feat: initialize Debian nodes through shared provisioning

Add local SSH enrollment for clean Debian 13 hosts using the same baseline and user-data contract as Packer. Preserve provider networking, validate storage and repository ownership, and protect final SSH and security-service activation with persistent access recovery.

Document composition-scoped replication patterns for independent node repositories and add behavioral coverage for provisioning, retries, and recovery. Native verification of the security activation transaction remains the production enrollment gate.

Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not Vladimir Eremin.

ci/packer/scripts/02-storage-docker.sh

@@ -1,94 +1,3 @@
 #!/usr/bin/env bash
 set -euo pipefail
-export DEBIAN_FRONTEND=noninteractive
-
-echo "=== [1/5] Configuring Debian Repositories for OpenZFS DKMS ==="
-# Enable contrib and non-free-firmware for zfs-dkms
-sed -i 's/Components: main/Components: main contrib non-free-firmware/g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
-sed -i 's/main$/main contrib non-free-firmware/g' /etc/apt/sources.list 2>/dev/null || true
-
-apt-get update
-apt-get install -y --no-install-recommends linux-headers-amd64 zfsutils-linux zfs-dkms
-
-# Pre-compile DKMS modules during bake time so first boot has zero compilation delay
-systemctl enable zfs-import-cache zfs-import.target zfs.target || true
-
-echo "=== [2/5] Installing Docker CE from Official Debian Repository ==="
-for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
-  apt-get remove -y "$pkg" 2>/dev/null || true
-done
-
-install -m 0755 -d /etc/apt/keyrings
-curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-chmod a+r /etc/apt/keyrings/docker.asc
-
-echo \
-  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
-  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
-  tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-apt-get update
-apt-get install -y --no-install-recommends \
-  docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-
-mkdir -p /srv/docker
-cat << 'EOF_DOCKER' > /etc/docker/daemon.json
-{
-  "data-root": "/srv/docker",
-  "log-driver": "json-file",
-  "log-opts": {
-    "max-size": "20m",
-    "max-file": "3"
-  }
-}
-EOF_DOCKER
-systemctl enable docker.service containerd.service
-
-echo "=== [3/5] Installing and Configuring UFW + ufw-docker ==="
-apt-get install -y --no-install-recommends ufw iptables
-
-curl -fsSL https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker -o /usr/local/bin/ufw-docker
-chmod +x /usr/local/bin/ufw-docker
-
-# Pre-configure firewall baseline (keep port 22 open during build for Packer SSH session)
-ufw default deny incoming
-ufw default allow outgoing
-ufw default allow routed
-ufw allow 22/tcp comment 'SSH default for builder'
-ufw allow 2222/tcp comment 'SSH for Apex'
-ufw --force enable
-
-# Set up ufw-docker routing in after.rules (now that UFW is active)
-/usr/local/bin/ufw-docker install || true
-
-# Symlink into adam ~/.local/bin for engine compatibility
-mkdir -p /etc/skel/.local/bin
-ln -sf /usr/local/bin/ufw-docker /etc/skel/.local/bin/ufw-docker
-
-echo "=== [4/5] Hardening SSH Configuration ==="
-mkdir -p /etc/ssh/sshd_config.d
-cat << 'EOF_SSH' > /etc/ssh/sshd_config.d/99-apex.conf
-Port 2222
-PasswordAuthentication no
-PermitEmptyPasswords no
-KbdInteractiveAuthentication no
-X11Forwarding no
-AllowUsers adam
-EOF_SSH
-
-echo "=== [5/5] Installing CrowdSec ==="
-# PackageCloud does not publish a dedicated 'trixie' suite yet; bookworm suite works seamlessly on Debian 13
-export os=debian
-export dist=bookworm
-if curl -fsSL https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash; then
-  apt-get update
-  apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables
-else
-  echo "PackageCloud script failed, falling back to Debian native repository..."
-  rm -f /etc/apt/sources.list.d/crowdsec*.list
-  apt-get update
-  apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables || \
-  apt-get install -y --no-install-recommends crowdsec
-fi
-
-echo "=== Docker, ZFS & Security Stack Complete ==="
+/usr/local/bin/apex-provision-image baseline