-notice` with a NetworkPolicy: ingress only from Traefik
|
|
(kube-system) on 8080, no egress at all, so there is no path to OpenBao.
|
|
- Nginx `nginxinc/nginx-unprivileged` pinned by digest (already running in
|
|
the cluster), running non-root with a read-only root filesystem and all
|
|
capabilities dropped.
|
|
- `/` returns 200 with the notice. Every other path returns 404 with the same
|
|
notice, so a probe of `/v1/sys/health` is never a false 200.
|
|
- `server_tokens off`, CSP `default-src 'none'`, `noindex`, `no-store`.
|
|
- An Ingress on `websecure` with `letsencrypt-prod`, and an HTTP→HTTPS
|
|
redirect at priority 1, so ACME HTTP-01 still wins.
|
|
|
|
Verified on 2026-09-24:
|
|
- Local container probe: `/` 200, `/v1/sys/health` and `/ui/` 404 with the
|
|
notice, `Server: nginx` with no version.
|
|
- Server-side dry run on railiance01: all eight objects valid.
|
|
- No existing Ingress claims the host.
|
|
- The `railiance-tenants` AppProject already whitelists every kind.
|
|
|
|
## T02 Adopt through ArgoCD (live, founder go-ahead)
|
|
|
|
```task
|
|
id: RPF-WP-0047-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3af7f95f-4689-547e-90dc-529e65c7b9e2"
|
|
```
|
|
|
|
The Application is `argocd/railiance01/applications/bao-notice.application.yaml`,
|
|
pinned to `960ed09`. Sync the root by hand to create it, then sync
|
|
`bao-notice` by hand. cert-manager issues `bao-notice-tls` over HTTP-01.
|
|
|
|
## T03 Verify from outside and close the loop
|
|
|
|
```task
|
|
id: RPF-WP-0047-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "26bf3291-e74e-51dd-89e5-c38169d471b0"
|
|
```
|
|
|
|
From the workstation: `curl -sv https://bao.coulomb.social/` must show a
|
|
trusted chain with no `-k`, HTTP 200 and the notice.
|
|
`https://bao.coulomb.social/v1/sys/health` must return 404, and
|
|
`http://bao.coulomb.social/` must redirect to https. Record the evidence, then
|
|
tell user-engine, railiance-infra (keep the A record) and railiance-master
|
|
(T09 posture unchanged).
|
|
|
|
## Rollback
|
|
|
|
Delete the `bao-notice` Application with prune. That restores today's state:
|
|
the Traefik default certificate and a 404.
|
|
|
|
## Execution record — 2026-09-23/24 (founder go-ahead)
|
|
|
|
- **T02 done.** The root and `bao-notice` were hand-synced; the app is
|
|
Synced/Healthy.
|
|
- **First issuance returned 502 on the HTTP-01 challenge.** The isolation
|
|
NetworkPolicy also covered cert-manager's solver pod (port 8089). Fixed by a
|
|
narrow `bao-notice-acme-solver` policy, Traefik to solver pods on 8089 only,
|
|
and `bao-notice-tls` was issued.
|
|
- **HSTS added** (`max-age=31536000`, this host only). The single-replica pod
|
|
swap caused a few seconds of 502 through Traefik.
|
|
- **T03 done.** Checked from the workstation with no `-k`:
|
|
- Certificate `CN=bao.coulomb.social` from Let's Encrypt, verify ok, expires
|
|
2026-12-22 (cert-manager renews).
|
|
- `/` returns 200 with the notice; `/v1/sys/health` and `/ui/` return 404;
|
|
`http://` returns a 301 to https.
|
|
- HSTS and CSP `default-src 'none'` are set, and the `Server` header carries
|
|
no version.
|
|
- No internal identifiers, form or redirect in the body.
|
|
- Evidence: `docs/evidence/2026-09-24-bao-coulomb-social-notice.json`.
|