windyboy
1f6d028ab5
Add playbooks/us4-firewalld.yml, a narrow reconciliation of the audited us4 public zone: fails closed on drift or unknown allowances, never reloads or restarts firewalld, and does not manage Docker rules. Requires explicit apply + provider-console confirmations, backs up the firewalld config and ruleset, schedules an automatic 15-minute rollback via at, and verifies SSH, HTTPS routes, containers, Fail2ban jails, and the WireGuard health check before cancelling rollback. Pins ansible.posix 2.2.2 in requirements.yml. Also expand hosts/us4.wsvc.info.md with deployment config and a live audit snapshot (2026-08-12).