gibandClaude Opus 5
a493fa5584
setup-server queried --query-port, saw "not open", and blanket-opened 80, 443 and 81. On a machine reaching those ports through rich rules -- one CDN's address sets, say -- neither appears in --list-ports, so the step read a deliberate, narrow grant as "closed" and replaced it with a public one. It did this during `panama update`, which asks nothing and runs unattended, so there was no prompt and no diff for anyone to read. A production server lost its firewall posture that way, port 81 and the proxy's admin portal included. Each port is now checked for existing coverage first -- an open port, an enabled service, or an accepting rich rule, ranges included -- and left alone when it has some. The bias stays where it was: only a rule that positively reads as a grant counts, and anything unrecognised still falls through to opening the port, because a fresh server that is silently unreachable is the worse failure. A rule that DROPS a port is not coverage either; reading a block as a grant would leave the proxy unreachable on a machine nobody thought to re-check. A machine that manages its own firewall opts out once, with `echo manual > ~/.local/state/panama/firewall`, and Panama never touches firewalld on it again. A file rather than an environment variable, because the run that needs to respect it is the unattended one. tests/setup/server-firewall-contract pins all of it, and fails against the previous code on exactly the cases that cost the posture. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
14 lines
704 B
Plaintext
14 lines
704 B
Plaintext
# Only on role=server, on top of core-packages. Deliberately short: a server
|
|
# is the shell environment plus containers, and almost everything it needs is
|
|
# already core.
|
|
#
|
|
# setup-server opens 80/443/81 through it, where nothing already grants them.
|
|
# Fedora Server ships it; a minimal cloud image may not, and a server whose
|
|
# firewall step silently no-ops is a server somebody believes is firewalled.
|
|
firewalld
|
|
# Node comes through nvm here for the same reason as on the desktop --
|
|
# config/bash/shell switches versions per project from .nvmrc -- and because
|
|
# install-packages puts Codex on with npm, agents' MCP servers want a node,
|
|
# and a system nodejs earlier on PATH would win every switch.
|
|
nvm
|