wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(security): 新增主機服務配置只讀清冊
Some checks failed
CD Pipeline / tests (push) Successful in 1m28s
Details
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-11 21:41:41 +08:00
parent 0a82648ef6
commit 118967cabc
16 changed files with 1362 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/security/high-value-config-control-coverage.snapshot.json
View File

@@ -327,15 +327,17 @@
"action_buttons_allowed": false,
"category_id": "docker_compose_systemd_host_config",
"control_tier": "C1",
"coverage_percent": 42,
"coverage_status": "inventory_needed",
"current_gap": "110 / 188 Docker Compose、systemd、port / volume / env 差異仍需只讀 inventory。",
"coverage_percent": 50,
"coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence",
"current_gap": "repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標。",
"evidence_refs": [
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
"docs/security/HOST-SERVICE-CONFIG-INVENTORY.md",
"docs/security/host-service-config-inventory.snapshot.json",
"docs/security/DEV-HOSTS-112-111-168-OBSERVE-ONLY-MAPPING.md"
],
"label": "Docker Compose / systemd / host service config",
"next_owner_action": "補 compose / systemd owner、restart window、rollback owner 與 post-check 指標。",
"next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、restart window、rollback owner 與 post-check 指標。",
"owner_response_accepted": false,
"owner_response_received": false,
"owner_response_required": true,
@@ -518,16 +520,9 @@
"secret_value_collection_allowed": false,
"workflow_modification_authorized": false
},
"generated_at": "2026-06-11T21:30:00+08:00",
"git_commit": "d448ae36",
"generated_at": "2026-06-11T23:21:00+08:00",
"git_commit": "0a82648e",
"lowest_coverage_categories": [
{
"category_id": "docker_compose_systemd_host_config",
"coverage_percent": 42,
"current_gap": "110 / 188 Docker Compose、systemd、port / volume / env 差異仍需只讀 inventory。",
"label": "Docker Compose / systemd / host service config",
"next_owner_action": "補 compose / systemd owner、restart window、rollback owner 與 post-check 指標。"
},
{
"category_id": "ssh_firewall_network_access",
"coverage_percent": 48,
@@ -535,6 +530,13 @@
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
"next_owner_action": "補 target whitelist、host key policy、network owner、maintenance window 與 rollback owner。"
},
{
"category_id": "docker_compose_systemd_host_config",
"coverage_percent": 50,
"current_gap": "repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標。",
"label": "Docker Compose / systemd / host service config",
"next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、restart window、rollback owner 與 post-check 指標。"
},
{
"category_id": "backup_restore_credential",
"coverage_percent": 52,