[TakGN]

Phase 2 of the rollout from #19. sing-1 switches from count to enforce; lith-1 and chic-1 keep counting.

Don't merge until the count phase looks clean. Read the counters on all three boxes after about an hour of counting:

ansible ipfs_nodes -u ipni -b -m shell -a 'nft list table inet cve_2026_98432 | grep counter'

If the ipv4 options counter shows real traffic rather than scanners, look at it first:

sudo tcpdump -ni any -c 20 'tcp[tcpflags] & tcp-syn != 0 and ip[0] & 0xf != 5'

What changes

Only host_vars/sing-1/firewall.yml, which sets cve_2026_98432_mode: enforce. Locally, site.yml --check --diff against all three boxes shows:

• sing-1: the ruleset gets drop on the IP-options rule, reset tcp option mptcp on the MPTCP rule, and the extra mptcp repeated drop rule. Then one reload, a single atomic nft -f that restarts nothing.
• lith-1 and chic-1: nothing changes on the box. The reload check compared their live tables with the file and found them equal, even with lith-1's non-zero MPTCP counter.

After the apply, on sing-1

• The table shows two drop rules and one reset tcp option mptcp.
• From outside, sudo nping --tcp -p 22 --ip-options R -c 3 5.199.165.77 gets no SYN-ACK, and the ipv4 options counter goes up by 3.
• A fresh SSH login works, pods are running, and needle 8190–8193 answers. route-origin serves through Cloudflare.
• Rollback comes back: load a count copy of the ruleset by hand, re-run site.yml from CI with --limit sing-1, and it reloads to enforce.
• sudo systemctl stop cve-2026-98432-filter removes the table, and start puts it back.
• needle and route-origin are steady for 30–60 minutes. Then the follow-up PR moves enforce into group_vars and deletes this file.

Undo: sudo systemctl stop cve-2026-98432-filter on sing-1, then revert this PR. Otherwise the next site.yml run puts enforce back.

🤖 Generated with Claude Code