vh
8c32a0540f
Adds a host-agnostic elway play + fleet driver that stand up an `infra-ops` system user (dedicated ed25519 key, NOPASSWD sudo with log_output audit, docker group) so the infra-ops agent completes DevOps work end-to-end instead of handing sudo steps back to the operator. Scoped to PFI-owned Linux boxes; tiered (compute/app/ sensitive-infra) with SureFire/corviduo/esh/Synology explicitly excluded. Validated live on irv-ml1.
63 lines
2.3 KiB
Bash
Executable File
63 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fleet bootstrap of the `infra-ops` agent identity across PFI-OWNED boxes.
|
|
# Runs playbooks/bootstrap-infra-ops-user.yaml on each host via elway.
|
|
#
|
|
# RUN THIS YOURSELF (operator). Each host's first bootstrap needs YOUR sudo, so
|
|
# elway prompts for your sudo password once per host (lazy). After bootstrap the
|
|
# agent authenticates as `infra-ops` with its own key (NOPASSWD) and never needs
|
|
# your password again — re-runs are then promptless and idempotent.
|
|
#
|
|
# Usage:
|
|
# scripts/bootstrap-infra-ops-fleet.sh # tiers 1+2 (default)
|
|
# PFI_TIER=compute scripts/bootstrap-infra-ops-fleet.sh # tier 1 only
|
|
# PFI_TIER=all scripts/bootstrap-infra-ops-fleet.sh # + tier 3 sensitive infra
|
|
# scripts/bootstrap-infra-ops-fleet.sh irv-ml1 # explicit host(s)
|
|
#
|
|
# SCOPE — PFI-owned Linux boxes ONLY. This list deliberately EXCLUDES:
|
|
# SureFire sf-*/sfsrv-ana (tenant), corviduo-dev (partner app-layer),
|
|
# esh-* (non-PFI home lab), nh3-nas (Synology DSM — no useradd/sudoers.d).
|
|
# Hosts must resolve as ssh aliases (or be reachable as your account).
|
|
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
PLAYBOOK=playbooks/bootstrap-infra-ops-user.yaml
|
|
|
|
# Tier 1 — compute / docker hosts (where the agent recurs)
|
|
TIER1=(irv-ml1 ana-ml2 ana-docker nh3-docker)
|
|
# Tier 2 — PFI app VMs / LXCs
|
|
TIER2=(pfi-ana-webhost ana-filebot pfi-pteradactyl pfi-tacticalrmm ana-nas)
|
|
# Tier 3 — sensitive infra (DB, backup, network, hypervisors): opt-in via PFI_TIER=all
|
|
TIER3=(pfi-postgres pbs-ana pbs-nh3 ana-wg pfi-pve nh3-pve)
|
|
|
|
if [ "$#" -gt 0 ]; then
|
|
HOSTS=("$@")
|
|
else
|
|
case "${PFI_TIER:-default}" in
|
|
compute) HOSTS=("${TIER1[@]}") ;;
|
|
all) HOSTS=("${TIER1[@]}" "${TIER2[@]}" "${TIER3[@]}") ;;
|
|
*) HOSTS=("${TIER1[@]}" "${TIER2[@]}") ;;
|
|
esac
|
|
fi
|
|
|
|
echo "infra-ops fleet bootstrap → ${#HOSTS[@]} host(s):"
|
|
printf ' %s\n' "${HOSTS[@]}"
|
|
echo
|
|
|
|
declare -a OK=() FAIL=()
|
|
for h in "${HOSTS[@]}"; do
|
|
echo "================ $h ================"
|
|
if scripts/elway "$h" --playbook "$PLAYBOOK"; then
|
|
OK+=("$h")
|
|
else
|
|
FAIL+=("$h")
|
|
echo "!! bootstrap FAILED on $h (continuing)"
|
|
fi
|
|
echo
|
|
done
|
|
|
|
echo "================ summary ================"
|
|
echo "ok (${#OK[@]}): ${OK[*]:-none}"
|
|
echo "fail (${#FAIL[@]}): ${FAIL[*]:-none}"
|
|
[ "${#FAIL[@]}" -eq 0 ]
|