KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bootstrap): target only remaining system (tsys-siem) [#403]

Browse Source 
Access validation shows 68/70 non-excluded systems at intended access
state. Strip already-bootstrapped systems (devbox-cloudron, subopi3,
subopi-dev-3/4, ultix-field, pfvsvrpi, sectestbed-cloudron) from the
active list; tsys-siem is the sole remaining actionable target.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 16:36:55 -05:00
parent f96baa77d1
commit 8e0a67fd20
2 changed files with 16 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap-all.sh
+13 -16
View File
@@ -12,6 +12,9 @@
#
# Passes AGENT_USER so agent-bootstrap.sh targets the correct unprivileged
# user. You enter passwords interactively. Idempotent: safe to re-run.
#
# Verified state (access-matrix.sh, 2026-08-10): 68/70 non-excluded systems
# at intended access state. Only tsys-siem remains below.
set -u
cd "$(dirname "$0")" || exit 1
@@ -42,33 +45,27 @@ run_with_su() {
echo
}
# === localuser + sudo (password auth confirmed on) ===
echo "### localuser + sudo ###"
# === REMAINING: localuser + sudo (password auth on, key not yet pushed) ===
echo "### Remaining system: tsys-siem ###"
echo
run_with_sudo tsys-siem 100.72.35.113 localuser
run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
# === subodev/ultixfield + su (password auth confirmed on) ===
echo "### subodev/ultixfield + su ###"
echo
run_with_su subopi-dev-3 100.64.231.65 subodev subodev
run_with_su ultix-field 100.115.233.124 ultixfield ultixfield
run_with_sudo tsys-siem 100.72.35.113 localuser
echo "========================================"
echo "Done. Re-run access-matrix.sh to verify."
echo "========================================"
echo
echo "CONSOLE-ONLY — sshd rejects password auth (publickey-only)."
echo "Log in at the physical console (as root, or user then su/sudo)"
echo "and paste this ONE line:"
echo "CONSOLE-ONLY fallback — if tsys-siem rejects password auth"
echo "(publickey-only sshd), log in at the physical console (as root,"
echo "or localuser then sudo) and paste this ONE line:"
echo
cat <<'ONELINER'
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE
ONELINER
echo
echo " pfvsvrpi (localuser) — Raspberry Pi"
echo " subopi3 (subodev) — Raspberry Pi"
echo " subopi-dev-4 (subodev) — Raspberry Pi"
echo "========================================"
echo "Already bootstrapped (verified SUDOOK/root-ok via access-matrix):"
echo " devbox-cloudron, sectestbed-cloudron, subopi3, subopi-dev-3,"
echo " subopi-dev-4, ultix-field, pfvsvrpi (+ 60 others)"
echo "========================================"
echo "Deferred (separate ticket):"
echo " stlp-3dscanner — rename + bring online first [#417]"