mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
58 lines
2.3 KiB
Markdown
58 lines
2.3 KiB
Markdown
# API Reference: Implementing GCP VPC Firewall Rules
|
|
|
|
## Libraries
|
|
|
|
### google-cloud-compute
|
|
- **Install**: `pip install google-cloud-compute`
|
|
- **Docs**: https://cloud.google.com/python/docs/reference/compute/latest
|
|
|
|
### Key Classes and Methods
|
|
|
|
| Class | Method | Description |
|
|
|-------|--------|-------------|
|
|
| `FirewallsClient` | `list(project)` | List all firewall rules |
|
|
| `FirewallsClient` | `get(project, firewall)` | Get rule details |
|
|
| `FirewallsClient` | `insert(project, firewall_resource)` | Create rule |
|
|
| `FirewallsClient` | `patch(project, firewall, firewall_resource)` | Update rule |
|
|
| `FirewallsClient` | `delete(project, firewall)` | Delete rule |
|
|
| `NetworksClient` | `list(project)` | List VPC networks |
|
|
|
|
### Firewall Rule Object Fields
|
|
- `name` -- Rule name (unique per project)
|
|
- `network` -- VPC network path
|
|
- `direction` -- `INGRESS` or `EGRESS`
|
|
- `priority` -- 0 (highest) to 65535 (lowest)
|
|
- `allowed[]` -- Protocol and port combinations to allow
|
|
- `denied[]` -- Protocol and port combinations to deny
|
|
- `source_ranges[]` -- Source CIDR ranges for ingress
|
|
- `destination_ranges[]` -- Destination CIDRs for egress
|
|
- `target_tags[]` -- Network tags to apply rule to
|
|
- `source_tags[]` -- Source instance tags
|
|
- `disabled` -- Boolean to disable without deleting
|
|
- `log_config.enable` -- Enable firewall rule logging
|
|
|
|
## Priority Ranges (Best Practice)
|
|
- 0-999: Emergency/override rules
|
|
- 1000-9999: Organization policies
|
|
- 10000-49999: Application-specific rules
|
|
- 50000-64999: Default deny rules
|
|
- 65534: Implied allow egress (GCP default)
|
|
- 65535: Implied deny ingress (GCP default)
|
|
|
|
## gcloud CLI Equivalents
|
|
- `gcloud compute firewall-rules list`
|
|
- `gcloud compute firewall-rules create NAME --allow tcp:22 --source-ranges 10.0.0.0/8`
|
|
- `gcloud compute firewall-rules delete NAME`
|
|
- `gcloud compute firewall-rules update NAME --disabled`
|
|
|
|
## Hierarchical Firewall Policies
|
|
- Organization-level: `compute.firewallPolicies`
|
|
- Folder-level: Applied via `compute.firewallPolicies.addAssociation`
|
|
- Evaluation order: Organization > Folder > VPC rules
|
|
|
|
## External References
|
|
- VPC Firewall Rules: https://cloud.google.com/vpc/docs/firewalls
|
|
- Firewall Policies: https://cloud.google.com/vpc/docs/firewall-policies
|
|
- VPC Flow Logs: https://cloud.google.com/vpc/docs/using-flow-logs
|
|
- Cloud Armor WAF: https://cloud.google.com/armor/docs
|