[TakGN]

Phase 3 of the rollout (#19, #20). enforce becomes the default in group_vars/ipfs_nodes, so lith-1 and chic-1 start dropping. sing-1's override (host_vars/sing-1/firewall.yml) is deleted, which changes nothing on sing-1. sf and sf2 are untouched: they keep count in group_vars/infra_boxes, and an operator applies them with cve.yml, never CI.

Why now

• Count phase: all three boxes counted from about 13:20 UTC. In the first hour there were 0 IP-options packets, and only 1–5 MPTCP SYNs per box.
• sing-1 has enforced since 14:48 UTC. SSH, pods, needle 8190–8193 and the k3s, ufw and fail2ban rules all checked fine. Established TCP held at about 11–12k.
• The rule is proven on sing-1's live rules. As the ipni user, without sudo, sing-1 connected to its own public IP on port 22 with the record-route IP option set. All 6 SYNs, the first and its retries, were dropped before the TCP stack, and the ipv4 options counter went from 0 to 6. A plain connect to the same port succeeded at once.
• Testing from outside proves nothing here. IP-options SYNs from an operator's ISP and from lith-1 never reached sing-1 (none in tcpdump, counter unchanged), so something on those paths drops them. The README now describes the probe on the box itself, and says to run it only on a box that already enforces.

What changes (local site.yml --check --diff, all three boxes)

• lith-1 and chic-1: the ruleset gains drop, reset tcp option mptcp and the mptcp repeated drop. Then one reload, a single atomic nft -f that restarts nothing.
• sing-1: nothing on the box. Its only changes are the usual local kubeconfig writes.

CI applies one box at a time and stops at the first failure.

After the apply, on lith-1 and chic-1

• The table shows two drop rules and one reset tcp option mptcp.
• The probe on the box itself: the ipv4 options counter goes up by one for each SYN, and a plain connect still works.
• A fresh SSH login works, pods are running, and needle 8190–8193 answers.
• needle and route-origin are steady for a while afterwards.

Undo on one box: sudo systemctl stop cve-2026-98432-filter, then set that box to count in its host_vars. Otherwise the next site.yml run puts enforce back.

Still open: the real fix is Ubuntu's patched kernel, then a reboot one box at a time, with the needle warm-up on each.

🤖 Generated with Claude Code