coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Orientation §2: bao.coulomb.social now serves a trusted notice page (RPF-WP-0047)
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-09-24 02:22:02 +02:00
parent 1e37bcda18
commit 2120e7d887
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/agent-environment-orientation.md
View file

@ -1,7 +1,7 @@
# Agent environment orientation
**Audience:** every coding agent working in this estate (Claude Code, Codex, Grok, custodian workers). It is tool-neutral.
**Owner:** the-custodian. **Last verified:** 2026-09-23.
**Owner:** the-custodian. **Last verified:** 2026-09-24.
These are facts about the *environment*: where things run, how to reach them, and the traps that cost real time. Each section names its owner. When a fact changes, fix it here and in the owner's record.
@ -31,7 +31,7 @@ Services are private by default (railiance-master ADR-0008) and are reached thro
| OpenBao | `http://127.0.0.1:18200` (in-cluster: `openbao.openbao.svc:8200`) | `openbao-ui-railiance01` |
| k3s API | `https://127.0.0.1:16444` (`~/.kube/config` → `config-railiance01`) | `k3s-api-railiance01` |
**Retired name:** `bao.coulomb.social` is **retired**, not a trap to work around. Its public Ingress was retracted on 2026-09-15 (railiance-master RMASTER-WP-0020-T09); the self-signed Traefik cert and the 404 are leftovers of a dangling DNS record, and DNS withdrawal sits with railiance-infra. No certificate or route will be restored (railiance-platform RPF-WP-0025-T03). Operators use the tunnel `http://127.0.0.1:18200`, which `~/.bashrc` has exported as `BAO_ADDR`/`VAULT_ADDR` since 2026-09-22; workloads use `openbao.openbao.svc:8200`. A shell opened before that change still needs the prefix. Whether operators should be able to reach management surfaces at all from a device without an SSH certificate is an open question, parked in [`inner-zone-access-without-a-company-network.md`](inner-zone-access-without-a-company-network.md).
**Not a trap, a notice page:** `bao.coulomb.social` is **not** the OpenBao UI and never will be again. Since 2026-09-23 it serves a static "Not publicly available" page (railiance-platform RPF-WP-0047) on a Let's Encrypt certificate, in an isolated namespace with no egress: `/` returns 200, every other path returns 404, and `http://` redirects to `https://`. Verified from outside on 2026-09-24. Its public Ingress to OpenBao was retracted on 2026-09-15 (RMASTER-WP-0020-T09, RPF-WP-0025-T03), and DNS withdrawal is cancelled. Operators use the tunnel `http://127.0.0.1:18200` — the full web UI is there at `/ui/`, nothing was made headless — which `~/.bashrc` has exported as `BAO_ADDR`/`VAULT_ADDR` since 2026-09-22; workloads use `openbao.openbao.svc:8200`. A shell opened before that change still needs the prefix.
## 3. Permissions and the agent harness (Claude Code)

7
docs/inner-zone-access-without-a-company-network.md
View file

@ -59,6 +59,7 @@ is the default posture and there is no considered answer for BYOD access.
The retraction stands. The OpenBao UI is unchanged and reachable through the
`openbao-ui-railiance01` tunnel at `http://127.0.0.1:18200/ui/`; nothing was made
headless. Separately, `bao.coulomb.social` is to stop serving a broken-looking
TLS error and serve a plain "not publicly available" page instead — requested of
railiance-platform on 2026-09-23, tracked there, and not part of this question.
headless. Separately, `bao.coulomb.social` now serves a plain "not publicly available"
page on a trusted certificate instead of a self-signed TLS error (railiance-platform
RPF-WP-0047, live 2026-09-23, verified from outside 2026-09-24). That closed the
broken-looking surface; it did not answer this question.