- Ya
- 15 Agosti 2026, 22:50 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 9ea4773
Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at boot by a systemd unit, since nftables rules do not survive a reboot. It is a guardrail, not a boundary: kamodev has passwordless sudo apt, which is root-equivalent — the two requirements are in tension and that is documented. k1m1/k3m1 hosts entries go into the cloud-init TEMPLATE as well as /etc/hosts, because manage_etc_hosts regenerates the file on every boot and a plain append silently vanishes. Uses LAN IPs; the WireGuard/CGNAT overlays are retired and 10.0.50.1 is only the node-to-node link. cloud-init now carries desktop/agent/ as one deterministic tarball rather than a placeholder per file — the set went from three files to ten, and each addition otherwise meant editing the template and the CI render step too.