sjat
b006196cc5
established/related keeps the in-flight session alive across the swap, so the prior 'next task runs' confirm always passed even if new connections were bricked — the rollback was theater. reset_connection + wait_for_connection now force a fresh handshake through the new ruleset; failure aborts the play and the armed timer reverts. (meta: reset_connection ignores 'when' — benign extra reconnect on no-op runs; verified idempotent in molecule.)
9 lines
616 B
YAML
9 lines
616 B
YAML
---
|
|
# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
|
|
# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
|
|
base__firewall_mgmt_interface: wt0 # SSH accepted only on this iface (NetBird, ADR-016)
|
|
base__firewall_ssh_port: 22
|
|
base__firewall_rollback_timeout: 45 # seconds before the auto-revert fires on a bad apply
|
|
base__firewall_confirm_timeout: 20 # seconds to re-establish a fresh connection post-apply
|
|
base__firewall_dropin_dir: /etc/nftables.d
|
|
base__firewall_apply: true # set false to render+validate without applying (CI/Molecule)
|