feat(ci): LLDAP admin page must answer over the tailnet; add an operator exposure check for production #94

Merged

jfraeys merged 1 commit from jfraeys/feat/exposure-check into main 2026-10-13 10:23:41 -04:00

Conversation 0 Commits 1 Files changed 3 +117 -2

jfraeys commented 2026-10-13 09:54:45 -04:00

Owner

Copy link

After the #78 firewall change, staging only proved the LLDAP admin port was open over the tailnet, and production's tailnet access had not been confirmed.

• playbooks/validate-connectivity.yml: from the web node, GET http://:17170/ must return 200 (retried), reported with the other mismatches. Tested with synthetic results: 200 passes, 502 and empty fail with a message.
• scripts/check-exposure.py (new, read-only, stdlib only): checks PRODUCTION from the operator machine. Public: 443/80/8443 open; 17170, 25, 3000, 9093, 2222 closed. Tailnet (skipped with a note if not on it): SSH, the LLDAP admin page returns HTTP 200, Forgejo API open, Postfix 25 not reachable from a device that is not tag:web (ACL). Ran it live just now: 13/13 checks match, including LLDAP HTTP 200 over the tailnet and 17170 filtered publicly.
• docs/staging-parity.md: where each check lives and the home-ISP port-25 caveat.

🤖 Generated with Claude Code

After the #78 firewall change, staging only proved the LLDAP admin port was open over the tailnet, and production's tailnet access had not been confirmed. - playbooks/validate-connectivity.yml: from the web node, GET http://<services tailnet>:17170/ must return 200 (retried), reported with the other mismatches. Tested with synthetic results: 200 passes, 502 and empty fail with a message. - scripts/check-exposure.py (new, read-only, stdlib only): checks PRODUCTION from the operator machine. Public: 443/80/8443 open; 17170, 25, 3000, 9093, 2222 closed. Tailnet (skipped with a note if not on it): SSH, the LLDAP admin page returns HTTP 200, Forgejo API open, Postfix 25 not reachable from a device that is not tag:web (ACL). Ran it live just now: 13/13 checks match, including LLDAP HTTP 200 over the tailnet and 17170 filtered publicly. - docs/staging-parity.md: where each check lives and the home-ISP port-25 caveat. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit 2026-10-13 10:18:13 -04:00

feat(ci): LLDAP admin page must answer over the tailnet; add scripts/check-exposure.py for production ... b737c6ae32

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit edb605add2 into main 2026-10-13 10:23:41 -04:00

jfraeys referenced this pull request from a commit 2026-10-13 10:23:43 -04:00

Merge pull request 'feat(ci): LLDAP admin page must answer over the tailnet; add an operator exposure check for production' (#94) from jfraeys/feat/exposure-check into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!94

No description provided.