thin templates — tenant content moves to rig bootstrap roles; templates shrink to creds-free seeds #81

New issue

Closed

opened 2026-07-18 16:55:06 +00:00 by dan-claude-bot · 0 comments

dan-claude-bot commented

2026-07-18 16:55:06 +00:00

(Migrated from github.com)

Thin templates: box mints, rig converges

Decision (with @danmt, 2026-07-18): a box template stops being where tenant content lives. The "claude" template becomes box + rig bootstrap claude; staging becomes box + rig bootstrap staging — see heavy-duty/rig#31 for the rig side. #69 is closed in favor of this split.

What stays in box (mint-time, host-side, creds-free):

The cloud-init seed per template: base image, BOX_USER, rig (+ tmux, #65) preinstalled — and nothing that joins or admits.
box.env host-side keys — including #69's BOX_REQUIRE_VM and BOX_AUTOSTART, which are mint flags, not guest content. These, plus #69's dynamic template test machinery (tests sweep templates/*/ so a new template cannot ship unseen), survive and are re-cut as a slim PR.
box may auto-run creds-free roles after mint (box exec … rig bootstrap claude); creds-holding roles (staging's tailnet join) stay operator-run.

What moves to rig (rig#31): agent CLIs, docker, hardening, joins — everything convergent, idempotent, and testable in rig's harness instead of parse-only cloud-init YAML.

Dovetails with #80: the agent-context guard note ("never run setup-host / the drill inside a box") lives once in the rig agent roles, not copy-pasted per template.

Pin points: box guests installing rig inverts the rig→box install edge (#28). Both track main unpinned today; the seed needs RIG_REPO/RIG_REF documented the same honest way rig#29 documented box's unpinned install.

## Thin templates: box mints, rig converges Decision (with @danmt, 2026-07-18): a box template stops being where tenant content lives. The "claude" template becomes **box + `rig bootstrap claude`**; staging becomes **box + `rig bootstrap staging`** — see heavy-duty/rig#31 for the rig side. #69 is closed in favor of this split. **What stays in box** (mint-time, host-side, creds-free): - The cloud-init seed per template: base image, `BOX_USER`, rig (+ tmux, #65) preinstalled — and nothing that joins or admits. - `box.env` host-side keys — including #69's `BOX_REQUIRE_VM` and `BOX_AUTOSTART`, which are mint flags, not guest content. These, plus #69's dynamic template test machinery (tests sweep `templates/*/` so a new template cannot ship unseen), survive and are re-cut as a slim PR. - box may auto-run creds-free roles after mint (`box exec … rig bootstrap claude`); creds-holding roles (staging's tailnet join) stay operator-run. **What moves to rig** (rig#31): agent CLIs, docker, hardening, joins — everything convergent, idempotent, and testable in rig's harness instead of parse-only cloud-init YAML. **Dovetails with #80**: the agent-context guard note ("never run setup-host / the drill inside a box") lives once in the rig agent roles, not copy-pasted per template. **Pin points**: box guests installing rig inverts the rig→box install edge (#28). Both track main unpinned today; the seed needs `RIG_REPO`/`RIG_REF` documented the same honest way rig#29 documented box's unpinned install.