deytenit
6be21acde1
Add local SSH enrollment for clean Debian 13 hosts using the same baseline and user-data contract as Packer. Preserve provider networking, validate storage and repository ownership, and protect final SSH and security-service activation with persistent access recovery. Document composition-scoped replication patterns for independent node repositories and add behavioral coverage for provisioning, retries, and recovery. Native verification of the security activation transaction remains the production enrollment gate. Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not Vladimir Eremin.
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
#cloud-config
|
|
# Use this same file for cloud-init or: ./apex init root@HOST --user-data FILE
|
|
# Replace the hostname, repository and public key. Keep filled files outside Git.
|
|
# SSH repositories additionally require approved deferred id_ed25519 (0600)
|
|
# and known_hosts (0644) writes under /home/adam/.ssh, owned by adam:adam.
|
|
# Supply trusted Git host keys; do not infer trust from ssh-keyscan alone.
|
|
preserve_hostname: false
|
|
hostname: metis.a1.apex.ermnvldmr.com
|
|
users:
|
|
- name: adam
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
groups: [sudo, docker]
|
|
shell: /bin/bash
|
|
ssh_authorized_keys:
|
|
- "ssh-ed25519 REPLACE_WITH_OPERATOR_PUBLIC_KEY operator@workstation"
|
|
write_files:
|
|
- path: /etc/apex/bootstrap.env
|
|
owner: root:root
|
|
permissions: '0600'
|
|
content: |
|
|
APEX_REPO_NAME="metis.apex.ermnvldmr.com"
|
|
APEX_REPO_URL="https://github.com/deytenit/metis.apex.ermnvldmr.com.git"
|
|
APEX_TIER1_MODE="directory"
|
|
APEX_TIER1_DEVICE=""
|
|
APEX_TIER2_MODE="directory"
|
|
APEX_TIER2_DEVICE=""
|
|
APEX_TIER3_MODE="directory"
|
|
APEX_TIER3_DEVICE=""
|
|
# For a verified empty disk, explicitly select MODE=create and DEVICE=/dev/disk/by-id/...
|
|
# For an existing single-device pool, select MODE=import, DEVICE and POOL_GUID.
|
|
# Occupied devices are never erased; missing devices never fall back to directories.
|
|
runcmd:
|
|
- /usr/local/bin/apex-bootstrap
|