Network Egress

Overview

Rousseau exposes zero inbound HTTP surface. All traffic is outbound: LLM calls, transport WebSockets, cron scheduler side effects. This guide walks through the egress-only firewall posture we recommend for production, using nftables on the host and Podman Network=pasta inside the container.

Domains rousseau might reach

Anything not in this list should be blocked.

nftables ruleset (host)

table inet rousseau {
  chain output {
    type filter hook output priority 0; policy drop;

    # Loopback + established
    oifname lo accept
    ct state established,related accept

    # DNS to internal resolver only
    ip daddr 10.42.0.1 udp dport 53 accept
    ip daddr 10.42.0.1 tcp dport 53 accept

    # Anthropic (adjust to Bedrock / Vertex / self-hosted)
    ip daddr { 160.79.104.0/23 } tcp dport 443 accept

    # Slack Socket Mode WebSocket
    ip daddr { slack-ip-set } tcp dport 443 accept

    # Log-and-drop everything else
    log prefix "[rousseau blocked] " counter drop
  }
}

Verify with sudo nft list ruleset.

Podman quadlet posture

The reference docker/rousseau-agent.container unit uses Network=pasta (rootless), no PublishPort=. From inside the container:

podman exec rousseau-agent ss -tulwn
# expect: no LISTEN sockets

Verification

• Checkbox curl -m 3 https://api.anthropic.com succeeds from the daemon host.
• Checkbox curl -m 3 https://example.com fails / times out.
• Checkbox ss -tulwn inside the container shows no LISTEN sockets.
• Checkbox nft list ruleset shows the rousseau table active.

Common pitfalls

• DNS leaks: the container inherits /etc/resolv.conf. Point at an internal resolver, or use CoreDNS with a custom zone.
• cosign verify-blob fails during upgrade: the Sigstore endpoints (rekor.sigstore.dev, fulcio.sigstore.dev) must be reachable when verifying. Add them to the ruleset when performing releases.
• STS token refresh fails on Bedrock/Vertex: the STS/GCP IAM endpoints must be reachable.

Related pages

• Security
• Deployment
• Recipes: Airgapped deployment
• Best Practices: Secret management