branderson
eeecfd619c
One command. There is no install.sh: the sister repository split bootstrap from install, and the split produced two commands that had to be run in the right order with no host ever wanting one without the other. The path to the installed program is written in exactly one place. In the sister repository it was written in two, they disagreed, and a timer that had never worked on any host failed with 203/EXEC every time it fired without anyone noticing. Here the marker is substituted and then the result is checked for being executable before anything is enabled. It asks rather than assumes on addressing, and states what each mode costs at the boundary instead of choosing. It validates the forge hostname, warns rather than dies when the name does not resolve yet - the resolver rule may not be in place at this point in the runbook - and says plainly at the end that the firewall itself is not something a guest can apply to itself. That is the whole reason the rules are worth having. Smoke-tested end to end against stub directories and a stub systemctl: the program installs, both units are written with the marker substituted, the config is written, the audit runs once and correctly reports FAIL where no hypervisor rules exist.
27 lines
1.2 KiB
Plaintext
27 lines
1.2 KiB
Plaintext
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# Copyright (C) 2026 Brad Anderson
|
|
#
|
|
# Installed to /etc/dejima-devbox/config by dejima-devbox-bootstrap.
|
|
#
|
|
# One key, deliberately. Everything else the audit needs it takes from the
|
|
# machine: the gateway from the routing table, and whether the network works
|
|
# from whether the forge answers.
|
|
#
|
|
# There is no list here of what this VM must not reach, and there should never
|
|
# be one. Such a list is a map of valuable targets, kept on the machine this
|
|
# project assumes will be owned, describing topology that is not otherwise
|
|
# obtainable from here without loud scanning.
|
|
#
|
|
# This value must match the destination of the forge rules on the hypervisor.
|
|
# See proxmox/README.md, "Values that must agree". They are entered in two
|
|
# places and are silent when they disagree: the audit reports INDETERMINATE,
|
|
# which is correct and unhelpful.
|
|
|
|
# Prefer a name over an address. Both work, but `getent hosts` on an address
|
|
# is a reverse lookup, and a forge without a PTR record fails it - so the
|
|
# resolution control quietly stops contributing and only the TCP probe remains.
|
|
# Nothing breaks; the audit just has one fewer way to tell a filtered gateway
|
|
# from a dead network.
|
|
|
|
forge_host=forge.example.invalid
|