mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
93a15c1a8f
The inventory was missing northstar (53 on the advertise address, 5300 on the wildcard and dialled cross-node by every node's per-instance DNS shim), charon (500/4500 plus ESP), Geneve 6081, the per-instance IMDS and VPC-DNS listeners, and chronyd. Section 6 asks the operator to compare the table against ss -tulnp, which was not possible while six listeners were absent. Two classifications were wrong. 8443 was Cluster, but predastore binds the S3 gate to 0.0.0.0 deliberately because S3 is a public plane. 4432 was External, but it binds the node's --bind address and is transient. The scope vocabulary predated the three-plane model, so it could not express the encap plane or record that a node with fewer NICs collapses the planes onto its public address. Cluster and Encap now state intent rather than a guarantee. Replaces the reference nftables ruleset. The previous one had no conntrack, loopback, ICMP or ime-* rules and ended in a blanket drop, so an operator who applied it lost guest metadata, guest DNS, all egress return traffic and their own SSH session. The replacement is input-only in a dedicated table, because nftables verdicts are per-table and a default-deny forward chain would override the accepts vpcd writes to ip filter and break every routed-NAT instance.