[deploy][M0] Foundations + detection-only (shadow) #166

New issue

Open

opened 2026-07-11 13:44:14 +00:00 by vxfemboy · 3 comments

vxfemboy commented

2026-07-11 13:44:14 +00:00

(Migrated from github.com)

Milestone tracker. Deploy blackwalld on sockpuppet as an Incus container, one iBGP session to BIRD, sFlow from the POPs, detecting but not acting (shadow). Gate to exit: N days of shadow logs match reality.

Features:

#1 POP sensor / sFlow shipper (DONE — telemetry ingest, PR #165)
#2 Anycast-aware aggregation (DONE — PR #165)
#23 One-command bootstrap
#6 Incus container + source-IPs
#7 purrmetheus dashboard + alerts
#3 BIRD iBGP-snippet generator
#9 Network-wide shadow mode

Long pole was #1+#2 (done). Critical path: #23 → #6 → (#3 ∥ done-telemetry) → #9 → deploy detection-only.

Milestone tracker. Deploy blackwalld on sockpuppet as an Incus container, one iBGP session to BIRD, sFlow from the POPs, **detecting but not acting** (shadow). Gate to exit: N days of shadow logs match reality. **Features:** - [x] #1 POP sensor / sFlow shipper (DONE — telemetry ingest, PR #165) - [x] #2 Anycast-aware aggregation (DONE — PR #165) - [ ] #23 One-command bootstrap - [ ] #6 Incus container + source-IPs - [ ] #7 purrmetheus dashboard + alerts - [ ] #3 BIRD iBGP-snippet generator - [ ] #9 Network-wide shadow mode Long pole was #1+#2 (done). Critical path: #23 → #6 → (#3 ∥ done-telemetry) → #9 → deploy detection-only.

vxfemboy commented

2026-07-11 19:45:07 +00:00

(Migrated from github.com)

#9 shadow mode — DONE (PR #187, merged). Global shadow config directive: RTBH/FlowSpec/XDP mitigations are logged + metered (blackwall_shadow_would_mitigate_total{plane,action}) + audit-logged (/v1/audit), never executed; persistent mirror stays empty so a shadow→live restart can't promote never-vetted entries. Non-breaking.

M0 remaining: #3 BIRD-gen (#172), #6 Incus (#175), #7 purrmetheus (#176), #23 bootstrap (#185).

**#9 shadow mode — DONE** (PR #187, merged). Global `shadow` config directive: RTBH/FlowSpec/XDP mitigations are logged + metered (`blackwall_shadow_would_mitigate_total{plane,action}`) + audit-logged (`/v1/audit`), never executed; persistent mirror stays empty so a shadow→live restart can't promote never-vetted entries. Non-breaking. M0 remaining: #3 BIRD-gen (#172), #6 Incus (#175), #7 purrmetheus (#176), #23 bootstrap (#185).

vxfemboy commented

2026-07-12 06:02:33 +00:00

(Migrated from github.com)

#23 bootstrap + #6 Incus container — artifacts authored (deploy repo branch blackwall-m0, off auth-nameservers). Blackwalld flow packaged as an incusbr0-only Incus container running shadow/detection-only: build.sh (bootstrap — postgres DB/role, container, binary+systemd unit, DB env; pg-backups auto-covers the DB), install-in-container.sh, blackwall.conf.tmpl (ships shadow), a host blackwall-sflow-forward.sh DNAT, and docs/BLACKWALL.md runbook. iBGP over incusbr0 via the shipped blackwalld bird-config. Not merged/applied — operator review + apply. Remaining M0: #7 purrmetheus (#176).

**#23 bootstrap + #6 Incus container — artifacts authored** (deploy repo branch `blackwall-m0`, off `auth-nameservers`). Blackwalld `flow` packaged as an incusbr0-only Incus container running **shadow/detection-only**: `build.sh` (bootstrap — postgres DB/role, container, binary+systemd unit, DB env; pg-backups auto-covers the DB), `install-in-container.sh`, `blackwall.conf.tmpl` (ships `shadow`), a host `blackwall-sflow-forward.sh` DNAT, and `docs/BLACKWALL.md` runbook. iBGP over incusbr0 via the shipped `blackwalld bird-config`. **Not merged/applied — operator review + apply.** Remaining M0: #7 purrmetheus (#176).

vxfemboy commented

2026-07-12 06:21:16 +00:00

(Migrated from github.com)

M0 artifacts COMPLETE. All M0 pieces exist: blackwall code (telemetry #1/#2, shadow #9, BIRD-gen #3, all merged) + deploy glue (#23 bootstrap + #6 container + #7 purrmetheus, authored on deploy branch blackwall-m0). The detection-only shadow deploy is fully buildable. Remaining M0 = operator apply (run build.sh on sockpuppet, fill config, wire BIRD/sFlow/monitoring — see docs/BLACKWALL.md) + a shadow observation period. Then M1 (arm with safety).

**M0 artifacts COMPLETE.** All M0 pieces exist: blackwall code (telemetry #1/#2, shadow #9, BIRD-gen #3, all merged) + deploy glue (#23 bootstrap + #6 container + #7 purrmetheus, authored on deploy branch `blackwall-m0`). The detection-only shadow deploy is fully buildable. **Remaining M0 = operator apply** (run build.sh on sockpuppet, fill config, wire BIRD/sFlow/monitoring — see docs/BLACKWALL.md) + a shadow observation period. Then M1 (arm with safety).