32 lines
1.4 KiB
YAML
32 lines
1.4 KiB
YAML
|
#cloud-config
|
||
|
|
# The staging template — a server, not an agent devbox: no agent, no
|
||
|
|
# agent-context file, and (as everywhere in box) no credentials. Docker and
|
||
|
|
# rig are preinstalled and that is all. Tailscale, openssh-server and every
|
||
|
|
# credential are deliberately ABSENT: rig installs and hardens sshd and joins
|
||
|
|
# the tailnet at bootstrap time ('box shell' → 'sudo rig bootstrap workload'),
|
||
|
|
# holding the auth key in process memory — box never sees it.
|
||
|
|
# BOX_USER in box.env must match the user created here — the file is passed
|
||
|
|
# to Incus verbatim.
|
||
|
|
users:
|
||
|
|
- name: ops
|
||
|
|
shell: /bin/bash
|
||
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
||
|
|
lock_passwd: true
|
||
|
|
package_update: true
|
||
|
|
packages:
|
||
|
|
- curl
|
||
|
|
- ca-certificates
|
||
|
|
# tmux is the one agent-adjacent tool a server box still carries: 'box tmux'
|
||
|
|
# runs 'tmux new-session' INSIDE the box on EVERY template (#65) — the
|
||
|
|
# operator babysits 'rig bootstrap workload' through it — and test/cli.sh
|
||
|
|
# asserts it for every template directory, this one included.
|
||
|
|
- tmux
|
||
|
|
runcmd:
|
||
|
|
- curl -fsSL https://get.docker.com | sh
|
||
|
|
- usermod -aG docker ops
|
||
|
|
# rig runs as root, so install it as root: its installer lands the tree in
|
||
|
|
# $HOME/.local/share/rig and symlinks /usr/local/bin/rig. HOME is pinned
|
||
|
|
# because cloud-init's runcmd does not guarantee one, and the installer
|
||
|
|
# derives its install dir from it.
|
||
|
|
- HOME=/root bash -c 'curl -fsSL https://raw.githubusercontent.com/heavy-duty/rig/main/install.sh | bash'
|