Add Flatcar VM for cisa-kev-rss on goose (#4)

Provision a dedicated Flatcar host that runs the CISA KEV RSS container
from GHCR, with a dozzle agent and hub remote entry like the other VMs.

Co-authored-by: Cursor Agent <[email protected]>

butane/cisa_kev_rss.yaml

@@ -0,0 +1,52 @@
+variant: flatcar
+version: 1.0.0
+
+# CISA KEV RSS feed. Turns the CISA Known Exploited Vulnerabilities catalog
+# into an RSS 2.0 feed (https://github.com/xsaveopt/cisa-kev-rss).
+#
+# Feed:  http://192.168.7.64:3000/rss
+# Health: http://192.168.7.64:3000/health
+#
+# Stateless: the container refreshes from CISA every ten minutes and keeps
+# nothing on disk, so it is safe to rebuild at any time.
+
+systemd:
+  units:
+    - name: cisa-kev-rss.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=CISA KEV RSS feed
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=/usr/bin/docker pull ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStartPre=-/usr/bin/docker rm --force cisa-kev-rss
+        ExecStart=/usr/bin/docker run --rm --name cisa-kev-rss \
+          -p 3000:3000 \
+          ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStop=/usr/bin/docker stop cisa-kev-rss
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
+    - name: dozzle-agent.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Dozzle Agent
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
+        ExecStart=/usr/bin/docker run --name dozzle-agent \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -p 7007:7007 \
+          amir20/dozzle:v11.1.1 agent
+        ExecStop=/usr/bin/docker stop dozzle-agent
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target

butane/monitor.yaml

@@ -44,7 +44,7 @@ systemd:
           --tmpfs /data \
           -p 8080:8080 \
           -e "DOZZLE_HOSTNAME=Oswald Logs" \
-          -e "DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Infra,192.168.7.61:7007|ai|Infra,192.168.7.62:7007|oswl-connector|Infra" \
+          -e "DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Infra,192.168.7.61:7007|ai|Infra,192.168.7.62:7007|oswl-connector|Infra,192.168.7.64:7007|cisa-kev-rss|Infra" \
           amir20/dozzle:v11.1.1
         ExecStop=/usr/bin/docker stop dozzle
         Restart=always

terraform.tfvars

@@ -251,6 +251,19 @@ nodes = {
         qemu_guest_agent = false
         butane_file      = "butane/monitor.yaml"
       }
+      # CISA Known Exploited Vulnerabilities catalog as an RSS feed.
+      # Stateless container; feed at :3000/rss.
+      "cisa-kev-rss" = {
+        hostname         = "cisa-kev-rss"
+        vmid             = 214
+        ip               = "192.168.7.64"
+        vlan             = 7
+        memory           = 1024
+        cores            = 1
+        disk_size        = 16
+        qemu_guest_agent = false
+        butane_file      = "butane/cisa_kev_rss.yaml"
+      }
     }
     machines = {
       "grist" = {