sjat
39d2ad38ca
base__ssh_listen_mesh_only binds sshd to the live wt0 IP only, with
ip_nonlocal_bind to beat the post-boot bind race and a fail-closed assert so an
unresolved address never silently listens on all interfaces. Molecule covers
the render + sysctl. Mesh-hardening 1/3 (ADR-016/021).
Environmental checkpoint applied: the molecule-debian13 container image lacks
procps (no sysctl binary). Added molecule/default/prepare.yml to install procps
and sysctls: {net.ipv4.ip_nonlocal_bind: "0"} to molecule.yml platform so the
ansible.posix.sysctl task can write and read back the value hermetically.
Sysctl file format is net.ipv4.ip_nonlocal_bind=1 (no spaces); verify.yml
grep pattern updated to match ansible.posix.sysctl's actual output.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
2.3 KiB
YAML
40 lines
2.3 KiB
YAML
---
|
|
# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
|
|
# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
|
|
base__firewall_mgmt_interface: wt0 # SSH accepted only on this iface (NetBird, ADR-016)
|
|
base__firewall_control_addr: "" # control-node LAN address (ubongo); SSH allowed from it
|
|
# as the guaranteed-management-plane `ssh-from-control`
|
|
# source (ADR-021). Empty = no rule. Set in group_vars
|
|
# once ubongo exists.
|
|
base__firewall_ssh_port: 22
|
|
base__firewall_rollback_timeout: 45 # seconds before the auto-revert fires on a bad apply
|
|
base__firewall_confirm_timeout: 20 # seconds to re-establish a fresh connection post-apply
|
|
base__firewall_dropin_dir: /etc/nftables.d
|
|
base__firewall_apply: true # set false to render+validate without applying (CI/Molecule)
|
|
|
|
# SSH hardening + fail2ban (ADR-002) — `hardening` concern.
|
|
base__ssh_password_authentication: "no"
|
|
base__ssh_permit_root_login: "no"
|
|
base__fail2ban_maxretry: 5
|
|
base__fail2ban_bantime: 1h
|
|
base__fail2ban_findtime: 10m
|
|
# base__ssh_authorised_keys lives in group_vars/all/vars.yml (per-person control keys).
|
|
base__ssh_authorised_keys: []
|
|
|
|
# SSH listen-on-mesh (mesh-hardening 1/3, ADR-016/021). Opt-in: when true, sshd binds
|
|
# ListenAddress to this host's mesh IP only (not the WAN). The IP comes from the live wt0
|
|
# fact (ansible_facts.wt0.ipv4.address); base__ssh_listen_addr overrides it. ip_nonlocal_bind
|
|
# lets sshd bind the mesh IP before wt0 exists at boot. Fails closed: the play asserts a
|
|
# non-empty address rather than silently listening on all interfaces.
|
|
base__ssh_listen_mesh_only: false
|
|
base__ssh_listen_addr: ""
|
|
|
|
# NetBird mesh agent enrollment (ADR-016). Opt-in: default off so applying `base` to a
|
|
# host not on the mesh is a no-op for this concern. The live actions (apt install over
|
|
# the network, `netbird up` against the coordinator) are additionally gated by
|
|
# base__mesh_manage so Molecule can exercise the wiring without a coordinator.
|
|
base__mesh_enabled: false
|
|
base__mesh_manage: true
|
|
base__mesh_management_url: "https://netbird.askari.wingu.me"
|
|
base__mesh_setup_key: "{{ vault.netbird.setup_key }}"
|
|
base__mesh_version: "0.72.4" # match the coordinator; exact apt pin confirmed on-host at deploy
|