deytenit
6463bad5ee
- Purge misplaced RFCs, scratch tokens, and node-proprietary assets - Decouple remote provisioning to ci/scripts/init-node.py - Add targeted composition orchestration in actions/compose.py - Add host-side Xray stale socket cleanup in /dev/shm - Add actions/env.py for shell exports and .env synchronization - Harden UFW, backup retention, host tempfiles, and notify dispatcher - Add pyproject.toml and Makefile with 78 passing unit tests
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
#cloud-config
|
|
# Use this same file for cloud-init or: python3 ci/scripts/init-node.py root@HOST --user-data FILE
|
|
# Replace the hostname, repository and public key. Keep filled files outside Git.
|
|
# SSH repositories additionally require approved deferred id_ed25519 (0600)
|
|
# and known_hosts (0644) writes under /home/adam/.ssh, owned by adam:adam.
|
|
# Supply trusted Git host keys; do not infer trust from ssh-keyscan alone.
|
|
preserve_hostname: false
|
|
hostname: node1.example.com
|
|
users:
|
|
- name: adam
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
groups: [sudo, docker]
|
|
shell: /bin/bash
|
|
ssh_authorized_keys:
|
|
- "ssh-ed25519 REPLACE_WITH_OPERATOR_PUBLIC_KEY operator@workstation"
|
|
write_files:
|
|
- path: /etc/apex/bootstrap.env
|
|
owner: root:root
|
|
permissions: '0600'
|
|
content: |
|
|
APEX_REPO_NAME="node1.example.com"
|
|
APEX_REPO_URL="https://github.com/you/node1.example.com.git"
|
|
APEX_TIER1_MODE="directory"
|
|
APEX_TIER1_DEVICE=""
|
|
APEX_TIER2_MODE="directory"
|
|
APEX_TIER2_DEVICE=""
|
|
APEX_TIER3_MODE="directory"
|
|
APEX_TIER3_DEVICE=""
|
|
# For a verified empty disk, explicitly select MODE=create and DEVICE=/dev/disk/by-id/...
|
|
# For an existing single-device pool, select MODE=import, DEVICE and POOL_GUID.
|
|
# Occupied devices are never erased; missing devices never fall back to directories.
|
|
runcmd:
|
|
- /usr/local/bin/apex-bootstrap
|