claude-hdb bd849181bd fix: the firewall unit never re-ran, so new rules were never applied ... The box-to-box drop shipped, the drill still found boxes reaching each other, and the rule was simply not on the host. setup-host.sh ended with 'systemctl enable --now claudebox-firewall.service' — but the unit is RemainAfterExit, so once it has run it stays "active" forever, and '--now' does nothing to an active unit. Re-running setup-host after upgrading claudebox therefore installed the new script to /usr/local/sbin and never executed it. The host silently kept its old firewall, and the box-to-box hole stayed open through the release that claimed to close it. This is worse than the original bug: every future firewall change would have landed only on hosts that had never run setup-host before. Restart the unit instead — the script is idempotent by design. Then ASSERT the rule is live rather than assume it, because the absence of this particular rule is invisible: everything keeps working and boxes can simply reach each other. doctor.sh checks it too. Also: dns.mode=none is now part of the shipped stack, so the drill must stop treating it as leftover rehearsal dirt and reverting it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-14 01:40:02 +00:00
..
claudebox-firewall.service	Import claudebox: creds-free, trust-less Claude Code VMs	2026-07-10 15:00:36 +00:00
claudebox-firewall.sh	fix: boxes could reach each other — isolate them at the bridge	2026-07-14 01:29:33 +00:00
setup-host.sh	fix: the firewall unit never re-ran, so new rules were never applied	2026-07-14 01:40:02 +00:00
teardown-host.sh	feat: drop the claude- instance-name prefix; tag boxes instead	2026-07-10 17:09:45 +00:00