public/docs
6
0
Fork 0
Code Issues Pull requests Activity

docs: document enclave ingress and egress allowlists #36

Closed
vkobel wants to merge 1 commit from feat/reject-unsupported-egress into main
pull from: feat/reject-unsupported-egress
merge into: public:main
Conversation 1 Commits 1 Files changed 2 +130 -15
vkobel commented 2026-09-14 17:53:11 +00:00 (Migrated from codeberg.org)
Copy link

Summary

Companion documentation for platform PR #457.

  • Replace the obsolete egress on/off limitation with the implemented IPv4 ingress/egress allowlist contract, validation limits and a selective-egress example.
  • Document DNS relay permissions, recovery source policy, private HTTP upstreams and current Attested-TLS restrictions consistently across the HCL and deployment references.
  • Distinguish reserved local listener ports from remote egress destination ports, and describe the host enforcement boundary and pre-rollout smoke test.
  • Keep the user-facing material in the existing reference pages rather than adding a duplicate platform documentation page.

Rebased onto current docs main 6589593a40398077551b601901df389171ba6340. Current head 6c4894ce8f4bc458eb840626fbb82e4bdd53fb8b is one signed commit preserving the existing author/date, changing only docs/reference/caution-hcl.md and docs/reference/deployment-configuration.md.

Test plan and results

  • PATH=/usr/bin:/bin make build-prod IMAGE_NAME=caution-docs-pr457-cleanup — passed on the exact docs head; Zensical reported no issues.
  • Extracted all six standalone network HCL examples from the two changed pages and validated them with hcl::from_str::<ConfigurationFile> followed by NetworkConfig::policy() from exact platform head 63f98c1676ea9a3135e934c0439f35c84b1fbbf7 — all six passed.
  • Checked all 546 local links, including fragment targets, from the two rendered reference pages — no broken targets.
  • git diff --check 6589593a...HEAD and clean integration with main — passed.

No site deployment was performed. Coordinate publication with the platform feature; its focused deployed AWS/Nitro networking qualification remains separate from these documentation checks.

## Summary Companion documentation for [platform PR #457](https://git.caution.co/public/platform/pulls/457). - Replace the obsolete egress on/off limitation with the implemented IPv4 ingress/egress allowlist contract, validation limits and a selective-egress example. - Document DNS relay permissions, recovery source policy, private HTTP upstreams and current Attested-TLS restrictions consistently across the HCL and deployment references. - Distinguish reserved local listener ports from remote egress destination ports, and describe the host enforcement boundary and pre-rollout smoke test. - Keep the user-facing material in the existing reference pages rather than adding a duplicate platform documentation page. Rebased onto current docs main `6589593a40398077551b601901df389171ba6340`. Current head `6c4894ce8f4bc458eb840626fbb82e4bdd53fb8b` is one signed commit preserving the existing author/date, changing only `docs/reference/caution-hcl.md` and `docs/reference/deployment-configuration.md`. ## Test plan and results - `PATH=/usr/bin:/bin make build-prod IMAGE_NAME=caution-docs-pr457-cleanup` — passed on the exact docs head; Zensical reported no issues. - Extracted all six standalone network HCL examples from the two changed pages and validated them with `hcl::from_str::<ConfigurationFile>` followed by `NetworkConfig::policy()` from exact platform head `63f98c1676ea9a3135e934c0439f35c84b1fbbf7` — all six passed. - Checked all 546 local links, including fragment targets, from the two rendered reference pages — no broken targets. - `git diff --check 6589593a...HEAD` and clean integration with main — passed. No site deployment was performed. Coordinate publication with the platform feature; its focused deployed AWS/Nitro networking qualification remains separate from these documentation checks.
anton force-pushed feat/reject-unsupported-egress from 853d26c725 to 6c4894ce8f 2026-10-17 03:16:58 +00:00 Compare
anton changed title from Document supported on-off egress configuration to docs: document enclave ingress and egress allowlists 2026-10-17 03:16:58 +00:00
anton commented 2026-10-19 20:10:58 +00:00
Owner
Copy link

Superseded by #43, the unified release documentation update. It consolidates this proposal with the other open docs updates and corrects the combined guidance against platform main 2dd613e3.

Closing this PR to keep one review/release path. The original branch is retained; the replacement is not merged.

Superseded by #43, the unified release documentation update. It consolidates this proposal with the other open docs updates and corrects the combined guidance against platform main `2dd613e3`. Closing this PR to keep one review/release path. The original branch is retained; the replacement is not merged.
anton closed this pull request 2026-10-19 20:10:58 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
public/docs!36
No description provided.