Commit Graph

5 Commits

Author SHA1 Message Date
Claude
3542afbe28 feat: Add YAML frontmatter to all 57 task READMEs
Phase 1 of task management consolidation (per Gemini consultation).

Added standardized frontmatter with:
- status: open | blocked | complete
- priority: P1 | P2 | P3 | P4
- owner: Michael | Meg | Holly
- created: YYYY-MM-DD

Final counts:
- 39 open tasks
- 17 complete tasks
- 1 blocked task

Metadata extracted from existing inline markdown and audit results.
Ready for Phase 2: 11ty mobile index generation.

Chronicler #69
2026-04-08 14:21:41 +00:00
Claude
ebb66b3cc2 priority: elevate Frostwall Protocol to top priority
Email is needed urgently — Holly staff email, staff comms,
subscriber notifications. Frostwall → Mailcow is the only
path. Elevated March 10, 2026.

Created by Chronicler #29
2026-03-10 23:34:34 +00:00
Claude
1722dfb17e docs: Add Command Center security hardening deployment guide
Created comprehensive security hardening guide (500+ lines):

Defense-in-Depth Strategy:
- Layer 1: Fail2Ban auto-banning
- Layer 2: SSH key-only authentication
- Layer 3: UFW firewall optimization

5-Phase Deployment (1 hour total):
- Phase 1: Test SSH key access (CRITICAL - prevents lockout)
- Phase 2: Install and configure Fail2Ban (20 min)
- Phase 3: SSH hardening (20 min)
- Phase 4: UFW firewall review (15 min)
- Phase 5: Additional security (automatic updates, AIDE)

Security Features:
- Fail2Ban monitors SSH, Nginx, bad bots
- SSH: Key-only auth, MaxAuthTries=3, rate limiting
- UFW: Management IP whitelist, unnecessary ports closed
- Automatic security updates
- File integrity checking (AIDE)

Critical Safety Measures:
- Mandatory SSH key testing before disabling passwords
- Keep session open while testing
- Backup access via console/IPMI
- Step-by-step verification at each phase
- Comprehensive troubleshooting (lockout recovery)

Monitoring & Maintenance:
- Daily: Check Fail2Ban bans and auth logs
- Weekly: Review UFW logs and security updates
- Monthly: AIDE file integrity check

Ready to deploy when SSH access available.
Risk level: MEDIUM (can lock out if keys not tested)

Task: Command Center Security Hardening (Tier 1)
FFG-STD-002 compliant
2026-02-17 23:59:44 +00:00
Claude
2bd96ee8c7 docs: Complete Frostwall Protocol deployment documentation
Created comprehensive documentation for Frostwall Protocol rebuild:

deployment-plan.md (500+ lines):
- Complete 7-phase implementation guide
- GRE tunnel configuration for Command Center ↔ TX1/NC1
- Iron Wall UFW firewall rules
- NAT/port forwarding setup
- Self-healing tunnel monitoring with auto-recovery
- DNS configuration
- Testing and verification procedures
- Rollback plan
- Performance considerations

ip-hierarchy.md (400+ lines):
- Three-tier IP architecture explained
- Complete service mapping table (all 11 game servers)
- GRE tunnel IP addressing
- Traffic flow diagrams
- DNS configuration reference
- Security summary
- Quick command reference

troubleshooting.md (450+ lines):
- Quick diagnostics checklist
- Common problems with step-by-step solutions:
  - Tunnel won't come up
  - Can't ping tunnel IP
  - Port forwarding not working
  - Tunnel breaks after reboot
  - Self-healing monitor issues
  - High latency/packet loss
  - UFW blocking traffic
- Emergency recovery procedures
- Common error messages decoded
- Health check commands

This documentation enables rebuilding the Frostwall Protocol from scratch
with proper IP hierarchy, DDoS protection, and self-healing capabilities.

Unblocks: Mailcow deployment, AI stack, all Tier 2+ infrastructure

Task: Frostwall Protocol (Tier 1, Critical)
FFG-STD-002 compliant
2026-02-17 15:01:35 +00:00
74d94e1c24 Create frostwall-protocol task directory
Task 5 migration (CRITICAL Tier 1).

The Frostwall: GRE tunnel DDoS protection.
Foundation for all infrastructure.

3-4 hour deployment.

Date: 2026-02-16
2026-02-16 06:55:39 -06:00