tegwick
8f5799553e
- goss/baseline.yaml: assertions for all spec/server-baseline.yaml items (packages, services, SSH config, UFW rules, admin user, fail2ban, HISTCONTROL) - goss/vars/baseline-vars.yaml: parameterised ports and paths - ansible/roles/goss/: installs Goss binary (v0.4.9), deploys tests, runs assertions in TAP format, fetches report to reports/ - ansible/playbooks/verify.yaml: playbook wrapping the goss role - Makefile: add 'make verify' target; update 'make status' with hint - docs/adr/ADR-002: formal repo boundary — railiance-hosts vs railiance-bootstrap - workplans/RAIL-HO-WP-0002: registered workstream 8fed53c2, T03–T06 done Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
69 lines
1.2 KiB
YAML
69 lines
1.2 KiB
YAML
# Goss baseline assertions for railiance managed nodes
|
|
# Derived from spec/server-baseline.yaml — keep in sync.
|
|
# Run: goss -g /etc/goss/baseline.yaml validate
|
|
|
|
package:
|
|
ufw:
|
|
installed: true
|
|
fail2ban:
|
|
installed: true
|
|
git:
|
|
installed: true
|
|
curl:
|
|
installed: true
|
|
vim:
|
|
installed: true
|
|
htop:
|
|
installed: true
|
|
age:
|
|
installed: true
|
|
sops:
|
|
installed: true
|
|
|
|
service:
|
|
ufw:
|
|
enabled: true
|
|
running: true
|
|
fail2ban:
|
|
enabled: true
|
|
running: true
|
|
ssh:
|
|
enabled: true
|
|
running: true
|
|
|
|
file:
|
|
/etc/ssh/sshd_config:
|
|
exists: true
|
|
contains:
|
|
- /^PermitRootLogin no/i
|
|
- /^PasswordAuthentication no/i
|
|
- /^PubkeyAuthentication yes/i
|
|
|
|
user:
|
|
admin:
|
|
exists: true
|
|
groups:
|
|
- sudo
|
|
shell: /bin/bash
|
|
|
|
command:
|
|
"ufw status":
|
|
exit-status: 0
|
|
stdout:
|
|
- "Status: active"
|
|
- /22\/tcp.*ALLOW/
|
|
- /6443\/tcp.*ALLOW/
|
|
- /8472\/udp.*ALLOW/
|
|
"grep NOPASSWD /etc/sudoers.d/admin":
|
|
exit-status: 0
|
|
stdout:
|
|
- "NOPASSWD"
|
|
"grep -r HISTCONTROL /etc/profile.d/":
|
|
exit-status: 0
|
|
stdout:
|
|
- "ignorespace"
|
|
"fail2ban-client status sshd":
|
|
exit-status: 0
|
|
stdout:
|
|
- "Status for the jail: sshd"
|