From 2e3f2b5db793ec52f1f45f11788e5a6909a65a5a Mon Sep 17 00:00:00 2001 From: Ty Date: Sat, 26 Sep 2026 17:05:20 +0000 Subject: [PATCH] Record firewall rules enabled; forwarder still pending --- .../04_projects/veripath/fleet-2026-09-26.md | 29 ++++++------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md index bde3139..54fab04 100644 --- a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md +++ b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md @@ -1,6 +1,6 @@ # VeriPath fleet snapshot -Updated: 2026-09-26 10:03 PT +Updated: 2026-09-26 10:04 PT Do not store passwords, tokens, or keys in this file. ## Operating model @@ -13,39 +13,28 @@ Do not store passwords, tokens, or keys in this file. ## Adopted rules (2026-09-26) - Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email. -- Do not expose `100.64.0.1:8787` until allow-Regis plus block-everyone-else firewall rules exist. - After firewall: small forwarder `100.64.0.1:8787` -> `127.0.0.1:8787`. Status-check test only. - Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale. ## Persistence -S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Tasks: `\VeriPath\Hermes_WebUI`, `\VeriPath\Cloudflared_Tunnel`, `\VeriPath\Hermes_Gateway_leonard`. -Launchers: `C:\Users\fight\AppData\Local\VeriPath\`. +S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Web app: `127.0.0.1:8787` only. Healthy. Tunnel `/health` 200. Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`. -Live URL file: `%LOCALAPPDATA%\cloudflared\current-url.txt`. Password only in `C:\Users\fight\Projects\hermes-webui\.env`. -Leonard runs elevated. Unknown 09:48 Leonard start attempt, parked. +## Regis line (2026-09-26 10:04 PT) -## Regis line (2026-09-26 10:03 PT) +Firewall done. Both rules Enabled, PrimaryStatus OK: +- `VeriPath WebUI from Regis` — Inbound Allow +- `VeriPath WebUI block non-Regis` — Inbound Block -Stopped. Nothing exposed. Listen address not changed. +Listen address not changed yet. Next is CoS forwarder under `\VeriPath\Hermes_WebUI` only, then Regis status-check. -Blocker: firewall rules need admin. Existing `python.exe` rule allows inbound any port from any address, so an allow-Regis rule alone would leave all of Headscale able to reach a `100.64.0.1` listener. - -Gatekeeper command, once, admin PowerShell: - -``` -New-NetFirewallRule -DisplayName 'VeriPath WebUI from Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 100.64.0.6 -Action Allow; New-NetFirewallRule -DisplayName 'VeriPath WebUI block non-Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 0.0.0.0-100.64.0.5,100.64.0.7-126.255.255.255,128.0.0.0-255.255.255.255 -Action Block -``` - -After `firewall done`, CoS adds a forwarder under the web app task, restarts only that task, then Regis status-check. - -Also reported, not changed: same allow-everything Python rules on `C:\Program Files\Python312` and a copy under `OneDrive\Desktop\data\assets`. +Also reported, not changed: `python.exe` allow-everything rules on the web app Python, `C:\Program Files\Python312`, and a copy under `OneDrive\Desktop\data\assets`. ## Open / next -1. Gatekeeper runs the two firewall rules. +1. Done: firewall rules. 2. CoS forwarder + Regis status-check. 3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, Telegram / NAT, Coach, default-profile token, client backlog.