From c9faa517d1c09dfc554f1ff47d2e8ffbbed1bf45 Mon Sep 17 00:00:00 2001
From: mo <mo@dell-atc.lan>
Date: Thu, 25 Jun 2026 00:56:38 +0000
Subject: [PATCH] Document Elasticsearch firewall rules for lab subnets

---
 docs/runbook-vm304.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/runbook-vm304.md b/docs/runbook-vm304.md
index 442bf5d..1820282 100644
--- a/docs/runbook-vm304.md
+++ b/docs/runbook-vm304.md
@@ -44,3 +44,13 @@ print(s3.list_buckets())
 ```bash
 ./scripts/sync-gitea.sh
 ```
+
+## Elasticsearch firewall (atc-elastic01)
+
+Port **9200** opened via firewalld rich rules for lab subnets:
+- `10.0.21.0/24` (Command Center, lakehouse, kafka, …)
+- `10.0.20.0/24` (ObjectScale, db01, …)
+
+Kibana **5601** was already public on elastic01.
+
+`elastic` password: set in `/opt/atc-agents/.env` as `ELASTIC_PASSWORD` (not in git).