feat(infra-ops): commission a dedicated NOPASSWD-sudo agent identity for PFI boxes

Adds a host-agnostic elway play + fleet driver that stand up an `infra-ops` system user (dedicated ed25519 key, NOPASSWD sudo with log_output audit, docker group) so the infra-ops agent completes DevOps work end-to-end instead of handing sudo steps back to the operator. Scoped to PFI-owned Linux boxes; tiered (compute/app/ sensitive-infra) with SureFire/corviduo/esh/Synology explicitly excluded. Validated live on irv-ml1.
2026-06-03 14:49:46 -07:00
parent d8d776c7a3
commit 8c32a0540f
2 changed files with 139 additions and 0 deletions
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Fleet bootstrap of the `infra-ops` agent identity across PFI-OWNED boxes.
+# Runs playbooks/bootstrap-infra-ops-user.yaml on each host via elway.
+#
+# RUN THIS YOURSELF (operator). Each host's first bootstrap needs YOUR sudo, so
+# elway prompts for your sudo password once per host (lazy). After bootstrap the
+# agent authenticates as `infra-ops` with its own key (NOPASSWD) and never needs
+# your password again — re-runs are then promptless and idempotent.
+#
+# Usage:
+#   scripts/bootstrap-infra-ops-fleet.sh                 # tiers 1+2 (default)
+#   PFI_TIER=compute scripts/bootstrap-infra-ops-fleet.sh   # tier 1 only
+#   PFI_TIER=all     scripts/bootstrap-infra-ops-fleet.sh   # + tier 3 sensitive infra
+#   scripts/bootstrap-infra-ops-fleet.sh irv-ml1            # explicit host(s)
+#
+# SCOPE — PFI-owned Linux boxes ONLY. This list deliberately EXCLUDES:
+#   SureFire sf-*/sfsrv-ana (tenant), corviduo-dev (partner app-layer),
+#   esh-* (non-PFI home lab), nh3-nas (Synology DSM — no useradd/sudoers.d).
+# Hosts must resolve as ssh aliases (or be reachable as your account).
+
+set -uo pipefail
+cd "$(dirname "$0")/.."
+
+PLAYBOOK=playbooks/bootstrap-infra-ops-user.yaml
+
+# Tier 1 — compute / docker hosts (where the agent recurs)
+TIER1=(irv-ml1 ana-ml2 ana-docker nh3-docker)
+# Tier 2 — PFI app VMs / LXCs
+TIER2=(pfi-ana-webhost ana-filebot pfi-pteradactyl pfi-tacticalrmm ana-nas)
+# Tier 3 — sensitive infra (DB, backup, network, hypervisors): opt-in via PFI_TIER=all
+TIER3=(pfi-postgres pbs-ana pbs-nh3 ana-wg pfi-pve nh3-pve)
+
+if [ "$#" -gt 0 ]; then
+  HOSTS=("$@")
+else
+  case "${PFI_TIER:-default}" in
+    compute) HOSTS=("${TIER1[@]}") ;;
+    all)     HOSTS=("${TIER1[@]}" "${TIER2[@]}" "${TIER3[@]}") ;;
+    *)       HOSTS=("${TIER1[@]}" "${TIER2[@]}") ;;
+  esac
+fi
+
+echo "infra-ops fleet bootstrap → ${#HOSTS[@]} host(s):"
+printf '  %s\n' "${HOSTS[@]}"
+echo
+
+declare -a OK=() FAIL=()
+for h in "${HOSTS[@]}"; do
+  echo "================ $h ================"
+  if scripts/elway "$h" --playbook "$PLAYBOOK"; then
+    OK+=("$h")
+  else
+    FAIL+=("$h")
+    echo "!! bootstrap FAILED on $h (continuing)"
+  fi
+  echo
+done
+
+echo "================ summary ================"
+echo "ok   (${#OK[@]}): ${OK[*]:-none}"
+echo "fail (${#FAIL[@]}): ${FAIL[*]:-none}"
+[ "${#FAIL[@]}" -eq 0 ]