sjat
402913efb3
Bare 'nft list ruleset' has no leading flush, so the timer's 'nft -f rollback'
was a no-op on first apply (empty file) and errored ('table exists') on later
applies — the auto-rollback silently did nothing, defeating the askari lockout
safeguard. Prepend 'flush ruleset' so the revert is atomic + self-contained.
Verified the snapshot->lockout->revert round-trip in an isolated netns.
Also fix stale STATUS prose (base is partially built, not absent).
|
||
|---|---|---|
| .. | ||
| base | ||
| README.md | ||
roles/
Local Ansible roles. No Galaxy roles — every role is written and maintained here
(ADR-003). Scaffold new ones with make new-role NAME=<name>; never create the
directory structure by hand.
Each role must have: a molecule/default/ scenario (Debian 13), a populated
README.md, and a filled-in meta/main.yml. Conventions: CLAUDE.md and
docs/runbooks/new-role.md.
Current state: base and docker_host are not built yet — they exist only as
empty, untracked dirs, so site.yml would fail on a clean clone. Build them with
make new-role when defining the baseline. See STATUS.md.