dejima-devbox-hardener

T

branderson fa25e2049b Assert against a real devbox, and skip loudly everywhere else

Gated on DEJIMA_DEVBOX rather than on detecting a devbox. A detector that guesses wrong skips silently, and a suite passing by asserting nothing is worse than one that fails, because the first gets believed. The sister repository has DEJIMA_CI_TIER for the same reason, added after a job landed on the wrong runner and quietly checked nothing.

Three of the seven are not in the plan and earn their place. The unit's ExecStart is resolved from systemctl and checked for being executable, which is the 203/EXEC failure caught on a real host rather than in a template. The service is checked for running reach and not all, because a timer running the credential inventory would accumulate it in the journal where it outlives the run. And the public internet is checked as reachable, because without it the gateway assertion passes on a machine with no network at all: PASS has to mean contained, not unplugged.

2026-08-09 23:22:35 -07:00

.dejima

Start the repository with the guard that keeps real addresses out

2026-08-09 22:56:43 -07:00

bin

Add the single entry point, which verifies what it writes

2026-08-09 23:21:24 -07:00

etc

Add the single entry point, which verifies what it writes

2026-08-09 23:21:24 -07:00

proxmox

Report what root on this box would get, without printing any of it