From 5fb342d64d301dcde5ca3f7617d653870bbf7ccc Mon Sep 17 00:00:00 2001 From: claude-hdb Date: Sat, 11 Jul 2026 10:38:14 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20bootstrap=20installs=20openssh-server=20?= =?UTF-8?q?=E2=80=94=20sshd=5Fconfig.d=20does=20not=20exist=20on=20pristin?= =?UTF-8?q?e=20images?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by the Incus rehearsal (prod-migration Task 4): cloud images ship openssh-server, container/VM images do not; the hardening drop-in and 'systemctl restart ssh' both presume it. A rig box is SSH-managed by definition, so the dependency is explicit now. No-op on cloud images. Co-Authored-By: Claude Fable 5 --- commands/bootstrap.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/commands/bootstrap.sh b/commands/bootstrap.sh index 4b82fc5..697d20c 100755 --- a/commands/bootstrap.sh +++ b/commands/bootstrap.sh @@ -66,7 +66,11 @@ fi export DEBIAN_FRONTEND=noninteractive log "installing base packages" apt-get update -qq -apt-get install -y -qq curl ca-certificates unattended-upgrades +# openssh-server: a rig box is managed over SSH (Coolify SSHes in as root), +# and the hardening drop-in below targets /etc/ssh/sshd_config.d/ — which +# only exists once the package is installed. Cloud images ship it; pristine +# container/VM images (the Incus rehearsal) do not. +apt-get install -y -qq curl ca-certificates unattended-upgrades openssh-server # enable periodic unattended upgrades (canonical file; idempotent overwrite) cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'