Live-verification found two real inaccuracies: WAN now passes 4 things
inbound (NetBird's STUN forward was added, undocumented), and the "third
fix" LAN-to-LAN narrative credited pfSense's ruleset when the actual
enforcement for host-to-host traffic is each host's own firewalld (pfSense
never sees same-subnet traffic on this flat LAN). Refreshed the WAN rules
screenshot and reworded the boundary table + narrative to match. Also
cleaned up the "Other Six Traffic Laws" table formatting per feedback.
The Kestra namespace gained public-docs-drift since this doc was last
verified. New flow-list screenshot (Total: 15), flow-patterns diagram
re-exported to 14 of 15 no-gate, and the pause-step snippet now includes
it. Also corrects the "only two things write to Trilium" claim — that
flow stamps #pendingPublicDoc labels, making it a third writer (labels
only, never content). Same correction applied to the KB source note.
New doc for the weekly self-deriving inventory pipeline: a three-tier
Ansible collection (hardware off the hypervisors/firewall, VMs/LXCs from
the Proxmox APIs, listening sockets off every guest) writing three linked
NocoDB tables, read live behind a Dashy page.
Covers the design decisions worth defending: ss -tlnp over systemctl for
"what does this host serve", merge-only-by-omission on Tier 1 to protect
the one hand-entered field a lying SMBIOS can't provide, API-only Tier 2
because the two Proxmox nodes aren't clustered, stdlib-only push scripts,
and the deliberate KB-vs-machine-layer separation.
Pipeline diagram + four screenshots (Dashy page, all three NocoDB tables).
Provenance comment wired to the ansible roles/playbooks, the rocky Caddy/
dashy config, and KB note O0d4fqw0mr05. Indexed in README under Systems.
Previous screenshot's token counts/TTL distribution predated card 59
(11 active tokens, 20m/1h/no-expiry split including the standing root
token). Current state: 14 active tokens, 1h/no-expiry split - no root
token in the mix anymore.
The standing root token this doc described is retired. Replaced the
2-flow table with the real 3-flow model now in place: routine AppRole
auth, a narrowly-scoped provisioner AppRole for occasional bootstrap
work, and a break-glass generate-root path for the rare cases the
provisioner deliberately can't cover. Alerting row corrected to note
the audit-log check fires on any root-policy token generically, not
a specific standing one.
Two command-block "evidence" snippets added earlier today pasted real,
live-captured values verbatim: the exact cert file path, the fleet's
actual CA fingerprint, today's real issuance timestamp, and the live
Vault role/principal name. All of it identified real infrastructure
in a way the rest of this repo's established redaction convention
(see docs/firewall-and-network.md's [admin workstation]-style
placeholders) already exists specifically to avoid. Redacted to
bracket placeholders; the structural/format evidence (cert type,
extensions, TTLs) stays genuine.
"No immediate disruption" was true for TLS certs and app secrets but not
for the SSH certificate refresh, which has no static-key fallback and
eventually locks the automation identity out entirely during a sustained
Vault outage. The "always talks through a local agent" law also had an
unstated exception worth naming rather than leaving implicit.
Vault's ssh-client-signer mount was undocumented here entirely. Adds it
as flow 2/5 rather than merging into Certificate Flow, since the actual
mechanism differs (own systemd timer, bypasses Vault Agent's render
cycle, only reuses its cached token) - and explains why that distinction
matters for debugging. Diagram updated to match: a third data-plane box
feeding fleet-wide sshd trust instead of a container.
The SSH CA mount (ssh-client-signer/) existed live in Vault but was
missing from this doc's capability list entirely. Adds it as a fourth
"What It Does" bullet with real role config and a live screenshot of
the secrets engines list, and refreshes the stale ACL policies
screenshot (was showing 15 policies, live is 18).
The old claim described two flows sharing one keypair under different
usernames as a deliberate scoping decision. That was actually a stale,
half-migrated credential mismatch, not a design choice - the real fix was
giving Kestra a dedicated keypair with zero relation to the ansible
automation identity's own key, so a leak of one can never expose the other.
Kestra's SSH plugin has no certificate support at all (a plain Java client,
confirmed via its own plugin schema), which is the actual reason it needs
its own static key regardless of what the fleet's ansible identity does.
Added the real current flow config (kestra_local_user/kestra_local_key) and
a screenshot of the live KV Store showing exactly those two entries. Also
refreshed the automation-self-update.timer example, which had gone stale.
Small, precise clarification - the table row was always worded
generically ('a host', not 'a VM') so it was never technically wrong,
just aspirational for LXC hosts before Terraform could provision them
natively. Now genuinely true for both, so it says so.
Live re-ran agent_control -l against the real Wazuh manager - the
netbird host (ID 013) is now enrolled and Active, matching the fleet's
real current host count.
Live-verified against the new NetBird host: firewalld genuinely locked
to 3 explicit rich-rules (zero blanket ports), yet 3 container-published
ports (netbird-proxy, netbird-server, hawser) sit completely outside
those rules and are reachable LAN-wide via Docker's own NAT - the exact
gap the doc already documented, now with a second real example on a
host provisioned this same week instead of just the one from before.
Fleet host count was stale (11, now 12 with the NetBird control plane).
Traffic law 8 (Management) now reflects the real new off-LAN admin path
via the zero-trust mesh, alongside the existing LAN-scoped firewall
rules - accurate about what's affected if the mesh goes down (on-LAN
access unaffected, off-LAN access specifically loses its only path).
Was reusing netbird-zero-trust-mesh-topology.svg (the doc's detailed
peer-topology diagram) in the README too - breaks this repo's own
established convention of the README getting its own dedicated asset
even when covering related material (see readme-trust-boundaries-
blast-radius.svg vs architecture-overview-trust-depth.svg). New diagram
is a simple perimeter-vs-zero-trust conceptual contrast, matching the
README section's generalized framing rather than NetBird's specific
implementation topology.
README: real dedicated 'Zero Trust, Actually Implemented' section (general
concept -> NetBird as the concrete implementation -> link out), host/doc
count bumped to 12/16, NetBird tool bullet.
netbird-zero-trust.md: dropped the LXC-provisioning tangent (not relevant
to a doc about NetBird itself), added self-hosted-vs-SaaS rationale, a
real Addressing table, and expanded split-DNS mechanism detail. Also
genericized personal-device specifics (device types/exact split of
access) that were too specific for the public repo.
New file covering NetBird - a self-hosted WireGuard mesh giving every
fleet host and personal device a stable overlay identity, with a
genuinely-implemented zero-trust policy layer (deny-by-default, groups,
scoped setup keys, peer approval, posture checks).
- Why a mesh over a classic VPN concentrator, illustrated with a real
topology diagram (control plane handles coordination only; actual
data flows peer-to-peer, bypassing it entirely - the literal
distinction from a concentrator, drawn not just asserted)
- Ties back to today's iac-pipeline.md update: this LXC is the first
host ever built through the new Terraform LXC-native path, start to
finish, no manual provisioning step
- Real bring-up incident: gRPC/h2c requirements broke through a naive
proxy chain, and a proxying CDN 403s the agent outright - both root
causes documented, not just the fixes
- Evidence: 3 real command blocks (docker ps, live Caddyfile splitter
config, netbird status --detail from an enrolled peer), 2 real
screenshots (dashboard Peers list, Access Control Policies - port
counts in the screenshot match the real policy detail in the text)
- Second diagram (edge routing chain) for the specific gRPC/h2c/path
split detail, kept separate from the topology diagram since they show
genuinely different shapes of information
- Honest, non-rounded-up rollout status table - several phases still
explicitly open
- Sanitize-checked: no internal IPs/domains/personal email
Also: fixes iac-pipeline.md's forward-reference to this doc to use the
repo's actual link convention ([docs/x.md](x.md)), not descriptive
prose link text.
Terraform gained a second provider (bpg/proxmox) alongside the existing
telmate/proxmox, via a new containers.tf / proxmox_virtual_environment_container
resource - real, live-verified against the actual repo files. Corrects
the doc's previous "Terraform only manages virtual machines... cannot
create or manage LXC containers" claim, which is no longer true.
- Terraform section: VM/LXC comparison table, real containers.tf
excerpt, explains why LXCs need an extra pct-exec bootstrap step
(stock template has no sshd, since it never went through Packer)
- WARNING section: new paragraph noting the LXC-provisioning gap is
closed for new hosts going forward (the three existing exceptions
stay as preserved history, not retroactively fixed) - forward-links
to docs/netbird-zero-trust.md (next commit)
- Fixed now-stale section heading ("one resource type" -> "two
resource types")
- Sanitize-checked: no internal IPs/domains
New export reflecting the user's latest diagram edit. Same white-line
strip as aae1ff2 applied fresh to this export (variant this time: flat
#1C1D1E plus inverted light-dark(#1C1D1E, #d3d4d5)) - verified 0 broken
patterns remain, valid XML, all 8 correct span backgrounds preserved.
Same fix as orchestration-flow-patterns.svg (8772564), applied after a
comprehensive re-check that found the bug wasn't limited to the 6 files
originally caught by a narrower pattern match - architecture-overview.svg
and firewall-and-network-docker-bypass.svg were also affected.
Confirmed via a control test on orchestration-flow-patterns.svg that the
.drawio source's labelBackgroundColor property was never the actual
cause (reverted it, re-exported, still broken, still fixed cleanly by
the same strip) - this is a draw.io export-time quirk, not a content or
convention problem, so no CLAUDE.md changes needed.
Each file: stripped the same broken wrapper-div background-color
declarations (flat #1C1D1E / #ffffff, or the equivalent light-dark()/
var(--ge-adaptive-bg) variants - not consistent across exports of the
same file), verified 0 remain, valid XML, and the correct adaptive span
background count unchanged before/after in every file.
Files: architecture-overview.svg, firewall-and-network-docker-bypass.svg,
iac-pipeline-tools-flow.svg, observability-pipeline.svg,
readme-trust-boundaries-blast-radius.svg, secret-distribution-flows.svg,
secrets-and-pki-lifecycle.svg
The exported SVG's 4 edge labels (no/yes/approve/decline) had two extra,
non-adaptive background-color declarations stamped onto their wrapper
divs by the draw.io exporter (flat #ffffff, and an undefined
var(--ge-adaptive-bg) CSS variable that falls back to #ffffff) -
independent of both the .drawio source content and the export dialog's
Appearance setting (tested Automatic and Light, both showed it).
Surgically stripped just those two declarations from the exported SVG,
verified count (4+4 removed, 0 remaining), confirmed the correct
adaptive span background (light-dark(white, #1C1D1E)) and every other
color in the diagram were untouched, confirmed still valid XML.
- Replaced both mermaid diagrams with real Nextcloud diagrams; the
Ansible-stages rebuild caught a real omission - the old diagram showed
only 2 stages (init/compliance) when there are genuinely 3
(provisioning.yml exists too, currently just clamav/rocky-docker)
- Live-verified against the real iac repo: roles_metadata.yml (9
cis_hardening + 6 other compliance roles, 1 provisioning role),
kickstart partitioning/packages/SSH config, both Packer bootstrap
scripts, terraform.tfvars, pct list on both hypervisors, a real
rendered host_tags.yml
- KB fix: LXC Strategy note's PBS row was wrong, not just stale - PBS
genuinely has a populated vm_tags list and live compliance roles
(confirmed via real artifacts on the host itself), not 'never
Ansible-managed' as it said; corrected and re-verified via re-fetch
- Added real content not previously in the doc: the deliberately
permissive build-time SSH window closed by ssh_hardening, the
admin/ansible identity split baked into the image at build time, and a
third pipeline exception (PBS) that's genuinely different in kind from
the other two, including a real Rocky-vs-Debian PAM ordering bug found
onboarding it
- Considered two screenshot candidates (Proxmox template list, VM/LXC
mix) - declined as low-value; command evidence covers this
source-driven topic well on its own
- Sanitize-checked: no internal IPs/MACs/domains/personal info/forbidden
app names
- Replaced mermaid diagram with real Nextcloud diagram; rebuild caught a
real bug in the old one (showed Kopia/Bazarr flowing through the App
Router, which flows.json disproves - they bypass it entirely)
- Live-verified Mosquitto broker config/ACL, Node-RED flow routing (16
switch rules = 15 apps + unknown fallback, 2 dedicated endpoints),
mqtt-monitor.sh check count against the real script
- Named NetBox and Kestra directly (previously generic) after the real
Node-RED screenshot made them visible anyway; Postiz/nocodb-content
stay generic per standing instruction
- Added real evidence: routing-table command output, the real
topic-agnostic Inventory Parse function source, real Mosquitto
ACL/config, real check-count grep, a real Node-RED flow canvas
screenshot, and a real Mosquitto connection log screenshot (the
kestra-notify client is live proof of the MQTT-not-HTTP claim)
- KB fix: Ansible mqtt_client Role note was missing a 23rd real check
(crash-looping systemd units, distinct from the failed-units check,
added to the script after a real vault-agent crash-loop incident)
- Sanitize-checked: no internal IPs/domains/personal info/forbidden app
names
1. Live-verify: journald persistent-storage config confirmed on two
hosts (1G vs 500M cap, matches the doc's claim exactly), Alloy
active confirmed across all 11 fleet hosts.
2. Fix KB: Alloy Agent Model was stale - version had moved from
v1.18.0 to v1.18.1 on all 8 'newer' hosts since last checked,
role's own default still unreconciled at 1.17.1. Fixed and
confirmed via re-fetch.
3. Pulled the full Observability Pipeline tree: Alloy Agent Model,
Log Flow, Metrics Flow.
4. Replaced both mermaid diagrams (broke this repo's Nextcloud-SVG
convention) with real diagrams built through the proper round-trip.
5. Evidence: real journald config dumps, plus 3 real Grafana
screenshots (host metrics dashboard, detailed Loki log stream
showing job=technitium-dns/docker/system, and the fleet-wide log
volume dashboard) - one screenshot round caught and fixed an
unredacted internal IP before being used.
6/7. Compelling-proof test passes; sanitize-check clean.
Step 5 re-audit, completing the checklist gap that started this whole
detour. Added: the real hyper2 host_vars comment (matches the WARNING
callout's reasoning almost word for word), the real automation-self-
update.timer schedule, the real Kestra flow list (visually confirms
13 total flows), and app-update's real execution topology (visually
confirms wait_for_approval as an actual node, not just a diagram
concept).
Step 5 re-audit. The table itself (the file's central correction from
earlier this session) had no embedded evidence - only the corrected
count was asserted. Added the real, freshly-repulled provider list
confirming all 10 by actual model type, not just name.
Step 5 re-audit. The wazuh_agent_tuning root-cause comment adds a
specific fact not previously in the doc (9 of the fleet's agents
affected). The SCA dashboard screenshot is the doc's first visual
evidence - everything else was CLI/text - and shows a real 87% score,
directly proving the 'below 100% is an accepted tradeoff' claim with
an actual number instead of just asserting the policy.
automation-bot
thesabear