windy-git

Files

Grant Whitmer 4a34b35441 security: CI egress filter — jobs reach the internet, never Veron/LAN

Measured: an unprivileged job container inside the CI dind could open SSH,
Ollama and dev servers on Veron (192.168.1.73) and the rest of the LAN,
WireGuard and Tailscale — lateral movement for any malicious dependency,
no escape needed. egress.sh (idempotent; windygit-ci-egress.service at
boot) hooks the jobs bridge: runner<->dind, replies, DNS and public
egress allowed; RFC1918, CGNAT, link-local and the host itself dropped.
Verified from a job container: 6/6 private targets blocked, DNS,
internet and the public forge OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 03:20:45 -04:00

config.yaml

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

docker-compose.yml

ci: six runners; SSO #8 Gitea sign-in hardening (staged)

2026-09-23 02:51:56 -04:00

egress.sh

security: CI egress filter — jobs reach the internet, never Veron/LAN

2026-09-23 03:20:45 -04:00

prune.sh

ci: prune.sh must address dind over TCP (it has no unix socket)