33 lines
1.6 KiB
YAML
33 lines
1.6 KiB
YAML
#cloud-config
|
|
# A thin, creds-free seed (#81): the tenant user, tmux (#65), and rig —
|
|
# nothing that joins a tailnet or admits credentials, no agent CLI, no
|
|
# docker, no context-file heredoc. Everything this box becomes comes from
|
|
# 'rig bootstrap grok-box' (heavy-duty/rig#31), which box auto-runs after
|
|
# mint; the agent-context file — including the #80 guard (never run
|
|
# 'box setup-host' or the drill inside a box) — is rendered by that role,
|
|
# once, instead of being copy-pasted per template.
|
|
users:
|
|
- name: grok
|
|
shell: /bin/bash
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
lock_passwd: true
|
|
package_update: true
|
|
# tmux: 'box tmux' runs 'tmux new-session' INSIDE the box (#65).
|
|
# curl + ca-certificates: the rig installer below rides them, and a bare
|
|
# cloud image is not guaranteed to ship either.
|
|
packages:
|
|
- tmux
|
|
- curl
|
|
- ca-certificates
|
|
runcmd:
|
|
# Preinstall rig so the box can converge — and re-converge — via
|
|
# 'rig bootstrap grok-box'. @RIG_REPO@/@RIG_REF@ are the pin point (#81):
|
|
# box substitutes them at mint from the RIG_REPO/RIG_REF environment
|
|
# (default heavy-duty/rig @ main — unpinned, tracking main, the same
|
|
# honest edge as rig's own unpinned box install, until rig#32 ships a
|
|
# release flow). The pin covers both the installer fetched AND the tree
|
|
# it installs, so a branch under review is testable end to end.
|
|
# HOME=/root: cloud-init runs runcmd as root but with NO $HOME in the
|
|
# environment, and the rig installer (set -u) reads $HOME for its DEST —
|
|
# measured live: the mint died with "HOME: unbound variable" without it.
|
|
- '@RIG_INSTALL@'
|