3 commits

Author	SHA1	Message	Date
sjat	3b30e70ba5	feat(firewall): public zone + askari's public services in the catalog ... Adds a public (0.0.0.0/0) zone and askari's Caddy (80/443) + NetBird STUN (3478/udp) ingress so the base nftables default-deny does not drop the live public services when applied to askari. Molecule + filter unit test cover the public-zone rendering. Mesh-hardening 1/3 (ADR-020/024/016). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 20:46:03 +02:00
sjat	7dae93e4e1	fix(base): firewall resolver fails fast on empty/malformed sources; cover hosts: + proto default ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-06 18:56:04 +02:00
sjat	4127f8bc6b	feat(base): firewall catalog resolver filter plugin + tests ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-06 18:51:10 +02:00