vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(esh-nas): infra-ops identity bootstrapped in CT 103 via pct from esh-pve-nas

Browse Source 
Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key
login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid
850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out,
visudo-validated) ran inside the container from its host. Verified with a
direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.
This commit is contained in:
vh
2026-10-13 13:25:21 -07:00
parent b699088e2b
commit 30a7220b2c
4 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/bootstrap-infra-ops-user.yaml
+2 -1
View File
@@ -25,7 +25,8 @@
# esh-pve-nas) DO get infra-ops — done that day.
# PVE ships without sudo: `apt-get install sudo` first.
# Also granted by operator request: esh-docker-vm,
# esh-vm-db (2026-08-24) and vm-esh-nas (2026-09-27).
# esh-vm-db (2026-08-24), vm-esh-nas (2026-09-27) and esh-nas
# (CT 103, 2026-10-13, via pct from its host: playbooks/esh-nas-infra-ops.yaml).
# - nh3-nas (Synology DSM) (no standard useradd / sudoers.d)
#
# Idempotent: re-running reconciles the key + sudoers without error.