From 583ac25448b53aa79f3c6440e41bc3cfc0181a0d Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 15:51:58 +0000 Subject: [PATCH] docs: README section for the staging bootstrap role Co-Authored-By: Claude Opus 4.8 --- README.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index cdcdd43..d025a35 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ PATH (`/usr/local/bin` when root). Re-run any time to upgrade. ## Commands -### `rig bootstrap ` +### `rig bootstrap ` Run as root on the fresh box (over SSH). Convergent — safe to re-run; a second run changes nothing. @@ -29,6 +29,7 @@ second run changes nothing. rig bootstrap control-plane --hostname my-coolify-box rig bootstrap workload --hostname my-prod-box rig bootstrap runner --hostname my-ci-box +rig bootstrap staging --hostname my-vm-host ``` - `--hostname ` — tailnet hostname (default: the role name) @@ -106,6 +107,19 @@ grant `tag:server` to repo-controlled code." A runner executes that code, and the check turns the worst misconfiguration from a documentation warning into a hard, post-join error. +`staging` is the box that *hosts* staging boxes — Incus VMs minted by the +[`box`](https://github.com/heavy-duty/box) CLI, each converged from inside with +`rig bootstrap workload` and registered in the control plane as its own server. +Mint its key with `tag:local`: the host and its guests sit on opposite sides of +a trust boundary, and the *host* is never managed by the control plane — so the +role **refuses an effective `tag:server`**, same mechanism as `runner`. rig +deliberately installs no Incus and no box here — box's own `setup-host` is the +single owner of the Incus daemon's configuration, and two tools converging one +daemon is drift by construction. The closing log points you at it: install box, +run `box setup-host`, then `box new --template staging`. If `/dev/kvm` is +absent, rig warns (a host that exists to run VMs should have it) but does not +fail — the role is rehearsed in containers, which legitimately lack it. + ### `rig coolify install --version ` Control-plane box only. Installs Coolify at exactly the pinned version with