4 commits

Author	SHA1	Message	Date
sjat	b0511179cb	feat(tf/offsite): retire askari's WAN :22 (mesh-only SSH) ... The Hetzner Cloud Firewall SSH rule is now conditional on a non-empty ssh_admin_cidrs (default []); askari sets it empty so the WAN :22 rule is removed on the next apply. SSH is reached over wt0; break-glass is the Hetzner console. Apply is the live cutover (Task 5). Mesh-hardening 1/3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 20:51:24 +02:00
sjat	1ee343dfca	feat(tf): open Caddy 80/443 + NetBird 3478 on askari (public_web) ... hetzner_vm gains a public_web bool (default false); offsite sets it true. Firewall adds 80/443 tcp + 3478 udp from anywhere (SSH-from-ubongo preserved). For M4 Caddy + NetBird. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 17:38:51 +02:00
sjat	917005174a	feat(tf): provision askari — cx23/hel1 (CAX11 ARM was out of stock) ... ARM (cax11) unavailable in all EU locations 2026-06-14; fell back to cx23 (x86, same 2/4/40 spec, cheaper in hel1). Server created (id 141153963); offsite.yml generated into the directory inventory. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 16:23:01 +02:00
sjat	127ade59a3	feat(tf): offsite environment — askari (CAX11/hel1/debian-13) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 12:03:31 +02:00