The fleet's shape

What protects this fleet is mostly a shape, and the shape is checkable. Three rules govern the wire: zones meet only inside chosen boxes, one way in, one way out. One discipline governs every box: it starts hardened from a script, carries no functionless surface, and is watched from enrollment on. What follows is each of these at building depth, with the hardening baseline as the worked example, closing on the property the whole adds up to: a short list of statements, each of which a script can check against the live machines.

Zones meet only inside chosen boxes

The fleet's networks are zones with jobs: a workspace zone where the knowledge base lives, and an internal zone for the machinery that watches. The rule that gives the zoning its teeth is that there is no router between them. Zones meet only inside boxes that are deliberately connected to more than one, and exactly two boxes are: the door, which stands in every zone because it is the way in, and the monitor, which stands in every zone so that every box can report to it without traffic ever crossing from zone to zone. Everything else lives in exactly one zone.

The consequence carries the security weight: cross-zone traffic is enumerable. The tunnel traffic stepping through the door and every box's reports to the monitor make the whole list. A design whose crossings can be written in one breath can be audited in one sitting, and a crossing observed anywhere else is a finding.

One way in

From the internet, the fleet is one silent socket: a tunnel endpoint that answers nothing unless a known key speaks first, so a scan of the fleet sees nothing at all. The remote shell rides inside the tunnel, and the public shell port is retired on every box. Inside, the shell is source-restricted per box, so even inside the fleet a shell arrives only along the drawn path.

Admission to the tunnel is a key, and the keys follow rules that outlive any one box. Every person and every seat has its own key and no account is shared, so revoking one peer removes exactly one person's access, provably: the removed key is tested against every box and must be refused. A guest peer is confined by the door's rules to exactly the segment their work needs, because being inside the tunnel is not being inside the fleet.

Recovery, for the day the tunnel itself is broken, is a break-glass path that does not depend on the tunnel. It is drilled, because a recovery path that has never been run cannot be counted on.

One way out

The workspace has no public address at all. Its only route to the internet is a single pinned path through the chokepoint. The pinning is deliberate, so neither the provider's plumbing nor a renamed interface can quietly hand the workspace a second way out.

The chokepoint itself is three ordinary parts on one box: a resolver bound to the workspace leg with query logging on, so every name the workspace asks for is a line in a log, an inspection engine listening on the same leg, and the address translation. Nothing in it is exotic. The control comes from where the parts sit: everything the workspace says to the internet crosses one wire that is logged and watched.

Every box starts hardened

A box joins the fleet through one script, run once as root on first boot: the hardening baseline. Its steps are ordinary. The order matters. Patch everything first. Create the named admin user and move the key in. Turn off root login, password authentication and the interactive fallback, and bound the authentication attempts. Default-deny inbound, allow outbound, rate-limit the shell port. Enable the intrusion-ban service and unattended security updates. Then print the state that was just set, because a hardening script that ends silently invites the assumption that it ran.

Two rules extend the baseline. A short-lived worker box is born encrypted and key-only at creation. And the per-box firewall rulesets live as idempotent scripts under version control, so a rebuild reproduces the locked state exactly.

The discipline's other half is subtraction. An interface that buys nothing is attack surface, and it goes: spare network legs and the address family nothing used were removed fleet-wide. The removal leaves a checkable claim: no interface carries an address the design does not name, and no firewall carries a rule for traffic that cannot arrive.

The monitor watches, and is watched

Every box carries a reporting agent from enrollment, and what the agents watch is decided centrally. The file-integrity baseline, the system paths whose change means something, is pushed from the monitor to every agent, and an agent applies it on receipt. The push earns its place against a known failure mode: a box rebuilt with a stock configuration silently watches nothing that matters, and nothing complains. With the central push, a rebuilt box re-acquires the baseline by enrolling. The push is verified in both directions with planted changes: a file added and a file removed must each raise their event, at the agent and at the monitor.

Two placement rules complete it. The monitor watches itself: its own configuration lives under the same file-integrity watch it pushes to everyone else, because the box that watches the fleet is the one whose quiet corruption would cost most. And the severities are split deliberately between what interrupts a person and what waits for review. The split matters in both directions: a page that fires often trains its reader to ignore it, and a serious event in an unwatched queue reaches nobody.

Checked against the live machines

A shape rots if it lives only in its document, so this one is held the way everything here is held: by a check. A script re-enumerates every box, its interfaces, routes, listening ports, firewall state and reporting agent, and diffs the result against a tracked baseline. A clean run means the live fleet still matches its own description. A delta is either reviewed into the baseline as a deliberate change or reverted as drift. Together with the hardening and ruleset scripts, this closes the loop: a box can be rebuilt to the described state, and the described state is continuously compared with the live one.

What the three rules and the box discipline add up to is a small number of statements, each mechanically checkable. That is what a security shape has to be when one person keeps it honest: short enough to hold in the head, and checkable by something other than the head. The narrative of the whole fleet is the fleet chapter.