vps change plan
change-plan vps-change-plan.yaml
This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.
Validates against the change-plan schema — try it: POST /v1/validate with {"schema": "change-plan", "document": …}.
The document (YAML original)
version: "1.0"
change_id: CHANGE-DEMO-VPS-001
authorization_id: AUTH-DEMO-2026-001
client_id: client-demo
target: 203.0.113.10
environment: production
change_level: minor
objective: Plan a key-only SSH and default-deny host-firewall baseline without locking out administration or interrupting HTTPS.
profile: LAKA-VPS-WEB@1.0.0
risk:
magnitude: 4
blast_radius: [demo-vps-01, production-website, administrative-access]
lockout_risk: high
data_loss_risk: low
reversibility: configuration backup plus provider-console restoration
dependencies: [provider-console, existing-admin-key, reverse-proxy, provider-firewall]
preconditions:
authorization_current: true
ownership_proof_verified: true
backup_verified: true
restore_evidence_current: true
rollback_verified: true
console_confirmed: true
maintenance_window_confirmed: false
kill_switch_configured: true
health_baseline_captured: true
canary:
target: demo-vps-01
required: true
success_criteria:
- second key-based administrative session succeeds
- HTTPS health check remains healthy
- only approved public listeners remain reachable
steps:
- step_id: STEP-001
action: Capture effective SSH, firewall, listeners, services, and configuration backups.
tool: native-local-audit
expected_change: none
validation: [evidence-hash-recorded, backup-files-readable]
failure_action: stop
- step_id: STEP-002
action: Create and validate the proposed Ansible diff in check mode.
tool: ansible-check
expected_change: plan-only SSH and firewall diff
validation: [syntax-valid, inventory-bound, no-unexpected-task, approved-port-set]
failure_action: stop
- step_id: STEP-003
action: Apply the approved role serially after separate approval.
tool: ansible-apply
expected_change: key-only SSH and default-deny firewall with HTTPS and administrative access preserved
validation: [new-key-session, ssh-effective-config, https-health, listener-diff, firewall-diff]
failure_action: rollback-change
health_checks:
- provider console remains available
- new SSH session succeeds before old session closes
- HTTPS returns the expected client hostname and health response
- application and database services remain healthy
- no unexpected public listeners appear
rollback:
trigger_conditions:
- new administrative SSH session fails
- HTTPS health check fails
- expected service does not start
- firewall diff exceeds approved scope
method:
- use retained session or provider console
- restore SSH configuration backup
- restore prior firewall rules
- validate configuration before service reload
owner: platform-security-owner
maximum_decision_time: 2m
verification:
- administrative access restored
- HTTPS health restored
- prior effective SSH and firewall state confirmed
evidence:
before: [effective-sshd-config, firewall-rules, listeners, service-health, config-backup-hashes]
during: [ansible-task-events, policy-decisions, operator-events]
after: [effective-sshd-config, firewall-rules, listeners, health-checks, rollback-readiness]
destination: evidence://client-demo/changes/CHANGE-DEMO-VPS-001
integrity: sha256-plus-signed-manifest
status: planned
As JSON
{
"version": "1.0",
"change_id": "CHANGE-DEMO-VPS-001",
"authorization_id": "AUTH-DEMO-2026-001",
"client_id": "client-demo",
"target": "203.0.113.10",
"environment": "production",
"change_level": "minor",
"objective": "Plan a key-only SSH and default-deny host-firewall baseline without locking out administration or interrupting HTTPS.",
"profile": "LAKA-VPS-WEB@1.0.0",
"risk": {
"magnitude": 4,
"blast_radius": [
"demo-vps-01",
"production-website",
"administrative-access"
],
"lockout_risk": "high",
"data_loss_risk": "low",
"reversibility": "configuration backup plus provider-console restoration",
"dependencies": [
"provider-console",
"existing-admin-key",
"reverse-proxy",
"provider-firewall"
]
},
"preconditions": {
"authorization_current": true,
"ownership_proof_verified": true,
"backup_verified": true,
"restore_evidence_current": true,
"rollback_verified": true,
"console_confirmed": true,
"maintenance_window_confirmed": false,
"kill_switch_configured": true,
"health_baseline_captured": true
},
"canary": {
"target": "demo-vps-01",
"required": true,
"success_criteria": [
"second key-based administrative session succeeds",
"HTTPS health check remains healthy",
"only approved public listeners remain reachable"
]
},
"steps": [
{
"step_id": "STEP-001",
"action": "Capture effective SSH, firewall, listeners, services, and configuration backups.",
"tool": "native-local-audit",
"expected_change": "none",
"validation": [
"evidence-hash-recorded",
"backup-files-readable"
],
"failure_action": "stop"
},
{
"step_id": "STEP-002",
"action": "Create and validate the proposed Ansible diff in check mode.",
"tool": "ansible-check",
"expected_change": "plan-only SSH and firewall diff",
"validation": [
"syntax-valid",
"inventory-bound",
"no-unexpected-task",
"approved-port-set"
],
"failure_action": "stop"
},
{
"step_id": "STEP-003",
"action": "Apply the approved role serially after separate approval.",
"tool": "ansible-apply",
"expected_change": "key-only SSH and default-deny firewall with HTTPS and administrative access preserved",
"validation": [
"new-key-session",
"ssh-effective-config",
"https-health",
"listener-diff",
"firewall-diff"
],
"failure_action": "rollback-change"
}
],
"health_checks": [
"provider console remains available",
"new SSH session succeeds before old session closes",
"HTTPS returns the expected client hostname and health response",
"application and database services remain healthy",
"no unexpected public listeners appear"
],
"rollback": {
"trigger_conditions": [
"new administrative SSH session fails",
"HTTPS health check fails",
"expected service does not start",
"firewall diff exceeds approved scope"
],
"method": [
"use retained session or provider console",
"restore SSH configuration backup",
"restore prior firewall rules",
"validate configuration before service reload"
],
"owner": "platform-security-owner",
"maximum_decision_time": "2m",
"verification": [
"administrative access restored",
"HTTPS health restored",
"prior effective SSH and firewall state confirmed"
]
},
"evidence": {
"before": [
"effective-sshd-config",
"firewall-rules",
"listeners",
"service-health",
"config-backup-hashes"
],
"during": [
"ansible-task-events",
"policy-decisions",
"operator-events"
],
"after": [
"effective-sshd-config",
"firewall-rules",
"listeners",
"health-checks",
"rollback-readiness"
],
"destination": "evidence://client-demo/changes/CHANGE-DEMO-VPS-001",
"integrity": "sha256-plus-signed-manifest"
},
"status": "planned"
}