Loading HoneyMesh...
Loading HoneyMesh...
Operator runbook
This is an evaluation sequence for experienced Linux and network administrators. It establishes what must be checked before a host rule is authorized and how to prove that normal traffic and recovery remain available.
Signed customer downloads are open for eligible paid plans. Check the exact release and plan before installing.
Six checkpoints
Administrator
Choose one noncritical Ubuntu 24.04 AMD64 host. Record kernel, network namespace, interface, critical services, normal traffic, provider console access, and the existing firewall configuration.
Pass: A separate operator can reach the host even if the protected interface becomes unavailable.
Stop: No provider console, untested kernel/interface, or an irreplaceable production service.
Administrator
Download the plan-matched archive only from its authenticated customer path. Compare the published SHA-256, publisher fingerprint, signed manifest, and file hashes before installation.
Pass: Every local value matches the exact release record and the included CUSTOMER_INSTALL.md.
Stop: Missing signature, mismatched hash, unexpected filename, or a withdrawn package.
Host operator
Install with the release-specific guide, import the emailed host license into its protected path, start the agent, and verify the local health endpoint. Keep sharing disabled and do not attach an unreviewed public interface.
Pass: The service is healthy, the paid entitlement is recognized, and the local mode is TEST.
Stop: A health failure, wrong license, unsupported interface, or missing rollback instructions.
Security operator
Use an authorized test source and a separate control source. Review the source attribution, proposed scope, expected TTL, and protected management addresses. Record baseline reachability first.
Pass: The proposed decision identifies one exact source and leaves the control path reachable.
Stop: The source is ambiguous, a management address is in scope, or normal traffic changes unexpectedly.
Security operator
Only after the previous checks, deliberately enter ENFORCE for the selected interface and apply one short grant. Confirm the selected source is blocked, the control source remains open, and a drop counter records the effect.
Pass: The observed packet effect matches the reviewed decision and can be released by its owner.
Stop: Unexplained block, missing control traffic, inability to release, or a mode that differs from the review.
Host operator
Release the grant, confirm selected traffic returns, return to TEST, and exercise the documented emergency rollback. Save the release version, hashes, observations, and who approved the test.
Pass: Both sources are reachable and the prior host control plane remains usable.
Stop: Any recovery step depends on the same interface that is being tested.
Run these on a host where the agent is already installed. The first three identify the environment; the last two check service and local TLS health. They do not enable enforcement.
uname -r
cat /etc/os-release
ip -br link
sudo systemctl status honeymesh.service --no-pager
curl --cacert /etc/honeymesh/certs/ca/ca.crt https://127.0.0.1:8443/api/healthThe browser console is local to the host. For remote access, the setup guide covers a loopback SSH tunnel and CA verification. Keep the admin token out of logs and support tickets.
A passing canary does not establish broad detection accuracy, stateful egress policy, line-rate performance, or general production qualification.
Save the installed archive hash, publisher fingerprint, license unit, kernel, selected interface, test sources, grant duration, operator approval, and observed rollback result in your own change record. Network Decode does not need a copy of your private topology to provide the local tools.