mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
76 lines
2.3 KiB
Markdown
76 lines
2.3 KiB
Markdown
# Tailscale Deployment Planning Template
|
|
|
|
## Network Architecture
|
|
|
|
- **Organization**: _______________
|
|
- **Tailnet Name**: _______________
|
|
- **Identity Provider**: _______________
|
|
- **Key Expiry Policy**: _______________
|
|
- **Self-hosted (Headscale)**: [ ] Yes [ ] No
|
|
|
|
## User Groups
|
|
|
|
| Group Name | Description | Members Count | Access Level |
|
|
|---|---|---|---|
|
|
| group:engineering | Development team | ___ | Development, Staging |
|
|
| group:sre | SRE/DevOps team | ___ | All environments |
|
|
| group:security | Security team | ___ | Monitoring, Audit |
|
|
| group:management | Leadership | ___ | Dashboards only |
|
|
|
|
## Infrastructure Tags
|
|
|
|
| Tag | Description | Owner Group | Environment |
|
|
|---|---|---|---|
|
|
| tag:production | Production servers | group:sre | Production |
|
|
| tag:staging | Staging servers | group:engineering | Staging |
|
|
| tag:development | Dev servers | group:engineering | Development |
|
|
| tag:database | Database servers | group:sre | All |
|
|
| tag:monitoring | Monitoring stack | group:sre | All |
|
|
|
|
## Subnet Routes
|
|
|
|
| CIDR | Description | Router Node | Auto-Approved |
|
|
|---|---|---|---|
|
|
| 10.0.0.0/16 | Corporate network | ___ | [ ] Yes |
|
|
| 192.168.0.0/24 | Lab network | ___ | [ ] Yes |
|
|
|
|
## Exit Nodes
|
|
|
|
| Hostname | Location | Purpose | Auto-Approved |
|
|
|---|---|---|---|
|
|
| ___ | ___ | Internet routing | [ ] Yes |
|
|
| ___ | ___ | Geo-specific access | [ ] Yes |
|
|
|
|
## Security Checklist
|
|
|
|
- [ ] Identity provider configured with MFA
|
|
- [ ] Key expiry enabled (recommended: 90 days)
|
|
- [ ] ACLs configured with deny-all default
|
|
- [ ] Network Lock enabled
|
|
- [ ] SSH access requires re-authentication for privileged users
|
|
- [ ] Audit logging enabled
|
|
- [ ] Subnet routes approved only for authorized nodes
|
|
- [ ] Exit nodes approved only for authorized nodes
|
|
- [ ] Untagged node policy defined
|
|
- [ ] Ephemeral keys used for CI/CD and temporary workloads
|
|
|
|
## Rollout Plan
|
|
|
|
### Phase 1: Infrastructure
|
|
- [ ] Deploy to servers and critical infrastructure
|
|
- [ ] Configure subnet routers
|
|
- [ ] Set up exit nodes
|
|
- [ ] Test ACL enforcement
|
|
|
|
### Phase 2: User Onboarding
|
|
- [ ] Pilot group deployment
|
|
- [ ] Full organization rollout
|
|
- [ ] VPN migration (decommission legacy VPN)
|
|
- [ ] User training and documentation
|
|
|
|
### Phase 3: Hardening
|
|
- [ ] Enable Network Lock
|
|
- [ ] Enable Tailscale SSH with session recording
|
|
- [ ] Configure auto-approvers
|
|
- [ ] Set up monitoring and alerting
|