feat(us4): firewall audit + safe reconciliation playbook, host doc

windy/vps

Add playbooks/us4-firewalld.yml, a narrow reconciliation of the audited us4
public zone: fails closed on drift or unknown allowances, never reloads or
restarts firewalld, and does not manage Docker rules. Requires explicit
apply + provider-console confirmations, backs up the firewalld config and
ruleset, schedules an automatic 15-minute rollback via at, and verifies SSH,
HTTPS routes, containers, Fail2ban jails, and the WireGuard health check before
cancelling rollback. Pins ansible.posix 2.2.2 in requirements.yml.

Also expand hosts/us4.wsvc.info.md with deployment config and a live audit
snapshot (2026-08-12).

This commit is contained in:

windyboy

2026-08-12 21:16:31 +08:00

parent 035587e3bf

commit 1f6d028ab5

3 changed files with 594 additions and 1 deletions

									
										ansible/requirements.yml
									
		+5
		
												View File
												
				@@ -0,0 +1,5 @@

				---

				collections:

				  # us4-firewalld.yml was source-reviewed and exercised with this version.

				  - name: ansible.posix

				    version: 2.2.2