0 Fork 0

Files

T

jakman85andClaude Opus 4.8 1c4d86319c vpn_egress_gateway: retain nft src set on tunnel-down (explicit fail-closed backstop)

The down-script previously flushed the kill-switch source set on tunnel-down, which
disarmed the 'ip saddr @vpn_egress_gateway_src oifname != tun0 drop' rule exactly when
the tunnel was down — leaving fail-closed to ride only on the stale SNAT source being
non-routable (could leak if the edge NATed it). Retain the set instead: the drop rule
stays armed so any vpn-class packet leaving the WAN while the tunnel is down is EXPLICITLY
dropped (edge-independent). Safe because the up-script flush+re-adds the source on every
reconnect. Validated behavior: WS-NET fault-injection on k3s-dev-3 (2026-08-24).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-24 13:10:40 -05:00

ansible

vpn_egress_gateway: retain nft src set on tunnel-down (explicit fail-closed backstop)

2026-08-24 13:10:40 -05:00

cloud-init

Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

2026-08-16 01:21:00 -05:00

devcontainer

devcontainer: set KUBECONFIG + persist SOPS age key to host

2026-08-16 22:31:51 -05:00

tofu

iac: harden node lifecycle — tofu for_each + self-contained ansible rejoin

2026-08-16 19:42:12 -05:00

cluster.sh

Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

2026-08-16 02:18:39 -05:00

PHASE1-SCOPE.md

Phase 1: host Gitea as the bootstrap GitOps source (resolves source-URL)

2026-08-16 01:26:47 -05:00

PHASE1-STATUS.md

Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

2026-08-16 02:18:39 -05:00

README.md

Scope Phase 1: dev/test cluster bring-up on local KVM

2026-08-16 00:48:48 -05:00

README.md

infra/ — Phase 1 node provisioning (local KVM)

OpenTofu (libvirt) + cloud-init + Ansible bring up the 3-node k3s/Cilium cluster. See PHASE1-SCOPE.md. Spec: ../home-network-k3s/docs/02-environments-and-provisioning.md.