vh
70b7281182
Prime, 2026-10-09: "vh gets albok-everything". playbooks/nh3-albok-vh-viewer.yaml joins vh to albok-read, albok-personal and albok-feedback on nh3-albok and authorizes his four Macs' public keys for vh; verified at a fresh login that every wing's .browse/ lists and reads. The withdrawal harness gains a macOS driver (run-mac.sh: every mountable FUSE backend, a read-only smoke of the real wings, results copied back), env overrides for a non-container client, and summarize.py. Sanity-checked as vh from the Linux container before staging.
48 lines
2.0 KiB
YAML
48 lines
2.0 KiB
YAML
# vh on nh3-albok as the operator's albok viewer (Prime, 2026-10-09: "vh gets albok-everything").
|
|
# scripts/elway infra-ops@10.100.50.44 --playbook playbooks/nh3-albok-vh-viewer.yaml --var keys_file=<local .pub list>
|
|
# Idempotent. Joins vh to every albok read group that exists (albok-read 1510 = fleet + library,
|
|
# albok-personal 1511 = personal/notes, albok-feedback 1512 = personal/agent-feedback, which had been
|
|
# default-deny until this ruling) and authorizes the operator's workstation public keys for vh, so a
|
|
# workstation can sshfs-mount a wing's .browse/ (see stacks/albok-service/README.md).
|
|
# A later restricted group (1513+, e.g. the vault wing) is NOT included: add it here deliberately.
|
|
# Group membership is read at login, so it applies to new SSH sessions only.
|
|
vars:
|
|
keys_file: ""
|
|
groups: albok-read,albok-personal,albok-feedback
|
|
|
|
steps:
|
|
- name: vh joins {{ groups }}
|
|
sudo: true
|
|
shell: usermod -aG {{ groups }} vh
|
|
when: "! (for g in $(echo {{ groups }} | tr , ' '); do id -nG vh | tr ' ' '\\n' | grep -qx \"$g\" || exit 1; done)"
|
|
|
|
- name: stage the workstation public keys
|
|
upload:
|
|
src: "{{ keys_file }}"
|
|
dest: /tmp/vh-workstation-keys.pub
|
|
mode: "0644"
|
|
|
|
- name: append each key to vh's authorized_keys if absent
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
added=0
|
|
while IFS= read -r k; do
|
|
[ -n "$k" ] || continue
|
|
grep -qxF "$k" /home/vh/.ssh/authorized_keys || { printf '%s\n' "$k" >> /home/vh/.ssh/authorized_keys; added=$((added+1)); }
|
|
done < /tmp/vh-workstation-keys.pub
|
|
rm -f /tmp/vh-workstation-keys.pub
|
|
echo "added $added"
|
|
|
|
verify:
|
|
- name: vh holds every group
|
|
shell: |
|
|
for g in $(echo {{ groups }} | tr , ' '); do
|
|
id -nG vh | tr ' ' '\n' | grep -qx "$g" || { echo "missing $g"; exit 1; }
|
|
done
|
|
changed_when: "false"
|
|
- name: authorized_keys still vh-owned and 600
|
|
sudo: true
|
|
shell: test "$(stat -c '%U %a' /home/vh/.ssh/authorized_keys)" = "vh 600"
|
|
changed_when: "false"
|