This website requires JavaScript.
befdad6715
Doc update
Audiobuzz
2026-09-14 10:53:28 +00:00
0d32f73038
Merge pull request 'poam-hardening' (#22 ) from poam-hardening into main
audiobuzz
2026-07-17 05:12:10 +00:00
943f3e29ce
tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17 )
Audiobuzz
2026-07-12 09:25:02 +00:00
4e9ab45d34
2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules
Audiobuzz
2026-07-12 06:43:00 +00:00
9ce493ef6f
Merge pull request 'poam-hardening' (#21 ) from poam-hardening into main
audiobuzz
2026-07-12 06:30:53 +00:00
0fc54c64b7
docs: TLS audit offload bench-verified (poam-hardening-5bc6d27) — all gates passed
Audiobuzz
2026-07-12 06:28:18 +00:00
4fe6a5ae16
issue-cert: probe both smallstep password locations (secrets/password on older images)
Audiobuzz
2026-07-12 06:05:40 +00:00
dd3a672a82
Merge remote-tracking branch 'origin/main' into poam-hardening
Audiobuzz
2026-07-12 05:54:41 +00:00
7bd42abf4d
Merge pull request 'secure-ntp' (#20 ) from secure-ntp into main
audiobuzz
2026-07-12 05:48:24 +00:00
7b034a9249
docs(ssp): flip F-03/R-17 NTS to bench-verified (2026-07-12, clean build 5294860
Audiobuzz
2026-07-12 05:47:11 +00:00
5bc6d27f77
Adding rsyslog tls
Audiobuzz
2026-07-12 14:04:19 +09:30
5294860e74
secure-ntp: label /run/chrony-dhcp so chronyd can read the NTS source under SELinux
Audiobuzz
2026-07-12 02:53:05 +00:00
5a3eaedec5
secure-ntp: remove the chrony pkg NM dispatcher that clobbered the NTS source
Audiobuzz
2026-07-11 14:02:40 +00:00
d1621e9b74
Merge remote-tracking branch 'origin/main' into secure-ntp
Audiobuzz
2026-07-11 21:03:23 +09:30
0a3deca335
docs: cite clean build 28d31e4
Audiobuzz
2026-07-11 11:31:57 +00:00
b0890cfc09
Merge pull request 'poam-hardening' (#19 ) from poam-hardening into main
audiobuzz
2026-07-11 11:29:29 +00:00
f9f7c7c940
secure-ntp: fix NTS defects surfaced by the F-03 bench
Audiobuzz
2026-07-11 11:21:46 +00:00
aab6c9919c
docs(ssp): flip F-02 SSH host certs to bench-verified (2026-07-11)
Audiobuzz
2026-07-11 09:55:43 +00:00
8e1418c19d
docs(ssh-host-cert): record F-02 bench-verified end-to-end (2026-07-11)
Audiobuzz
2026-07-11 09:50:33 +00:00
28d31e436c
ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench
Audiobuzz
2026-07-11 09:44:33 +00:00
fbb8100ecd
Adding secure NTP
Audiobuzz
2026-07-11 17:32:05 +09:30
8325818c1b
fix pipeline use of bash
Audiobuzz
2026-07-11 16:24:07 +09:30
2e318fba00
adding ssh host signing
Audiobuzz
2026-07-11 16:20:21 +09:30
b5d6c790c4
Merge pull request 'fleet-manager' (#18 ) from fleet-manager into main
audiobuzz
2026-07-10 23:16:44 +00:00
57fb5c3a3e
docs(ssp): v0.3 — add the fleet-management plane + July hardening changes
Audiobuzz
2026-07-10 22:56:34 +00:00
3284a2713b
docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings
Audiobuzz
2026-07-10 22:45:00 +00:00
a46e5edf69
agent: add chrony supplementary group so it can read tracking.log (DAC)
Audiobuzz
2026-07-10 12:45:44 +00:00
02a6621a19
image: SELinux allow fleet-agent to read chrony tracking.log under enforcing
Audiobuzz
2026-07-10 09:57:34 +00:00
8eb28c0a6b
serving: document opening 123/udp on the host firewall for the NTP server
Audiobuzz
2026-07-10 09:42:26 +00:00
4ca0b6dd06
agent: read chrony status from tracking.log instead of the command socket
Audiobuzz
2026-07-10 09:36:37 +00:00
394ad10824
agent: query chrony over loopback UDP command socket (unix socket unusable under sandbox)
Audiobuzz
2026-07-10 09:02:05 +00:00
e6fd4a2dde
image: SELinux allow fleet-agent chronyc probe under NoNewPrivileges
Audiobuzz
2026-07-10 08:39:27 +00:00
1db3977238
fleet-manager: auto-renew the agent-plane server cert (step-ca sidecar + hot-reload)
Audiobuzz
2026-07-10 07:42:18 +00:00
1c68c37824
fleet-manager: chrony tracking metrics relative to the NTP source
Audiobuzz
2026-07-10 06:47:27 +00:00
df7dad81b7
fleet-manager: host uptime metric + reboot-pending status
Audiobuzz
2026-07-10 06:41:09 +00:00
e6ae8c4b23
fleet-manager UI: auto-refresh the selected host's metric graphs
Audiobuzz
2026-07-10 06:22:33 +00:00
d85a1e5b23
serving: defaults.env header + Makefile + .gitignore + doc refs
Audiobuzz
2026-07-10 06:19:11 +00:00
cbc679c5bd
serving: rename .env.example -> defaults.env (committed defaults + .env overrides)
Audiobuzz
2026-07-10 06:18:15 +00:00
1b8cf2f344
agent: dial the manager by a fleet DNS name (manager.fleet.lab)
Audiobuzz
2026-07-10 06:13:46 +00:00
0068a15917
docs/TODO #14 : on-host agent telemetry BENCH-VERIFIED on real hardware
Audiobuzz
2026-07-10 06:08:48 +00:00
a89c3d2af1
fleet-manager: fix CA install, add register-host, surface agent status
Audiobuzz
2026-07-10 05:51:57 +00:00
4b99816394
Merge in main
Audiobuzz
2026-07-10 07:10:40 +09:30
08f2d82bd1
Merge pull request 'optimise-ram' (#11 ) from optimise-ram into main
audiobuzz
2026-07-05 06:46:52 +00:00
254ec79cae
fleet-agent: install agent.env from /tmp/agent (complete staging fix)
Audiobuzz
2026-07-05 06:36:54 +00:00
d0f39443ce
fleet-agent: fix 2b-agent config staging (build failed)
Audiobuzz
2026-07-05 06:36:18 +00:00
6b675a1bda
Merge pull request 'fapolicyd-tmpfs' (#16 ) from fapolicyd-tmpfs into main
audiobuzz
2026-07-05 03:21:46 +00:00
d5c833addf
fleet-agent: on-host TPM-mTLS telemetry client (v1)
Audiobuzz
2026-07-05 03:15:13 +00:00
8ab11a74c5
fleet-manager: add Makefile that sets COMPOSE_ENV_FILES for you
Audiobuzz
2026-07-05 02:14:22 +00:00
45d7101472
fleet-manager: layer config as defaults.env (committed) + .env (overrides)
Audiobuzz
2026-07-05 02:08:25 +00:00
688ff1aa88
fleet-manager: mirror the distroless runtime base through Harbor
Audiobuzz
2026-07-05 01:47:28 +00:00
e6b1f0308e
fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)
Audiobuzz
2026-07-05 01:46:52 +00:00
76c3a6aaa7
fleet-manager: drop self-TLS admin mode — the manager never terminates TLS
Audiobuzz
2026-07-05 01:44:23 +00:00
24d67d07db
serving: mirror the remaining base/service images through Harbor
Audiobuzz
2026-07-05 01:34:10 +00:00
08847532ee
fleet-manager: pull non-CI images through the Harbor mirror
Audiobuzz
2026-07-05 01:28:06 +00:00
46d54798b7
fleet-manager: docs for the Traefik ingress + behind-proxy mode
Audiobuzz
2026-07-05 01:00:51 +00:00
4c1db3f765
fleet-manager: front the admin UI with Traefik (443 + Route 53 ACME), retire acme side-car
Audiobuzz
2026-07-05 00:57:04 +00:00
20acdb0254
fleet-manager: add behind-proxy admin mode (passkey over plaintext behind a TLS proxy)
Audiobuzz
2026-07-05 00:52:19 +00:00
3140d51d95
fleet-manager: document hardening status + remaining per-env items
Audiobuzz
2026-07-05 00:36:01 +00:00
f72cea6b17
fleet-manager: add backup.sh for the durable-state volumes
Audiobuzz
2026-07-05 00:34:23 +00:00
487c62c53f
fleet-manager: run the CI-built image (FLEET_MANAGER_VERSION), keep local build
Audiobuzz
2026-07-05 00:32:58 +00:00
a8402a2127
ci: build + push the fleet-manager image (join the CI-built serving images)
Audiobuzz
2026-07-05 00:32:19 +00:00
cf86e615ea
fleet-manager: go fix — strings.Split -> strings.SplitSeq in newWebAuthn
Audiobuzz
2026-07-05 00:26:41 +00:00
2b3708c718
fleet-manager: register-admin link uses the first of multiple RP origins
Audiobuzz
2026-07-05 00:24:10 +00:00
76446edd75
fleet-manager: allow multiple WebAuthn origins (comma-separated RP_ORIGIN)
Audiobuzz
2026-07-04 11:07:15 +00:00
643ba6be2d
fleet-manager: actionable error when the enrol key is missing at startup
Audiobuzz
2026-07-04 10:55:24 +00:00
693cf94695
fleet-manager: point acme DNS-01 propagation check at a public resolver
Audiobuzz
2026-07-04 10:24:42 +00:00
d31c0f18eb
fleet-manager: locate lego at /lego in the acme side-car
Audiobuzz
2026-07-04 10:20:48 +00:00
510f4f6b25
fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car
Audiobuzz
2026-07-04 10:14:51 +00:00
9479b70b04
fleet-manager: add acme side-car for the admin-UI cert (LE DNS-01 via Route 53)
Audiobuzz
2026-07-04 10:13:51 +00:00
bf546a80a6
fleet-manager ui: render a never-reported host's last_seen as "never"
Audiobuzz
2026-07-04 10:03:28 +00:00
0360c1c6d1
fleet-manager: fix nonroot data-volume ownership + document broker wiring
Audiobuzz
2026-07-04 09:56:09 +00:00
014f43cb5a
fleet-manager: log a positive line when the authorise pillar enables
Audiobuzz
2026-07-04 09:25:10 +00:00
ea29d0d12e
fleet-manager: soft-disable optional planes when their PKI isn't staged yet
Audiobuzz
2026-07-04 08:58:38 +00:00
2ef0c1747d
fleet-manager: checkpoint 7 — deployment (compose, PKI, deploy runbook, design-doc updates)
Audiobuzz
2026-07-04 08:44:31 +00:00
f62c668ce3
fleet-manager: add Dockerfile (checkpoint 7 start)
Audiobuzz
2026-07-04 06:19:21 +00:00
12c4296f9d
fleet-manager ui: label target-version pin as recorded intent (not yet enforced)
Audiobuzz
2026-07-04 06:19:21 +00:00
f71a55eab5
fleet-manager ui: target version as a dropdown (fleet-known + custom)
Audiobuzz
2026-07-04 06:08:15 +00:00
20b29d9990
fleet-manager ui: readability + reboot-now
Audiobuzz
2026-07-04 06:05:29 +00:00
fae3624c58
fleet-manager: checkpoint 6 — the admin SPA (fleet command deck)
Audiobuzz
2026-07-04 05:54:41 +00:00
c40dd5ac93
fleet-manager: checkpoint 5 — admin WebAuthn/passkey auth (replaces browser mTLS)
Audiobuzz
2026-07-04 04:26:30 +00:00
9c86cd4c5a
fleet-manager: checkpoint 4 — InfluxDB metrics gateway (write + Flux read)
Audiobuzz
2026-07-04 03:59:18 +00:00
df4fa95bdd
fleet-manager: checkpoint 3 — authorise pillar (broker fold-in, births inventory)
Audiobuzz
2026-07-04 03:51:26 +00:00
80cbb833cc
fleet-manager: checkpoint 2 — gRPC agent plane (bidi mTLS stream)
Audiobuzz
2026-07-04 03:40:55 +00:00
0572d21c07
fleet-manager: drop accidentally-committed binary + add .gitignore
Audiobuzz
2026-07-04 03:26:44 +00:00
915a15b6a1
fleet-manager: checkpoint 1 — service skeleton + inventory store + admin API
Audiobuzz
2026-07-04 03:25:54 +00:00
e27f068aaf
docs/stig-deviations #15 : fapolicyd overlay watch VERIFIED enforcing (2026-07-04)
Audiobuzz
2026-07-04 02:52:04 +00:00
18aad0888c
Merge origin/main (trim-rpm) into optimise-ram
Audiobuzz
2026-07-04 02:49:55 +00:00
bdc7e6b234
Merge remote-tracking branch 'origin/main' into fapolicyd-tmpfs
Audiobuzz
2026-07-04 12:11:05 +09:30
2d9e813488
Merge pull request 'trim-rpm' (#12 ) from trim-rpm into main
audiobuzz
2026-07-04 02:39:51 +00:00
68dee79832
docs/TODO #18 : record nss-mdns/chromium regression + fix; kiosk re-verified, image 1.8 GiB → 755 MiB
Audiobuzz
2026-07-04 02:24:57 +00:00
de57a7de11
Merge branch 'main' into optimise-ram
Audiobuzz
2026-07-03 21:53:18 +09:30
2bc2dafb1c
kiosk: stop nss-mdns removal from cascading chromium out of the image
Audiobuzz
2026-07-03 12:21:22 +00:00
12043d3444
stig: add overlay to fapolicyd watch_fs — actually guard the overlay root
Audiobuzz
2026-07-03 11:56:13 +00:00
48dc3e11ae
Merge remote-tracking branch 'origin/main' into trim-rpm
Audiobuzz
2026-07-03 20:14:51 +09:30
8815fe0618
Merge pull request 'nvmeof-mounting' (#15 ) from nvmeof-mounting into main
audiobuzz
2026-07-03 10:44:13 +00:00
f882ddae1f
docs/TODO #6 : targeted-connect test-path bench-verified (0bfe872
Audiobuzz
2026-07-03 10:43:24 +00:00
480d926a98
trim: fix SIGPIPE (exit 141) in the initramfs-largest-files diagnostic
Audiobuzz
2026-07-03 07:48:09 +00:00
5ac03fa8b4
Merge pull request 'ci: registry-gc — read branches with the Actions token, not PACKAGE_TOKEN' (#14 ) from registry-gc into main
audiobuzz
2026-07-03 07:45:39 +00:00
51d9dc0888
ci: registry-gc — read branches with the Actions token, not PACKAGE_TOKEN
Audiobuzz
2026-07-03 07:43:24 +00:00
09a8fdd444
Merge pull request 'ci: add registry-gc — prune orphan container images for deleted branches' (#13 ) from registry-gc into main
audiobuzz
2026-07-03 07:38:03 +00:00
Audiobuzz