Decision sorb. Both questions are answered: there is no rule for 9090 or 3100 on
CFGMON and Hetzner denies inbound by default, so Weg A never had anything to
restrict; and the state now has ports-soll.md plus pruefe-ports.sh holding it.
The reservation is written down rather than glossed over: from sorb's network the
must-be-shut half cannot be proven, because the site coupling grants privileged
access there. The script says so instead of reporting false green, and an external
run - judged excessive for routine use - is named for the case that warrants it.
Whether the GAME push survives the vSwitch move belongs to #0002.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Measured from the cluster the port is shut; measured from sorb's Mac it answered,
because the lab reaches CFGMON over the site coupling, which the cloud firewall does
not filter. The rule is fine and so is the service.
What was actually broken is my check: its counter-probe proves the method works, not
that the vantage point is external. pruefe-ports.sh now probes its own location
first and refuses to score the closed-port half from a privileged network.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The CFGMON firewall has no rule for 9090 or 3100 at all. Hetzner denies inbound by
default, so the ports were never closed - they were never opened. That matches the
2026-08-01 observation exactly and makes Weg A moot for the public path.
While measuring the ports the rules do permit, port 53 answered from a public
address and resolved google.com recursively. The visible rule names only
10.58.73.17 as its source. Recorded here as a separate finding rather than decided
inside this issue.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three corrections to questions I should not have asked again.
#0103 is implemented: autoEnrollGroups points at wiki-anwender, verified in the live
database rather than from the job log. The decision was already in #0049 - the role
model was built, only the way in was missing.
#0102's blocker was in the documentation all along: maintenance-notify sends under
.de, not .chat, via IONOS on 587. The MAIL_FROM in config.example is an example, not
the operating state. So hardening .chat cannot break maintenance mail, and Authentik
remains its only .chat sender - DKIM-covered.
#0008 is not resolved by the console screenshots: they show fw-matrix-cx42, the
Matrix host, while the issue asks which rule keeps 9090 and 3100 shut on CFGMON.
Still open. What they did show is worth keeping: SSH and the Kubernetes API are
properly source-restricted, and several rules open ports to everyone where nothing
listens - including an inbound smtp 587 that cannot help the outbound sending it was
presumably added for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 2026-08-15 recheck found the ports closed but nobody had decided that and
nothing recorded it, so the next firewall change could have reopened them unseen.
notfallhandbuch:pruefe-ports.sh plus ports-soll.md close that half, measured rather
than derived, and check both directions - a reachability-only check would never
notice telemetry standing open.
Still needs sorb: the shared look at the Hetzner console. The script says what is
reachable from outside; which rules produce that, and whether they stand there on
purpose, only the console says.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Went through the seven imported waiting issues and replaced the generic
'reason is in the GitLab history' placeholder with the real blocker, which
completes #0041. Three of the seven were not merely imprecise but wrong:
- #0025: the deploy had long landed; screenshots confirm 24 aggregated messages
in the security room (limit 29), summing to the known 126 CRITICALs.
- #0014: the A/B/C decision exists as ADR-0008 (option A). Half its open question
is now answered — MATRIX has no docker group at all, so the root-equivalence
does not apply there.
- #0027: the blocking Struktur-Workshop happened on 2026-08-06 and produced three
ADRs, but W1 and W3 were spot-checked and are still unresolved.
The remaining four wait on a named action by sorb. Measured from here: the GAME
exporters are still filtered (and their silences expired on 2026-08-04, so
TargetDown has been firing every 4h since), while CFGMON's 9090/3100 are already
closed from the internet — so #0008 is about making that state deliberate rather
than an acute exposure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Gate 4, slice 4: 26 open management issues imported from live git.lab
(read-only, descriptions included as authorized; GitLab iid = file id,
labels/milestone/priority/due/host/area mapped into frontmatter, the
import aborts instead of inventing a missing milestone or priority).
Two new issues close the F-004 gap where work was really still open
(0033 OVERMIND-01, 0034 CFGMON-11 incl. the plaintext npm-token
rotation); CFGMON-12/13 already route to verified git.lab issues,
MATRIX-05 is done and needs none (agreed with sorb). The three wiki
task blocks now reference their issues, roadmap.md hands all counts to
the generated STATUS.md and states M1-M5 per ADR-0010 (closing F-001
in the canonical prose), pruefe_prosa joins the CI validate job, and
the import protocol under docs/sources/migration/ records every
intervention into imported text.
Verified: validate 0/0 over 29 issue files, gen_status --check current
(distribution line M1 9 - M2 17 - M4 2 plus per-issue milestone and
priority), pruefe_prosa 0 errors with clones and 0 errors/15 unchecked
citations in offline CI mode, drift check green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5