fleet: account bootstrap staging — root creator, per-account bootstrap, morning runbook

scripts/fleet/bootstrap-account.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# bootstrap-account.sh — run AS the target account on its host AFTER
+# root-create-accounts.sh. Idempotent. Everything lands in ~/mopac.
+# Env: MOPAC_STAGE (dir containing fleet-stage.tgz) — default: copied in.
+set -eu
+MOPAC="$HOME/mopac"
+mkdir -p "$MOPAC"
+cd "$MOPAC"
+
+if [ ! -d harness ]; then
+  tar xzf fleet-stage.tgz            # harness repo incl. bin/harness-linux-amd64
+fi
+cd harness
+
+# Per-account identity + secrets. ONLY Bitwarden access material belongs on
+# disk long-term (SPEC); tonight's boot uses env refs staged 0600 — migrate
+# to keyproxy (497) when Charles wires BW tomorrow.
+if [ ! -f "$MOPAC/env" ]; then
+  cat > "$MOPAC/env" <<ENVTPL
+# 0600. Replace values from Bitwarden tomorrow (keyproxy ref).
+HARNESS_VERTICAL=$(hostname -s)-$USER
+HARNESS_REDMINE_KEY=SETME
+HARNESS_LITELLM_KEY=SETME
+HARNESS_GITEA_KEY=SETME
+ENVTPL
+  chmod 600 "$MOPAC/env"
+  echo "EDIT $MOPAC/env (0600) before first start"
+fi
+
+# Render config + helpers for this account (never overwrites existing).
+ACCOUNT="$USER" sh deploy/install-account.sh "$USER"
+
+# Container service for this account (one container per account).
+set -a; . "$MOPAC/env"; set +a
+HARNESS_UID="$(id -u)" HARNESS_GID="$(id -g)" \
+DOCKER_GID="$(stat -c %g /var/run/docker.sock)" \
+docker compose -f deploy/compose.yaml -p "mopac-$USER" up -d --build
+
+docker compose -f deploy/compose.yaml -p "mopac-$USER" ps
+echo "Account $USER live. Logs: docker compose -p mopac-$USER logs -f"