vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(esh-nas): infra-ops identity bootstrapped in CT 103 via pct from esh-pve-nas

Browse Source 
Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key
login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid
850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out,
visudo-validated) ran inside the container from its host. Verified with a
direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.
This commit is contained in:
vh
2026-10-13 13:25:21 -07:00
parent b699088e2b
commit 30a7220b2c
4 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/bootstrap-infra-ops-user.yaml
+2 -1
View File
@@ -25,7 +25,8 @@
# esh-pve-nas) DO get infra-ops — done that day.
# PVE ships without sudo: `apt-get install sudo` first.
# Also granted by operator request: esh-docker-vm,
# esh-vm-db (2026-08-24) and vm-esh-nas (2026-09-27).
# esh-vm-db (2026-08-24), vm-esh-nas (2026-09-27) and esh-nas
# (CT 103, 2026-10-13, via pct from its host: playbooks/esh-nas-infra-ops.yaml).
# - nh3-nas (Synology DSM) (no standard useradd / sudoers.d)
#
# Idempotent: re-running reconciles the key + sudoers without error.
playbooks/esh-nas-infra-ops.yaml
+23
View File
@@ -0,0 +1,23 @@
# Bootstrap the infra-ops identity INSIDE esh-nas (CT 103 on esh-pve-nas, 10.0.50.50), Prime 2026-10-13 ("set it up").
# infra-ops could not log into the container (no user), so this runs on the HOST and reaches in with pct.
# scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-infra-ops.yaml
# The in-container steps are scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh (= playbooks/bootstrap-infra-ops-user.yaml).
vars:
ctid: "103"
steps:
- name: Stage the bootstrap script on the host
upload:
src: scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh
dest: /tmp/esh-nas-bootstrap-infra-ops.sh
mode: "0700"
- name: Push it into CT {{ ctid }} and run it as root there
sudo: true
shell: pct push {{ ctid }} /tmp/esh-nas-bootstrap-infra-ops.sh /root/bootstrap-infra-ops.sh --perms 0700 && pct exec {{ ctid }} -- bash /root/bootstrap-infra-ops.sh
- name: Remove the staged copies
sudo: true
shell: pct exec {{ ctid }} -- rm -f /root/bootstrap-infra-ops.sh && rm -f /tmp/esh-nas-bootstrap-infra-ops.sh
verify:
- name: The user and its sudoers file exist in CT {{ ctid }}
sudo: true
shell: pct exec {{ ctid }} -- sh -c 'id infra-ops && visudo -cf /etc/sudoers.d/infra-ops && grep -q NOPASSWD:ALL /etc/sudoers.d/infra-ops'
changed_when: "false"