boma/tests/integration/overrides/askari.yml

---
# Integration-test overlay for the "askari" profile (ADR-025). Passed via `-e @`.
# Reproduces the 2026-06-17 incident: apply base's nftables default-deny to a Docker host.
integration_profile: askari
base__firewall_apply: true
# Keep a break-glass: sshd stays on all interfaces (never wt0-only in a throwaway VM).
base__ssh_listen_mesh_only: false
# The VM is isolated; it must never touch the real mesh.
base__mesh_enabled: false
# Allow SSH from the VM's libvirt-NAT gateway (where the driver/ansible connects from),
# so base's default-deny firewall + the reboot don't lock out the harness. By source IP,
# so it's interface-independent. Overrides askari's real control addr for the test only.
base__firewall_control_addr: "192.168.150.1"
feat(integration): askari profile, stub overlay, cert-tier files Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-06-18 12:37:32 +02:00			`---`
			# Integration-test overlay for the "askari" profile (ADR-025). Passed via `-e @`.
			`# Reproduces the 2026-06-17 incident: apply base's nftables default-deny to a Docker host.`
test(integration): add the 'be ubongo' profile (input-only default-deny) A control-group VM that applies base with INPUT-only default-deny (forward policy accept; admin-addr SSH allow). verify.yml is now profile-aware via an integration_profile marker — the askari Docker/DNAT block is gated, and a ubongo block asserts input drop + forward accept + the admin-addr rule. Enables `make test-integration HOST=ubongo`. Mesh-hardening 2/3 (ADR-025). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-19 09:47:03 +02:00			`integration_profile: askari`
feat(integration): askari profile, stub overlay, cert-tier files Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-06-18 12:37:32 +02:00			`base__firewall_apply: true`
			`# Keep a break-glass: sshd stays on all interfaces (never wt0-only in a throwaway VM).`
			`base__ssh_listen_mesh_only: false`
			`# The VM is isolated; it must never touch the real mesh.`
			`base__mesh_enabled: false`
feat(integration): allow SSH from the NAT gateway in the askari overlay base's default-deny firewall would drop the driver's post-reboot SSH from the libvirt NAT gateway; set base__firewall_control_addr to the gateway (by source IP, interface-independent). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-18 16:35:15 +02:00			`# Allow SSH from the VM's libvirt-NAT gateway (where the driver/ansible connects from),`
			`# so base's default-deny firewall + the reboot don't lock out the harness. By source IP,`
			`# so it's interface-independent. Overrides askari's real control addr for the test only.`
			`base__firewall_control_addr: "192.168.150.1"`