docs(H1): v0.72.0 CHANGELOG + REPORT + CONTEXT (OOB operator access, live-validated)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-05 23:03:32 +02:00
parent 223c235f01
commit 26664d6d51
3 changed files with 106 additions and 63 deletions
@@ -1,3 +1,33 @@
+## v0.72.0 — OOB operator access: rendered operator /32 + dedicated felhom-sshd + port-adaptive belt + oob health (TASK H1) (2026-07-05)
+
+The agent half of the merged E1+H1 operator-SSH-access feature (hub half = felhom-hub v0.35.0).
+Provenance: `felhom.eu/documentation/audits/SPIKE-{felhom-sshd,oob-wg-operator-peer}-2026-07-05.md`.
+Live-validated on felhom-pve + the dev endpoint (both spikes' key probes re-run as acceptance).
+
+- **Operator /32 rendered into wg-felhom** (`internal/wgtunnel/manager.go` `renderConf`/`allowedIPsLine`):
+  `oob_peer_ip` from the desired-state block is appended to AllowedIPs, deterministically SORTED
+  (byte-stable conf-hash — no per-tick flap). RENDERED, not a runtime `wg set`, so it survives the
+  agent's self-heal ([OF-1]; live-proven: tunnel stopped → self-heal → operator SSH still works).
+- **Dedicated felhom-sshd** (`internal/felhomsshd/`): a SECOND sshd on a claimed non-22 port
+  (`[8822,2222,8022,62222]`, LOUD-fail on exhaustion [SF-4]), own config/host-key/AuthorizedKeysFile
+  (`/etc/felhom-sshd/authorized_keys/%u`, outside ~/.ssh [SF-3])/unit — COEXISTS with the customer's
+  :22 (never touched). Config: render→`sshd -t`→**reload** (never restart-on-change [SF-2]); operator
+  authorized_keys from the hub block; `reset-failed`-then-restart heal with a 10-min cooldown, NEVER
+  restarting onto an invalid config. `configs/felhom-sshd.service` SAFE — **no `RuntimeDirectory=`**
+  [SF-1].
+- **Port-adaptive belt** (`internal/felhomsshd/belt.go` + `configs/felhom-oob.nft`): a STATIC
+  `inet felhom_oob` table; the agent mutates ONLY its SETS — `@operator_ips` + `@ssh_port` [trap 4] —
+  so felhom-sshd's port is reachable ONLY from the operator `/32` over `wg-felhom` (off-tunnel +
+  box↔box dropped at the host; :22 untouched). Idempotent; a nil/unfetched block never empties it
+  (no operator lockout).
+- **OOB health** (`internal/felhomsshd/health.go`): the additive `oob` heartbeat stanza
+  (`felhom_sshd_active/port/reachable/config_invalid/operator_peer_configured/operator_key_configured/
+  wg_handshake_age_s`) — reaches the hub over HTTPS even with felhom-sshd/tunnel down. `reachable` =
+  a listener check (the belt blocks a dial); `operator_*_configured` from persistent state
+  (belt/authorized_keys), accurate immediately after a restart.
+- **Sudoers**: `FELHOM_SSHD` (config/authkeys install + `sshd -t/-T` + scoped systemctl) + `FELHOM_OOB`
+  (nft SET-element ops only — never a rule grant). `oob.enabled` config DEFAULT FALSE.
+
 ## v0.71.0 — management-plane break-glass: privsep-dir watchdog + mgmt_plane health (TASK G1) (2026-07-05)

 Prerequisite for the felhom-sshd OOB feature (H1). Closes the lockout from