remoteAdmin's policy is not pinned against composition; a blank host fails open in the provisioning guard

vnprc-agent commented

2026-09-30 03:29:37 +01:00

Four findings from a cold review of the landed range ba8f044..master, after allod/nexus#68 and the provisioning guard merged. Evidence, verified against the source.

remoteAdmin's named-interface rule can be undone by ordinary composition. nix/remote-admin.nix:45 sets openFirewall = false and :56 adds per-interface rules, but nothing refuses the same port in the global lists. Trigger: any composed module declares networking.firewall.allowedTCPPorts = [ 22 ]; list merging succeeds and sshd is reachable on every interface. The module's check composes an uncontested fixture only.
remoteAdmin's keys-only policy can be overridden. nix/remote-admin.nix:49 sets PasswordAuthentication = false and the others as ordinary definitions. Trigger: a composed module sets services.openssh.settings.PasswordAuthentication = lib.mkForce true; evaluation succeeds. Principle 4: a boundary that depends on cooperation is not a boundary.
A declared-but-empty host fails open in the provisioning guard. scripts/lib/rotation-common.sh:143-146 maps "host": "" to nothing and :19 accepts every blank value, so { "host": "" } in vm-specs.json or vmFacts is treated as undeclared and provisioning proceeds. Inventory validation refuses that value at evaluation, so this is the backstop failing open, not the boundary.
A bootstrap negative test can pass for the wrong failure. tests/bootstrap-orchestration.sh:17 runs test functions inside if, which suspends set -e inside them, so the assertions at :335-339 can fail without failing the test; only the final absence check decides. Trigger: bootstrap-vm exits early on an unrelated error and writes no known_hosts_vms.

Noted, not a defect: nix/configuration.nix:68 renders ALLOD_HYPERVISOR unconditionally, which is why every hypervisor's derivation changed with this range. The guard already falls back to hostname, so the variable may be redundant.

Refs allod/archetypes#89, allod/nexus#68

Four findings from a cold review of the landed range `ba8f044..master`, after allod/nexus#68 and the provisioning guard merged. Evidence, verified against the source. 1. **`remoteAdmin`'s named-interface rule can be undone by ordinary composition.** `nix/remote-admin.nix:45` sets `openFirewall = false` and `:56` adds per-interface rules, but nothing refuses the same port in the global lists. Trigger: any composed module declares `networking.firewall.allowedTCPPorts = [ 22 ]`; list merging succeeds and sshd is reachable on every interface. The module's check composes an uncontested fixture only. 2. **`remoteAdmin`'s keys-only policy can be overridden.** `nix/remote-admin.nix:49` sets `PasswordAuthentication = false` and the others as ordinary definitions. Trigger: a composed module sets `services.openssh.settings.PasswordAuthentication = lib.mkForce true`; evaluation succeeds. Principle 4: a boundary that depends on cooperation is not a boundary. 3. **A declared-but-empty host fails open in the provisioning guard.** `scripts/lib/rotation-common.sh:143-146` maps `"host": ""` to nothing and `:19` accepts every blank value, so `{ "host": "" }` in `vm-specs.json` or `vmFacts` is treated as undeclared and provisioning proceeds. Inventory validation refuses that value at evaluation, so this is the backstop failing open, not the boundary. 4. **A bootstrap negative test can pass for the wrong failure.** `tests/bootstrap-orchestration.sh:17` runs test functions inside `if`, which suspends `set -e` inside them, so the assertions at `:335-339` can fail without failing the test; only the final absence check decides. Trigger: `bootstrap-vm` exits early on an unrelated error and writes no `known_hosts_vms`. Noted, not a defect: `nix/configuration.nix:68` renders `ALLOD_HYPERVISOR` unconditionally, which is why every hypervisor's derivation changed with this range. The guard already falls back to `hostname`, so the variable may be redundant. Refs allod/archetypes#89, allod/nexus#68

vnprc referenced this issue from a commit

2026-09-30 04:11:33 +01:00

Pin the remote-administration policy against composition; refuse an empty declared host

vnprc referenced this issue from a commit

2026-09-30 04:11:33 +01:00

Assert the remote-administration policy on extraConfig, listenAddresses and the firewall switch

vnprc-agent commented

2026-09-30 04:30:23 +01:00

Author

All four findings are fixed on master. The remote-administration policy is asserted on the composed values for settings, extraConfig, listenAddresses, ports and the firewall switch, each with a contested fixture; an empty declared host refuses on both data surfaces; the bootstrap harness makes its assertions load-bearing, which also exposed and repaired five tests that proved nothing.

vnprc-agent closed this issue

2026-09-30 04:30:23 +01:00

vnprc-agent referenced this issue from allod/archetypes

2026-09-30 04:30:25 +01:00

Make the hypervisor identity plural so a deployment can run more than one #89

Rows
Columns

remoteAdmin's policy is not pinned against composition; a blank host fails open in the provisioning guard #70