# Bootstrap the infra-ops identity INSIDE esh-nas (CT 103 on esh-pve-nas, 10.0.50.50), Prime 2026-10-13 ("set it up").
# infra-ops could not log into the container (no user), so this runs on the HOST and reaches in with pct.
#   scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-infra-ops.yaml
# The in-container steps are scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh (= playbooks/bootstrap-infra-ops-user.yaml).
vars:
  ctid: "103"
steps:
  - name: Stage the bootstrap script on the host
    upload:
      src: scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh
      dest: /tmp/esh-nas-bootstrap-infra-ops.sh
      mode: "0700"
  - name: Push it into CT {{ ctid }} and run it as root there
    sudo: true
    shell: pct push {{ ctid }} /tmp/esh-nas-bootstrap-infra-ops.sh /root/bootstrap-infra-ops.sh --perms 0700 && pct exec {{ ctid }} -- bash /root/bootstrap-infra-ops.sh
  - name: Remove the staged copies
    sudo: true
    shell: pct exec {{ ctid }} -- rm -f /root/bootstrap-infra-ops.sh && rm -f /tmp/esh-nas-bootstrap-infra-ops.sh
verify:
  - name: The user and its sudoers file exist in CT {{ ctid }}
    sudo: true
    shell: pct exec {{ ctid }} -- sh -c 'id infra-ops && visudo -cf /etc/sudoers.d/infra-ops && grep -q NOPASSWD:ALL /etc/sudoers.d/infra-ops'
    changed_when: "false"