doors/every-host-owned
Every host in the company's public certificates has a named owner.
Install
firedrill hub add doors/every-host-owned
Reads
config.domains, ctlog.hosts, config.hosts
Fix when it fails
Add each host to .firedrill/hosts.yaml with its owner, or shut it down.
Test cases
| Case | Expected |
|---|---|
| owned | PASS |
| unowned | FAIL |
| no certs | N/A |
Drill file
firedrill: v0
id: doors/every-host-owned
safeguard: "Every host in the company's public certificates has a named owner."
severity: medium
for_each: config.domains
fetch:
hosts: { fact: ctlog.hosts, args: { domain: target.domain } }
owned: { fact: config.hosts }
pass_when:
- hosts.found.filter(h, !owned.exists(o, o.host == h.host)).size() == 0
fix: "Add each host to .firedrill/hosts.yaml with its owner, or shut it down."