vh
30a7220b2c
Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid 850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out, visudo-validated) ran inside the container from its host. Verified with a direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.
24 lines
1.3 KiB
YAML
24 lines
1.3 KiB
YAML
# Bootstrap the infra-ops identity INSIDE esh-nas (CT 103 on esh-pve-nas, 10.0.50.50), Prime 2026-10-13 ("set it up").
|
|
# infra-ops could not log into the container (no user), so this runs on the HOST and reaches in with pct.
|
|
# scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-infra-ops.yaml
|
|
# The in-container steps are scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh (= playbooks/bootstrap-infra-ops-user.yaml).
|
|
vars:
|
|
ctid: "103"
|
|
steps:
|
|
- name: Stage the bootstrap script on the host
|
|
upload:
|
|
src: scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh
|
|
dest: /tmp/esh-nas-bootstrap-infra-ops.sh
|
|
mode: "0700"
|
|
- name: Push it into CT {{ ctid }} and run it as root there
|
|
sudo: true
|
|
shell: pct push {{ ctid }} /tmp/esh-nas-bootstrap-infra-ops.sh /root/bootstrap-infra-ops.sh --perms 0700 && pct exec {{ ctid }} -- bash /root/bootstrap-infra-ops.sh
|
|
- name: Remove the staged copies
|
|
sudo: true
|
|
shell: pct exec {{ ctid }} -- rm -f /root/bootstrap-infra-ops.sh && rm -f /tmp/esh-nas-bootstrap-infra-ops.sh
|
|
verify:
|
|
- name: The user and its sudoers file exist in CT {{ ctid }}
|
|
sudo: true
|
|
shell: pct exec {{ ctid }} -- sh -c 'id infra-ops && visudo -cf /etc/sudoers.d/infra-ops && grep -q NOPASSWD:ALL /etc/sudoers.d/infra-ops'
|
|
changed_when: "false"
|