Rewrite the inbound-SSH section: it described a state that no longer exists

[aterga]

Summary

deploy/native/README.md's "Narrowing inbound SSH" section had two load-bearing claims that are now false. With the repo heading for public visibility, a reader would be misled on both.

"It still does" need 22/tcp open to the world. Not true as of today. Internet-facing SSH is closed on both hosts: each has a public-facing interface and a private one, security groups attach per-interface, and the public one now carries a group permitting 80/443 only. Verified from outside the VPN — 22 times out where it previously reached sshd.

"Do not try to solve this with a narrower CIDR — there isn't one." The evidence for this was a single observed public source address, and it turned out to be an artifact. Staging's DEPLOY_HOST named the public FQDN, so its deploys left over the internet rather than the VPN and presented a public source. With both hosts on private addresses, both present sources inside the private range. The section spent four paragraphs arguing a conclusion that had already collapsed.

Related issues

Part of #101 (publication scrub — the section now carries no internal addresses or resource identifiers). Supersedes the analysis in #91, which is being updated separately.

Changes

Rewritten to state what is true now and what is left to do:

• Internet-facing SSH is closed, and how — the per-interface security group split.
• DEPLOY_HOST must be the host's private address, with the failure mode spelled out. This is the same requirement Stop documenting a decommissioned host address as the DEPLOY_HOST example #102 adds to the secret's own description.
• The residual: 22 still open on the private interface, so the VPN and on-prem estate still reach SSH. Recorded as accepted rather than left implicit.
• The remaining step: narrow to the private range, delete the world-facing rule — after confirming the source across both runner clusters, and adding our own rule rather than depending on another team's, which can change without reference to this deployment.
• The Calico reasoning is kept, demoted from "this is impossible" to "verify rather than assume". That is what it actually supports, and it is the reason not to act on two readings.
• SSM is kept as considered and declined, with its reasoning intact and an explicit note to revisit if the judgement changes. It is the stronger end state; it was judged over-engineering for the residual once internet SSH was closed.
• The earlier failed attempt is recorded with its real cause, so nobody concludes the rule itself is untouchable.
• The ::/0 note and the $SSH_CLIENT / journalctl observation guidance are kept — both still correct and still useful.

Testing

• git grep over the whole tree finds no internal IPs, VPC/subnet/security-group/ENI/instance identifiers, or IPv6 addresses.
• Section boundaries preserved — the ship_runs_on and /version-assertion paragraphs that follow belong to the parent section and are untouched.
• Not run: cargo / npm — documentation only.

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change — this PR is the doc change.
• No secrets, credentials, or internal-only information are included — it removes internal detail rather than adding it.

Sequencing

Best merged after #102. One sentence here says the requirement is stated in deploy-native.yml's secret description, which is what #102 adds. Harmless if merged first, briefly forward-looking.

---

Generated by Claude Code

[Copilot]

Pull request overview

Updates the native deployment documentation to reflect the current network/security posture for deploy-host SSH access, removing now-incorrect claims and clarifying the remaining hardening work.

Changes:

• Rewrites “Narrowing inbound SSH” to state that internet-facing SSH is closed via per-interface security groups and to explain the DEPLOY_HOST private-address requirement.
• Reframes the CIDR-narrowing guidance as “verify then act” (Calico/SNAT variability) and records the prior failure mode accurately.
• Keeps SSM Session Manager as an explicitly considered (but currently declined) alternative end state.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

deploy/native/README.md:222

• This sentence claims the DEPLOY_HOST secret description in deploy-native.yml “now says so”, but in the current workflow it still uses the old example (ec2-user@10.118.0.61) and doesn’t state the private-address requirement. If this PR can land before #102, make this wording non-time-dependent (or reference #102 explicitly) so the README stays accurate.

configured, unnoticed, until that change made it fail. The secret's description in
[`deploy-native.yml`](../../.github/workflows/deploy-native.yml) now says so.