Admin: Automated edit (via update-page on MediaWiki MCP Server)

2026-07-06T03:10:17Z

Automated edit (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 08:40, 6 July 2026
Line 47:		Line 47:
	* For Ansible: enable <code>ansible-pull</code> logging to a central location		* For Ansible: enable <code>ansible-pull</code> logging to a central location
	* Physical: lock server cases, use tamper-evident seals, restrict USB boot		* Physical: lock server cases, use tamper-evident seals, restrict USB boot

			{{Navbox TELEICU}}

	{{Related}}		{{Related}}

Admin: Create TELEICU configuration drift runbook (via create-page on MediaWiki MCP Server)

2026-07-06T02:54:21Z

Create TELEICU configuration drift runbook (via create-page on MediaWiki MCP Server)

New page

{{Doc header
|type=runbook
|domain=teleicu
|title=Configuration drift runbook
|order=14
}}

Procedures for detecting and remediating configuration drift.

== Detection ==

=== Ansible path ===

* <code>ansible-pull</code> runs on timer and reports changed/changed state
* Non-compliant files are reverted each cycle
* Any manual change is detected on the next pull and overwritten
* Audit: <code>git diff</code> in the ansible repo shows what changed between pulls

=== NixOS path ===

* Drift is structurally impossible at the OS level — /etc is in the Nix store (read-only)
* Any tamper attempt at runtime fails with "Read-only file system"
* At generation level: <code>nixos-rebuild list-generations</code> shows the active generation
* If someone boots a different generation, comin will apply the current one on next poll

== Remediation ==

=== Ansible path ===

# Identify the drift: check the ansible-pull log for <code>changed</code> tasks that should not have changed
# If the drift is from an outdated playbook, update the playbook and push to repo
# If the drift is from tampering, investigate physical security at the site
# Force an immediate pull: <code>ansible-pull -U <repo></code> on the affected node
# Review site access logs to identify who tampered

=== NixOS path ===

# Check if the node is on the expected generation: compare <code>/run/current-system</code> hash with the flake's output hash
# If not, trigger comin to pull the latest generation
# If comin is failing, use deploy-rs as backup to push the correct generation
# Investigate physical access — a NixOS node cannot be tampered with at runtime, so any divergence means someone booted a different generation or replaced the disk

== Prevention ==

* Ensure all nodes have the correct pull interval configured
* For NixOS: remove boot entries for old generations (nixos-rebuild with <code>--max-generations</code>)
* For Ansible: enable <code>ansible-pull</code> logging to a central location
* Physical: lock server cases, use tamper-evident seals, restrict USB boot

{{Related}}

TELEICU/Configuration drift runbook - Revision history

Admin: Automated edit (via update-page on MediaWiki MCP Server)

Admin: Create TELEICU configuration drift runbook (via create-page on MediaWiki MCP Server)