windyboy
1f6d028ab5
Add playbooks/us4-firewalld.yml, a narrow reconciliation of the audited us4 public zone: fails closed on drift or unknown allowances, never reloads or restarts firewalld, and does not manage Docker rules. Requires explicit apply + provider-console confirmations, backs up the firewalld config and ruleset, schedules an automatic 15-minute rollback via at, and verifies SSH, HTTPS routes, containers, Fail2ban jails, and the WireGuard health check before cancelling rollback. Pins ansible.posix 2.2.2 in requirements.yml. Also expand hosts/us4.wsvc.info.md with deployment config and a live audit snapshot (2026-08-12).
6 lines
135 B
YAML
6 lines
135 B
YAML
---
|
|
collections:
|
|
# us4-firewalld.yml was source-reviewed and exercised with this version.
|
|
- name: ansible.posix
|
|
version: 2.2.2
|