4 commits

Author	SHA1	Message	Date
sjat	b0511179cb	feat(tf/offsite): retire askari's WAN :22 (mesh-only SSH) ... The Hetzner Cloud Firewall SSH rule is now conditional on a non-empty ssh_admin_cidrs (default []); askari sets it empty so the WAN :22 rule is removed on the next apply. SSH is reached over wt0; break-glass is the Hetzner console. Apply is the live cutover (Task 5). Mesh-hardening 1/3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 20:51:24 +02:00
sjat	64f1e821d8	docs(review): 2026-06-14 repo audit — M4a doc drift + Traefik→Caddy lag ... 11 safe auto-fixes (docs/comments only): reverse_proxy meta stale DNS-01 description, base/playbooks/scripts/terraform/public_dns README build-state, CAPABILITIES reverse-proxy Traefik→Caddy, README ADR list → 024, TF cax11→cx23 stamps, public_dns wildcard DNS-01→HTTP-01 comment. 29 open findings reported. make lint green. No stale-deferred (ADR-011 open questions still open). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 18:37:54 +02:00
sjat	1ee343dfca	feat(tf): open Caddy 80/443 + NetBird 3478 on askari (public_web) ... hetzner_vm gains a public_web bool (default false); offsite sets it true. Firewall adds 80/443 tcp + 3478 udp from anywhere (SSH-from-ubongo preserved). For M4 Caddy + NetBird. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 17:38:51 +02:00
sjat	bbc287900a	feat(tf): hetzner_vm module (server + firewall + ssh key + cloud-init) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 12:03:01 +02:00