mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-29 08:07:37 +09:00
Juan DenisandClaude Opus 5
7ebc2aba34
A facts document — firewall, SSH port, brute-force protection, the panel's two-factor policy, its version, and when its backups last succeeded and were verified — goes up the policy stream on connect and every six hours. `policy.report` sends one now, which is what "Check now" presses. The important part is what it does not claim. Each bundle is advertised in `capabilities` only when its probe actually answered, so a rule Cloud cannot get facts for reads "not checkable here" rather than marking a healthy server non-compliant. Pending OS security updates have no probe here, so that bundle is never advertised and its handler refuses honestly instead of pretending. Four repairs, each the panel's own path with its own refusals: FirewallService.enable (which declines to lock SSH out), the require-2FA policy with its grace window, systemctl start fail2ban, and the offsite verification. - backend/app/services/connect_policy.py - backend/app/services/connect_commands.py — the three consent bundles - backend/app/services/connect_client.py — the policy stream - backend/tests/test_connect_policy.py — 17 tests, nothing touches the host Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018q56AfqpgKjio4n9KYubvZ