vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(esh-nas): infra-ops identity bootstrapped in CT 103 via pct from esh-pve-nas

Browse Source 
Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key
login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid
850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out,
visudo-validated) ran inside the container from its host. Verified with a
direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.
This commit is contained in:
vh
2026-10-13 13:25:21 -07:00
parent b699088e2b
commit 30a7220b2c
4 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh
+27
View File
@@ -0,0 +1,27 @@
#!/bin/bash
# Run INSIDE esh-nas (CT 103 on esh-pve-nas) as root, via `pct exec 103`. The same steps as
# playbooks/bootstrap-infra-ops-user.yaml, for a container infra-ops cannot log into yet (Prime 2026-10-13: "set it up").
set -euo pipefail
U=infra-ops; ID=850
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet'
if ! id "$U" >/dev/null 2>&1; then
if ! getent passwd "$ID" >/dev/null && ! getent group "$ID" >/dev/null; then
groupadd -g "$ID" "$U"; useradd -m -s /bin/bash -u "$ID" -g "$ID" "$U"
else
echo "uid/gid $ID taken; letting the OS allocate"; useradd -m -s /bin/bash "$U"
fi
echo "created $U"
fi
chmod 0700 /home/$U
getent group docker >/dev/null && usermod -aG docker "$U" || echo "no docker group, skipped"
install -d -m 700 -o "$U" -g "$U" /home/$U/.ssh
printf '%s\n' "$KEY" > /home/$U/.ssh/authorized_keys
chown "$U:$U" /home/$U/.ssh/authorized_keys; chmod 600 /home/$U/.ssh/authorized_keys
f=/etc/sudoers.d/$U
printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' "$U" "$U" > "$f.tmp"
printf '%s\n' '# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)' \
'Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *' \
'Defaults!BULK_DATA !log_output' >> "$f.tmp"
chmod 440 "$f.tmp"
if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi
id "$U"; stat -c '%a %U %n' /home/$U /home/$U/.ssh /home/$U/.ssh/authorized_keys "$f"