kevinveenbirkenbachandClaude Opus 5 f9f010b444 docs(svc-net-firewall): drop the use case a fragment cannot serve ...

The role advertised holding a forwarding or masquerade rule for a tunnel. A fragment cannot do that: it lives in its own table, and an accept there terminates only its own base chain, so a DROP policy another component set still executes. svc-net-wireguard-firewalled was measured losing every forwarded packet that way.

The use case is replaced by one the design does serve, and the rule that decides it is written down where the next author will look rather than left in a commit body.

The fragment test no longer seeds the two wireguard interface names; the fragment they described is gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-15 20:32:35 +02:00

..

cli

style(inventory): wrap the keycloak users fixture the way autoformat does

2026-09-14 20:50:27 +02:00

group_vars

fix(litellm): publish a backend only when the gateway's own flag enables it

2026-09-15 02:06:38 +02:00

library

…

plugins

refactor(container_ports): express the remaining published ports through the lookup

2026-09-15 14:55:25 +02:00

roles

docs(svc-net-firewall): drop the use case a fragment cannot serve

2026-09-15 20:32:35 +02:00

scripts

fix(diagnostics): let the in-zone probes read the drop-in that holds the zone

2026-09-03 12:50:58 +02:00

utils

fix(domains): render the tor flags before the onion map reads them

2026-09-15 11:20:40 +02:00

__init__.py

…