[TakGN]

What

sf and sf2 (ipni/infra's indexers) get the CVE-2026-98432 host filter, in count mode to start.

• inventory/hosts.yml: a new group, infra_boxes, with sf and sf2. It is not part of ipfs_nodes.
• group_vars/infra_boxes/main.yml: ansible_user: user, ansible_port: 5222, cve_2026_98432_mode: count.
• cve.yml: runs only roles/hardening/tasks/cve_2026_98432.yml on infra_boxes, with sudo, one box at a time, stopping at the first failure.
• roles/hardening/defaults/main.yml: cve_2026_98432_ruleset moves here from a var on the import, so tasks_from picks it up. site.yml renders the same paths as before.
• CI's syntax-check loop includes cve.yml. CI does not apply it.
• README, AGENTS.md and the comment in roles/monitoring/defaults/main.yml are updated.

Why

Neither box's kernel has the fix:

• sf: Debian 12.15, kernel 6.1.180
• sf2: Debian 12.10, kernel 6.1.135
• Debian fixed it in 6.1.190-1 (bookworm-security).

Nothing filters inbound traffic on either box.

Why a group of its own

Every playbook and script here targets ipfs_nodes (or looks a host up by name or IP), so infra_boxes is picked up by nothing but cve.yml. Putting sf/sf2 in ipfs_nodes would let site.yml's hardening replace their SSH keys and turn on ufw, which would cut them off.

Reviewer notes

• Operator runs only. sudo on sf/sf2 wants the user account's password, so cve.yml runs with -K. CI has neither the key nor the password, and shouldn't.
• CI on this PR. It touches roles/hardening/tasks/main.yml, so site.yml gets its dry run. That dry run should show no change on the ipfs_nodes boxes: the ruleset path is the same, only where it's set moved.
• The boxes can run the enforce rules. Both run nft 1.0.6 on kernel 6.1. The rendered enforce ruleset (all three rules) loaded and listed back on both, in a throwaway user and network namespace, with no root and no change to the host.
• Checked locally:
  • All 7 playbooks pass --syntax-check.
  • ansible-inventory: sing-1 still gets ipni on port 22; sf gets user on 5222.
  • ansible infra_boxes -m ping answers from both boxes.
  • cve.yml --check --diff -l sf with sudo turned off: 0 failed, and the ruleset, unit and directory show as would-change.
  • yamllint is clean.
  • ansible-lint shows the same 7 findings as on main. All 7 are the local machine failing to resolve collection modules in roles this PR doesn't touch.

After merge

1. ansible-playbook cve.yml -K --check --diff -l sf, then without --check. The same for sf2.
2. Read sudo nft list table inet cve_2026_98432 for an hour or so.
3. enforce one box at a time through host_vars/<box>/, as with sing-1.

Follow-ups:

• The real fix is kernel 6.1.190-1 and a reboot on both boxes.
• ipni/infra's docs/03-monitoring.md and AGENTS.md say ipni/workers doesn't manage sf/sf2's firewalls. They need updating once this merges.

🤖 Generated with Claude Code