From e32b267f18f306c11c3cda36886f8bfbda0a3d04 Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Tue, 19 May 2026 15:57:49 +1000 Subject: [PATCH] chore: docs debian 12 -> 13 --- docs/DESIGN.md | 6 +++--- docs/security/malware-protection/README.md | 4 ++-- scripts/iac/proxmox/README.md | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/DESIGN.md b/docs/DESIGN.md index 1cace99cd..7212c5879 100644 --- a/docs/DESIGN.md +++ b/docs/DESIGN.md @@ -16,14 +16,14 @@ Users interact with Spinifex using standard AWS SDKs or the AWS CLI by using the ```bash AWS_PROFILE=spinifex aws ec2 run-instances \ - --image-id ami-debian12 \ + --image-id ami-debian13 \ --instance-type t3.micro \ --key-name my-keypair ``` The AWS SDK formats this as an HTTPS POST with: - AWS SigV4 authentication headers -- EC2 Query Protocol body (`Action=RunInstances&ImageId=ami-debian12&...`) +- EC2 Query Protocol body (`Action=RunInstances&ImageId=ami-debian13&...`) ### 2. AWS Gateway @@ -297,7 +297,7 @@ sudo systemctl start spinifex.target export AWS_PROFILE=spinifex # Run instance -aws ec2 run-instances --image-id ami-debian12 --instance-type t3.micro +aws ec2 run-instances --image-id ami-debian13 --instance-type t3.micro # List instances (queries all nodes) aws ec2 describe-instances diff --git a/docs/security/malware-protection/README.md b/docs/security/malware-protection/README.md index 8415f99dd..e40b87359 100644 --- a/docs/security/malware-protection/README.md +++ b/docs/security/malware-protection/README.md @@ -73,7 +73,7 @@ All Spinifex nodes must include the following in their malware protection scope. |------|----------| | `/usr/local/bin/spx` | Spinifex CLI and service entry point. All `spinifex-*.service` units invoke `spx service start`, so every service binary is reached through this one path. | | `/usr/bin/ovn-*`, `/usr/bin/ovs-*` | OVN / OVS control-plane and datapath binaries (installed via `apt` from the `ovn-central`, `ovn-host`, `openvswitch-switch` packages). | -| `/usr/lib/-linux-gnu/nbdkit/plugins/nbdkit-viperblock-plugin.so` | Viperblock NBD plugin loaded by `nbdkit` to expose EBS volumes as block devices. The exact path comes from `nbdkit --dump-config` (`plugindir=`); on Debian 12 amd64 it is `/usr/lib/x86_64-linux-gnu/nbdkit/plugins/`. | +| `/usr/lib/-linux-gnu/nbdkit/plugins/nbdkit-viperblock-plugin.so` | Viperblock NBD plugin loaded by `nbdkit` to expose EBS volumes as block devices. The exact path comes from `nbdkit --dump-config` (`plugindir=`); on Debian 13 amd64 it is `/usr/lib/x86_64-linux-gnu/nbdkit/plugins/`. | | `/usr/local/share/ca-certificates/spinifex-ca.crt` | Cluster CA cert installed into the system trust store | ### 1.2 Configuration and Secrets @@ -157,7 +157,7 @@ All scan runs — scheduled and real-time — must produce a log entry that incl ## 4. Reference Configurations -The configurations below are reference baselines. They are known to meet the CMMC L1 objectives on a standard Debian 12 Spinifex node; they are not the only valid implementation. Operators running a commercial EDR should treat [§1](#1-designated-locations-sil1-3142-a) and [§3](#3-scan-schedule-sil1-3145) as the contract and configure their chosen product to match. +The configurations below are reference baselines. They are known to meet the CMMC L1 objectives on a standard Debian 13 Spinifex node; they are not the only valid implementation. Operators running a commercial EDR should treat [§1](#1-designated-locations-sil1-3142-a) and [§3](#3-scan-schedule-sil1-3145) as the contract and configure their chosen product to match. ### 4.1 ClamAV (signature-based AV) diff --git a/scripts/iac/proxmox/README.md b/scripts/iac/proxmox/README.md index 07b0330a0..86873a2be 100644 --- a/scripts/iac/proxmox/README.md +++ b/scripts/iac/proxmox/README.md @@ -8,9 +8,9 @@ OpenTofu/Terraform templates for provisioning Spinifex development clusters on P - 1 or more Proxmox VE nodes with: - A Terraform API token (`Datacenter > Permissions > API Tokens`) - SSH access for a `terraform` user on each node - - Debian 12 cloud image uploaded to `local:iso/` on each node + - Debian 13 cloud image uploaded to `local:iso/` on each node - SSH keypair for cloud-init VM access -- A hardcoded Debian ISO is used, which needs to be pre-installed on each Proxmox host ("debian-12-genericcloud-amd64-20240211-1654.img") https://cdimage.debian.org/images/cloud/bookworm/20240211-1654/debian-12-genericcloud-amd64-20240211-1654.qcow2 +- A hardcoded Debian ISO is used, which needs to be pre-installed on each Proxmox host ("debian-13-genericcloud-amd64-20260501-2465.img") https://cloud.debian.org/images/cloud/trixie/20260501-2465/debian-13-genericcloud-amd64-20260501-2465.qcow2 ## Quick Start (spinifex-test.sh)