7d1e1839a8
Merge pull request 'Describe how the GitHub mirror shows the wordmark' (#30) from github-mirror into main
main
branderson2026-10-14 17:33:20 -07:00
12a04f244e
Merge pull request 'Stop reporting ephemeral sockets as listeners' (#28) from ephemeral-ports into main
branderson2026-09-03 11:48:26 -07:00
88c1521b32
Merge pull request 'Tell a state file it cannot read from one that is not there' (#29) from status-permission into main
branderson2026-09-03 11:43:54 -07:00
40276fdb0a
Stop reporting ephemeral sockets as listeners
branderson2026-09-03 11:31:36 -07:00
762282b0d4
Merge pull request 'Write down that a typed value is a defect, not a documentation problem' (#27) from typed-values into main
branderson2026-09-01 23:40:51 -07:00
622068a651
Merge pull request 'Describe the workflow this repository has, not the one it was copied from' (#26) from ci-tests into main
branderson2026-08-29 16:43:21 -07:00
a41e504c0a
Describe the workflow this repository has, not the one it was copied from
ci-tests
branderson2026-08-29 16:35:19 -07:00
4b9589fb86
Merge pull request 'Say what the guard's commands look like in a container' (#25) from guard-container-form into main
branderson2026-08-29 16:30:35 -07:00
8a183f070a
Watch the persistence that does not need root
branderson2026-08-29 15:14:37 -07:00
a81eba16c0
Merge pull request 'Point at dejima-guard, now that there is somewhere to point' (#23) from guard-pitch into main
branderson2026-08-29 14:20:59 -07:00
da38aea73f
Merge pull request 'Let dejima-guard collect from this devbox, without giving it a shell' (#22) from guard-access into main
branderson2026-08-29 14:10:58 -07:00
fddbeb119e
Drop the em-dashes, and repair the table one of them was holding up
branderson2026-08-29 01:49:32 -07:00
077af789d4
Tag escaped filenames, and cut prose that says a thing twice
branderson2026-08-28 21:44:27 -07:00
5ec2d22b88
Use a placeholder account in the sudoers example
branderson2026-08-28 20:17:41 -07:00
58908e8b5c
Install the guard's key from the machine that has it
branderson2026-08-28 18:12:04 -07:00
1ab684411c
Fix v5 telling you to run a copy of the tool that has never heard of v5
branderson2026-08-28 17:57:00 -07:00
2884608066
Let dejima-guard collect from this devbox, without giving it a shell
branderson2026-08-28 16:34:00 -07:00
d22d08ff99
Merge pull request 'Let the audit emit its state, for a watcher that keeps the baseline elsewhere' (#21) from watch-state into main
branderson2026-08-28 01:04:47 -07:00
23e1c247f7
Let the audit emit its state, for a watcher that keeps the baseline elsewhere
watch-state
branderson2026-08-27 23:55:45 -07:00
f76e8a11eb
Merge pull request 'The audit reports what changed, and the node logs what it dropped' (#19) from intrusion-detection into main
branderson2026-08-27 23:36:13 -07:00
872749797b
Treat devbox downtime as a scheduled event, and stop burying the how-to
branderson2026-08-27 22:17:44 -07:00
31c462a249
Do not assume /usr/local/sbin is on the PATH sudo hands you
branderson2026-08-27 20:47:30 -07:00
71f6b0aabb
Link the upgrade docs from the README, as a flow rather than a mention
branderson2026-08-27 20:26:36 -07:00
cc8ee744e7
v4 claimed a check that checks something else, and never recorded its node half
branderson2026-08-27 20:10:02 -07:00
ca41c94ebd
Let the upgrade tool find its own checks, and tell "cannot" from "failed"
branderson2026-08-27 17:41:15 -07:00
70f03c49ab
Report what changed, and log what the node dropped
branderson2026-08-27 03:52:14 -07:00
fe22e8f9d6
Merge pull request 'Version the deployed state, and pinhole ntfy' (#20) from versioning into main
branderson2026-08-27 21:45:28 -07:00
0b7751e20e
Merge main into versioning: keep main's ntfy work, keep the restructure
versioning
branderson2026-08-27 21:43:30 -07:00
cb6fa9bc00
Merge pull request 'A pinhole for dejima's remote-access notifications' (#18) from ntfy-pinhole into versioning
branderson2026-08-27 21:33:21 -07:00
928a797d00
Merge pull request 'Version the deployed state, so an existing devbox can be brought forward' (#17) from versioning into ipv6-boundary
ipv6-boundary
branderson2026-08-27 21:32:25 -07:00
50a37c52a2
Give the runbook a map, and put the reasoning after the doing
branderson2026-08-27 03:06:46 -07:00
10a152f953
Front-load the prose, and stop restating the same arguments
branderson2026-08-27 02:45:43 -07:00
7dc48c794d
Merge pull request 'Bound the LAN over IPv6, and over the range a tailnet uses' (#16) from ipv6-boundary into main
branderson2026-08-26 00:48:32 -07:00
1115da28eb
Generalise the pinhole to one port per service
branderson2026-08-26 00:39:52 -07:00
57624be642
The ntfy pinhole reaches a proxy, not a service, and says so
branderson2026-08-26 00:09:50 -07:00
499276322a
A pinhole for dejima's remote-access notifications
branderson2026-08-25 23:41:15 -07:00
29eddfaf61
Finish the v2 note: confirm the result, and say where to run it from
branderson2026-08-25 17:16:07 -07:00
a8569baf1b
Version the deployed state, so an existing devbox can be brought forward
branderson2026-08-25 15:36:04 -07:00
8b253765cb
Describe the boundary as it is, not as it changed
branderson2026-08-25 16:38:40 -07:00
7cba3932c2
Bound the LAN over IPv6, and over the range a tailnet uses
branderson2026-08-25 14:40:23 -07:00
a64cbb93b9
Merge pull request 'Specify an AVX2-capable CPU type at VM creation' (#15) from cpu-type into main
branderson2026-08-24 20:54:05 -07:00
98c4c98532
Specify an AVX2-capable CPU type at VM creation
branderson2026-08-24 20:20:55 -07:00
6fadacb3bf
Merge pull request 'Say that the harness is installed and signed in here, before dejima runs' (#13) from harness-prerequisite into main
branderson2026-08-17 18:43:25 -07:00
f0b4a50dbc
Merge pull request 'Say what dejima's notifications cost, before someone pays it' (#12) from ntfy-runbook into main
branderson2026-08-17 18:37:57 -07:00
54085211c6
Say that the harness is installed and signed in here, before dejima runs
branderson2026-08-17 15:14:15 -07:00
1d1c09addd
Put the notify service where it actually runs, and drop http2
branderson2026-08-17 15:12:14 -07:00
ce445fc8f4
Say what dejima's notifications cost, before someone pays it
branderson2026-08-17 14:56:57 -07:00
1f75dd422a
Merge pull request 'Hand off with dejima's dependencies met and its source on the box' (#11) from dejima-handoff into main
branderson2026-08-17 00:23:39 -07:00
652629e681
Merge pull request 'Report findings, not reasoning, and fix the kernel currency check' (#10) from audit-output into main
branderson2026-08-16 21:51:28 -07:00
b382a92724
Merge pull request 'Send the reader between the two halves, in the order that works' (#9) from runbook-order into main
branderson2026-08-11 20:37:58 -07:00
5b06aeccb2
Merge pull request 'Say when the audit is describing the wrong machine' (#6) from container-banner into main
branderson2026-08-11 18:36:28 -07:00
2f499914ef
Merge pull request 'Say which way the console orders rules, and fix the numbering' (#5) from console-order into main
branderson2026-08-11 18:32:22 -07:00
65a2281645
Merge pull request 'Correct the escape argument, and record that dejima closed poisoning' (#4) from threat-model-accuracy into main
branderson2026-08-11 18:29:46 -07:00
5e7bfc6aa9
Merge pull request 'Carry dejima's canonical statements: the disclaimer, and the push rule' (#8) from maturity-disclaimer into main
branderson2026-08-10 21:05:05 -07:00
d61924f731
Merge pull request 'Report the addressing mode, and catch a lease that stopped renewing' (#3) from lease-health into main
branderson2026-08-10 17:44:54 -07:00
9b029f96ea
Merge pull request 'Check that the confined tier is what CI actually got' (#2) from runner-env into main
branderson2026-08-10 00:02:39 -07:00
4b5f199f43
Check that the confined tier is what this job actually got
branderson2026-08-09 23:51:29 -07:00
5dfb5ca753
Merge pull request 'Guard the documentation links, which review cannot check' (#1) from link-guard into main
branderson2026-08-09 23:47:44 -07:00
4f151fa42a
Guard the documentation links, which review cannot check
branderson2026-08-09 23:45:04 -07:00
branderson