[deploy] #9 Network-wide shadow mode #178

New issue

Closed

opened 2026-07-11 13:45:48 +00:00 by vxfemboy · 1 comment

vxfemboy commented

2026-07-11 13:45:48 +00:00

(Migrated from github.com)

M0 (#166). A global 'log what I would blackhole/FlowSpec, act on nothing' across both planes; diff intended-vs-actual before arming.
Status: NONE · Size: M · Home: blackwall-rtbh/flowspec/xdp controllers.
Pro: THE interlock that makes it safe to run a mid-dev daemon on the security boundary. Con: a first-class flag threaded through the controllers. Needs its own spec→plan.

**M0** ([#166](../166)). A global 'log what I *would* blackhole/FlowSpec, act on nothing' across both planes; diff intended-vs-actual before arming. **Status:** NONE · **Size:** M · **Home:** blackwall-rtbh/flowspec/xdp controllers. **Pro:** THE interlock that makes it safe to run a mid-dev daemon on the security boundary. **Con:** a first-class flag threaded through the controllers. Needs its own spec→plan.

vxfemboy commented

2026-07-11 19:44:46 +00:00

(Migrated from github.com)

Shipped via PR #187 (global shadow mode: RTBH/FlowSpec/XDP logged+recorded, not applied).