fleet: account bootstrap staging — root creator, per-account bootstrap, morning runbook

scripts/fleet/root-create-accounts.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# root-create-accounts.sh — run AS ROOT on each host. Creates the MOPAC Linux
+# accounts (SPEC-20260829) with docker-group membership so each account's
+# container service can reach the host docker daemon. Idempotent.
+#   ultix-streaming: bash root-create-accounts.sh streaming
+#   ultix-offstage:  bash root-create-accounts.sh offstage
+set -eu
+HOST="${1:?usage: root-create-accounts.sh streaming|offstage}"
+case "$HOST" in
+  streaming) USERS="reachableceo TSGBOD TSGCOO TSGCTO TSGCCO" ;;
+  offstage)  USERS="reachableceo-offstage COSRCEO-Personal COSRCEO-Biz COSWFO" ;;
+  *) echo "unknown host $HOST" >&2; exit 1 ;;
+esac
+DOCKER_GID="$(stat -c %g /var/run/docker.sock)"
+for u in $USERS; do
+  if id "$u" >/dev/null 2>&1; then
+    echo "exists: $u"
+  else
+    useradd -m -s /bin/bash -G docker "$u"
+    echo "created: $u (docker group $DOCKER_GID)"
+  fi
+  usermod -aG docker "$u" 2>/dev/null || true
+done
+echo "NOTE: reachableceo already exists — group membership updated only."
+echo "Next (as each account or via sudo -u): ~/mopac/bootstrap-account.sh"