Bootstrap private node checkouts and operator access from the workstation

actions/config/adam.py

@@ -1,54 +0,0 @@
-"""Provision the golden-image operator while preserving authorized keys."""
-import pwd
-import grp
-from pathlib import Path
-from engine.descriptor import Meta, Opt
-
-METADATA = Meta(summary="Configure the adam operator, sudo access and optional SSH public key.",
-                args=[Opt("--public-key-file", "Append one OpenSSH public key from this file.")])
-
-
-HOME = Path("/home/adam")
-
-
-def run(ctx, args):
-    system = ctx.sys
-    key = None
-    if args.public_key_file:
-        key = Path(args.public_key_file).read_text().strip()
-        if len(key.splitlines()) != 1 or not key.startswith(("ssh-", "ecdsa-", "sk-")):
-            raise ValueError("Supply one OpenSSH public key.")
-        system.run(["ssh-keygen", "-lf", "-"], input=key + "\n", capture=True)
-    groups = ["sudo"]
-    try:
-        grp.getgrnam("docker")
-    except KeyError:
-        pass
-    else:
-        groups.append("docker")
-    try:
-        account = pwd.getpwnam("adam")
-    except KeyError:
-        if HOME.exists() or HOME.is_symlink():
-            raise RuntimeError("Resolve existing /home/adam before creating the account.") from None
-        system.sudo(["useradd", "--create-home", "--shell", "/bin/bash", "--user-group", "adam"])
-        account = pwd.getpwnam("adam")
-    if account.pw_uid < 1000 or Path(account.pw_dir) != HOME or HOME.resolve() != HOME:
-        raise RuntimeError("Existing adam account has incompatible UID or home.")
-    if Path(account.pw_dir).stat().st_uid != account.pw_uid:
-        raise RuntimeError("The operator must own /home/adam.")
-    system.sudo(["usermod", "--shell", "/bin/bash", "--append", "--groups", ",".join(groups), "adam"])
-    if key:
-        system.sudo(["runuser", "-u", "adam", "--", "sh", "-ec",
-                     'umask 077; cd "$1"; mkdir -p .ssh; chmod 700 .ssh; '
-                     'touch .ssh/authorized_keys; chmod 600 .ssh/authorized_keys; '
-                     'IFS= read -r key; grep -Fxq -- "$key" .ssh/authorized_keys || '
-                     'printf "\\n%s\\n" "$key" >> .ssh/authorized_keys', "sh", str(HOME)], input=key + "\n")
-    content = "adam ALL=(ALL:ALL) NOPASSWD: ALL\n"
-    system.sudo(["visudo", "-cf", "-"], input=content)
-    path = Path("/etc/sudoers.d/99-apex-adam")
-    if path.is_symlink():
-        raise RuntimeError(f"Refusing redirected sudo policy: {path}")
-    ctx.host.write_file(str(path), content, mode="0440", backup=False, sudo=True)
-    system.sudo(["visudo", "-c"])
-    system.sudo(["runuser", "-u", "adam", "--", "sudo", "-n", "true"])

actions/config/hardening.py

@@ -84,7 +84,7 @@ def _connection(ctx, *, after=None):
 def _operator_access(ctx):
     account = pwd.getpwnam("adam")
     if account.pw_uid < 1000 or account.pw_dir != "/home/adam":
-        raise RuntimeError("Configure a regular adam operator account first.")
+        raise RuntimeError("Prepare the adam account from your workstation with scripts/bootstrap-node first.")
     if pwd.getpwuid(os.getuid()).pw_name == "adam":
         return _connection(ctx)
     loginuid = int(Path("/proc/self/loginuid").read_text())