From e395d6754acc1a0671ae938e69e201991c61ae7b Mon Sep 17 00:00:00 2001 From: claude-hdb Date: Sat, 11 Jul 2026 18:25:47 +0000 Subject: [PATCH] =?UTF-8?q?feat:=20runner=20bootstrap=20role=20=E2=80=94?= =?UTF-8?q?=20defaults=20tag:ci,=20refuses=20tag:server?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- README.md | 23 ++++++++++++++------- bin/rig | 5 +++-- commands/bootstrap.sh | 27 +++++++++++++++++++------ docs/plans/2026-07-11-runner-install.md | 12 +++++++++++ test/cli.sh | 4 +++- 5 files changed, 55 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 88c2627..6e6bc2c 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ PATH (`/usr/local/bin` when root). Re-run any time to upgrade. ## Commands -### `rig bootstrap ` +### `rig bootstrap ` Run as root on the fresh box (over SSH). Convergent — safe to re-run; a second run changes nothing. @@ -28,10 +28,13 @@ second run changes nothing. ```sh rig bootstrap control-plane --hostname my-coolify-box rig bootstrap workload --hostname my-prod-box +rig bootstrap runner --hostname my-ci-box ``` - `--hostname ` — tailnet hostname (default: the role name) -- `--ts-tag ` — tailnet tag to advertise (default: `tag:server`) +- `--ts-tag ` — tailnet tag to advertise (default: `tag:server`; + the `runner` role defaults to `tag:ci` instead, and **refuses** + `tag:server` outright — see below) What it does: installs `curl ca-certificates unattended-upgrades` (and enables periodic unattended upgrades); writes an sshd hardening drop-in @@ -42,9 +45,14 @@ tailscale and joins your tailnet. the interactive prompt. Use a **single-use, tagged, short-expiry** key. It lives in process memory only — rig never writes a credential to disk. -The two roles are identical today except the default hostname; they exist -because control-plane and workload boxes diverge over time, and because the -next command applies to exactly one of them. +`control-plane` and `workload` are identical today except the default +hostname; they exist because the boxes diverge over time, and because each +follow-up command applies to exactly one role. `runner` is the box a CI +agent will live on, and it differs behaviorally: it defaults `--ts-tag` to +`tag:ci` and **refuses `tag:server`** — a runner executes repo-controlled +code, and advertising your server tag would extend every grant your servers +hold (SSH between them, say) to that code. The refusal turns the worst +misconfiguration from a documentation warning into a hard error. ### `rig coolify install --version ` @@ -55,10 +63,11 @@ explicit re-run with a new pin. The pin is required; there is no default. ### `rig runner install --repo --version ` -Workload box only, run after `rig bootstrap workload`: +Runner box only, run after `rig bootstrap runner` (the same two-step rhythm +as `bootstrap control-plane` → `coolify install`): ```sh -rig bootstrap workload --hostname my-ci-box --ts-tag tag:ci +rig bootstrap runner --hostname my-ci-box rig runner install --repo acme/widgets --version 2.335.1 ``` diff --git a/bin/rig b/bin/rig index 464b536..67d5bd6 100755 --- a/bin/rig +++ b/bin/rig @@ -8,10 +8,11 @@ usage() { usage: rig [args] commands: - bootstrap [--hostname ] [--ts-tag ] + bootstrap [--hostname ] [--ts-tag ] OS plumbing on a pristine Debian box: hardening, unattended-upgrades, tailscale join. Prompts for a single-use tailnet pre-auth key - (TS_AUTHKEY env overrides the prompt). Run as root. + (TS_AUTHKEY env overrides the prompt). Run as root. Role runner + defaults to tag:ci and refuses tag:server. coolify install --version Pinned Coolify install (AUTOUPDATE=false). Control-plane box only. runner install --repo --version [options] diff --git a/commands/bootstrap.sh b/commands/bootstrap.sh index 697d20c..ac54a9a 100755 --- a/commands/bootstrap.sh +++ b/commands/bootstrap.sh @@ -9,10 +9,13 @@ die() { printf 'rig-bootstrap: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; } usage() { cat <<'EOF' -usage: rig bootstrap [--hostname ] [--ts-tag ] +usage: rig bootstrap [--hostname ] [--ts-tag ] --hostname tailnet hostname (default: the role name) - --ts-tag tailnet tag to advertise (default: tag:server) + --ts-tag tailnet tag to advertise (default: tag:server; + role runner defaults to tag:ci and refuses tag:server — + a CI box executes repo-controlled code, and your server + tag's grants must never extend to it) Provide the single-use tailscale pre-auth key via the TS_AUTHKEY env var, or enter it at the interactive prompt. It is used once and never written to disk. @@ -22,14 +25,18 @@ EOF # --- args (validated before the root check, so errors are testable) --------- ROLE="${1:-}" case "$ROLE" in - control-plane|workload) shift ;; + control-plane|workload|runner) shift ;; -h|--help) usage; exit 0 ;; - "") usage >&2; die "role required (control-plane|workload)" 2 ;; - *) die "unknown role: $ROLE (want control-plane|workload)" 2 ;; + "") usage >&2; die "role required (control-plane|workload|runner)" 2 ;; + *) die "unknown role: $ROLE (want control-plane|workload|runner)" 2 ;; esac TS_HOSTNAME="$ROLE" -TS_TAG="tag:server" +if [ "$ROLE" = "runner" ]; then + TS_TAG="tag:ci" +else + TS_TAG="tag:server" +fi while [ $# -gt 0 ]; do case "$1" in --hostname) @@ -42,6 +49,12 @@ while [ $# -gt 0 ]; do esac done +# A runner executes repo-controlled code; advertising the server tag would +# extend every grant your servers hold to that code. Refused, not warned. +if [ "$ROLE" = "runner" ] && [ "$TS_TAG" = "tag:server" ]; then + die "role runner must not advertise tag:server" 2 +fi + # --- guards ------------------------------------------------------------------ [ "$(id -u)" -eq 0 ] || die "must run as root" if [ -r /etc/os-release ]; then @@ -109,4 +122,6 @@ fi log "done — role ${ROLE}, hostname ${TS_HOSTNAME}" if [ "$ROLE" = "control-plane" ]; then log "next: rig coolify install --version " +elif [ "$ROLE" = "runner" ]; then + log "next: rig runner install --repo --version " fi diff --git a/docs/plans/2026-07-11-runner-install.md b/docs/plans/2026-07-11-runner-install.md index a116c5f..c7a4694 100644 --- a/docs/plans/2026-07-11-runner-install.md +++ b/docs/plans/2026-07-11-runner-install.md @@ -274,6 +274,18 @@ git commit -m "docs: README section for runner install" --- +## Addendum (2026-07-11, operator-requested, post final review) + +A third bootstrap role, `runner`, joins `control-plane|workload` — requested +for CLI consistency (each follow-up command applies to exactly one role) and +because it closes a real footgun mechanically: the role defaults `--ts-tag` +to `tag:ci` and **refuses `tag:server`** (exit 2, validated before the root +check). Forgetting the tag flag previously joined the CI box with the default +server tag — the exact misconfiguration the runner posture exists to prevent. +Everything else about bootstrap is unchanged; `runner install`'s contract is +untouched. Tests: +2 (`runner refuses tag:server`, `runner role parses / +refuses non-root`) → 27 non-root. + ## Integration (orchestrator, after final review — not an SDD task) 1. Push the branch to the fork and open the PR **against upstream**: diff --git a/test/cli.sh b/test/cli.sh index 7298a3d..23d9dc8 100644 --- a/test/cli.sh +++ b/test/cli.sh @@ -36,10 +36,12 @@ check "bootstrap: --help exits 0" 0 "usage:" "$ROOT/commands/bo check "bootstrap: unknown role exits 2" 2 "unknown role" "$ROOT/commands/bootstrap.sh" potato check "bootstrap: unknown flag exits 2" 2 "unknown flag" "$ROOT/commands/bootstrap.sh" workload --nope check "bootstrap: hostname needs value" 2 "needs a value" "$ROOT/commands/bootstrap.sh" workload --hostname +check "bootstrap: runner refuses tag:server" 2 "must not advertise tag:server" "$ROOT/commands/bootstrap.sh" runner --ts-tag tag:server if [ "$(id -u)" -ne 0 ]; then check "bootstrap: refuses non-root" 1 "must run as root" env TS_AUTHKEY=x "$ROOT/commands/bootstrap.sh" workload + check "bootstrap: runner role parses, refuses non-root" 1 "must run as root" env TS_AUTHKEY=x "$ROOT/commands/bootstrap.sh" runner else - echo "skip: bootstrap non-root refusal (running as root)" + echo "skip: bootstrap non-root refusals (running as root)" fi check "coolify: version required, exit 2" 2 "--version" "$ROOT/commands/coolify-install.sh"