!521 · krz/gitbay

.gitbay/wiki/Architecture/09-Controls.org +1 −1

		@@ -88,7 +88,7 @@ chapter names of OWASP ASVS 4.0 where one fits.
88	88	\| No secrets for untrusted builds \| in place \| =internal/control/build.go= \|
89	89	\| Runner limited to attached repositories \| in place \| =runnerMayBuild= (=build.go=) \|
90	90	\| Build images fixed by the operator \| in place \| =--pull=never= \|
91		\| Build network egress restricted \| partial \| by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. Not yet measured from a build (#260) \|
	91	\| Build network egress restricted \| in place \| by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. measured on bay1 2026-09-29 (CI page) \|
92	92	\| Build results reused only across equal trust \| in place \| =SuccessBuildForTree=, =SuccessBuildFor= (=internal/store/builds.go=) \|
93	93
94	94	** Availability and operations

.gitbay/wiki/Architecture/10-Known-Gaps.org −2

		@@ -11,7 +11,6 @@ what the 2026-09-27 review found; remove a row when its issue closes.
11	11	\| Issue \| Area \| Gap \| Severity \|
12	12	\|-------+------------------+-----------------------------------------------------------------------+----------\|
13	13	\| #259 \| Recovery \| No restore has been exercised; the procedure and tooling (=admin restore-drill=, =backup --verify=) are in place, the clean-host drill is pending \| high \|
14		\| #260 \| CI network \| Separation and egress tables written; not yet measured from a build on bay1 (=deploy/runner-auth-flood-test.sh=) \| medium \|
15	14	\| #261 \| Various \| Migration foreign-key check after commit; three web writes bypass dispatch; documentation drift \| medium \|
16	15
17	16	* Not filed
		@@ -30,5 +29,4 @@ what the 2026-09-27 review found; remove a row when its issue closes.
30	29	\|-----------------------------------------------------------+------------------------------------------\|
31	30	\| What is the measured recovery time? \| unmeasured (#259) \|
32	31	\| How many concurrent clones does the host sustain? \| unmeasured (#262) \|
33		\| What can a build reach on the host's network? \| policy on the CI page; reachability untested until the flood test runs (#260) \|
34	32	\| Have the collaboration features been used by independent users? \| no; one human user, tests only \|

.gitbay/wiki/CI.org +23

		@@ -101,6 +101,29 @@ until the limiter locks its address, and the script checks that the
101	101	runner still reported the build and kept polling, and that the build's
102	102	log shows what the table allowed and refused.
103	103
	104	** Measured on bay1
	105
	106	2026-09-29, runner and daemon at 8b73af2, kernel 6.12.107, nftables
	107	1.1.3, podman 5.4.2, the runner scoped to =cmc/runner-scratch=. pasta
	108	ran in the build's cgroup both times
	109	(=builds/trusted/build-2144=, =builds/untrusted/build-2146=). Both runs
	110	passed.
	111
	112	\| Probe \| trusted \| untrusted \|
	113	\|----------------------+------------------+------------------\|
	114	\| DNS \| ok \| ok \|
	115	\| 169.254.1.2:22/80/443 \| open \| refused \|
	116	\| 169.254.1.2:2222 \| refused \| refused \|
	117	\| 10.0.0.1:80, 192.168.0.1:80 \| refused \| refused \|
	118	\| proxy.golang.org:443 \| open \| open \|
	119	\| github.com:22 \| open \| refused \|
	120	\| 12 logins \| 12 denied (sshd) \| 12 refused (table) \|
	121
	122	The trusted build's logins arrived from the host's public address,
	123	46.232.248.67: ten =auth.expired= and one =auth.throttled= for it, none
	124	for =127.0.0.1=. The untrusted build's logins never reached sshd. The
	125	runner kept polling through both builds.
	126
104	127	* The table
105	128
106	129	One =ci.yml= with five jobs, each isolating one rule:

deploy/runner-auth-flood-test.sh +2 −2

		@@ -56,7 +56,7 @@ job=flood260
56	56	tmp=$(mktemp -d)
57	57	fp=
58	58	cleanup() {
59		if [ -n "$fp" ]; then gitbay keys remove "$fp" >/dev/null \|\| echo "remove key $fp by hand" >&2; fi
	59	if [ -n "$fp" ]; then gitbay auth keys remove "$fp" >/dev/null \|\| echo "remove key $fp by hand" >&2; fi
60	60	fp=
61	61	rm -rf "$tmp"
62	62	}
		@@ -65,7 +65,7 @@ trap 'cleanup; exit 130' INT TERM
65	65
66	66	echo "==> an expired key"
67	67	ssh-keygen -q -t ed25519 -N '' -C auth-flood-260 -f "$tmp/key"
68		gitbay keys add --scope git --label auth-flood-260 --ttl 1s <"$tmp/key.pub" >/dev/null
	68	gitbay auth keys add --scope git --label auth-flood-260 --ttl 1s <"$tmp/key.pub" >/dev/null
69	69	fp=$(ssh-keygen -lf "$tmp/key.pub" \| awk '{print $2}')
70	70	sleep 2
71	71

wiki: build egress measured on bay1 !521