fix(ssh): run the Rocky SSH firewall check only when the port changes #104

Context

Found while reviewing the #89 PR on 2026-11-09 (epic #98). verified on main 949d449: on Rocky, SSHModule.Check and Apply (internal/module/ssh.go, cfg.Port > 0 branch) call rockyFirewallAllowsSSH whenever ssh.port is set, not only when the port changes. The check refuses on any UFW DENY/REJECT rule, any SSH allow that is not unrestricted in both address families, and any firewalld rich rule in an active zone. A Rocky host that sets ssh.port, already runs sshd on it and keeps a source-limited SSH policy therefore fails every check/apply.

AGENTS.md scopes the guard to "before changing SSH ports". #89 limits the Ubuntu path to real port changes; this issue aligns Rocky.

Implementation starts only on the owner's go-ahead.

Decisions

• Firewall verification runs only when the effective SSH port changes (managed drop-in Port, or 22 without one, differs from ssh.port). Unknown firewall state still refuses a change.
• Reuse the port-change detection fix(firewall): block SSH and UFW changes when firewall state is unknown #89 adds for Ubuntu; no second implementation.
• 2026-11-09: fix(firewall): block SSH and UFW changes when firewall state is unknown #89 added managedSSHPortChanges, which reads the current port from the managed drop-in only (22 when absent). Extend it to the effective port, sshd -T or the main sshd_config Port when no drop-in sets one, so a move from a non-22 main-config port to 22 is also verified. Basis: review of PR fix(firewall): block reachability changes on unknown firewall state #103.

Design

• In the Rocky branches of SSHModule.Check/Apply, gate rockyFirewallAllowsSSH on the shared "port changes" helper from fix(firewall): block SSH and UFW changes when firewall state is unknown #89. SELinux port labelling stays as it is (it is idempotent and needed even for an unchanged custom port).

Changes

• internal/module/ssh.go, internal/module/rocky_test.go, docs/rocky-support.md.

Acceptance criteria

• AC1: Rocky stub with ssh.port equal to the current drop-in Port and a source-limited firewalld/UFW policy: Check reports no firewall error and Apply changes nothing.
• AC2: same stub with a different ssh.port: refused before any sshd write, as today.
• AC3: rocky CI jobs pass.

Tasks

• T1: gate on the shared port-change helper (after fix(firewall): block SSH and UFW changes when firewall state is unknown #89 merges) (AC1, AC2)
  • Done when: go test ./internal/module -run Rocky -race passes.
• T2: docs and release note bullet (AC3)

Out of scope

• Changing what counts as an allowed policy for a real port change.