rig made every box except one: the Incus host that runs the claudeboxes was
hand-built, so "every box is rig-made, reproducibly" had a hole exactly where
an agent runs. Add `rig bootstrap dev`, same shape as the other roles —
idempotent, convergent, a second run is a no-op.
dev reuses all the shared machinery (00-rig.conf sshd drop-in + sshd -T
effective assert, hostname convergence, tailscale join) and adds:
- Tag policy: defaults TS_TAG to tag:local and REFUSES tag:server (exit 2,
mirroring the runner refusal). tag:server's ACL grants :22, so a mis-tagged
dev host would hand the control plane free SSH — the exact bug that made both
M900s retag-by-hand jobs. Correct-tag-only is enforced, not documented.
- Incus install + init, dev-only: apt-get install incus, then `incus admin
init --auto` ONCE. --auto is not idempotent, so a prior init is detected by
its artefacts (a storage pool AND a root disk on the default profile) and
re-init skipped, keeping a second run a true no-op. Effective state is
asserted after (default profile root disk, incusbr0) rather than trusting
init's exit code.
- A comment recording that the guest claudeboxes deliberately do NOT join the
tailnet — the host joins, guests are reached via ProxyJump through it; an
"enrol the guests" convenience would be the bug.
Unit tests cover arg parsing and the tag:server refusal; incus init and the
effective tag:local assertion need a real host and belong in the rehearsal.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
runner install is convergent by skipping: it sees a registered runner and
leaves it alone. So rig could create a runner and never move or destroy one,
and re-pointing a box at a different repo meant hand-rolled config.sh/svc.sh
incantations against an install layout only rig knew about.
- status: repo, name, labels, dir, unit — read-only, no token, no network.
- remove: service down, then deregister. --local wipes the box without
contacting GitHub, leaving a stale entry to delete by hand.
- repoint: remove + re-register in one act, keeping the runner's name and
reusing the binary already on the box.
The service always comes down before deregistration in both paths: GitHub's
removal throws "Uninstall service first" while the service is configured, and
--local bypasses that check entirely, which would strand a running service
pointed at deleted config.
repoint collects both tokens up front — a token you turn out not to have must
fail while the runner is still registered, not halfway through the move.
Labels are the sharp edge: GitHub holds them, the runner does not persist
them, and they are what runs-on matches. install now records what it
registered with so repoint and status can read it back; a runner installed
before that has nothing to read, so repoint falls back to the ci-runner
default and warns before it touches anything.
The Coolify control-plane database holds the GitHub App private key, every
registered server's SSH key, and every environment value for every environment
it manages. Backing it up was a manual runbook step, and the dump script lived
in cast — the off-box tool, whose src never references it. It runs on the box,
as root, under a scheduler: that is rig's job description.
It matters beyond tidiness. The dump is forensics, not a restore path — a lost
control plane is rebuilt fresh and reconciled from the manifest. So there will
be a next control-plane box, and as a runbook step it was born un-backed-up,
depending on someone remembering mid-incident. Now it is backed up from birth.
rig installs the machinery and templates /etc/coolify-dump.env empty at 0600,
never reading it back — no credential passes through rig. The script's own
guards make an unfilled file fail the unit loudly rather than ship plaintext.
systemd timer over cron: EnvironmentFile is the right idiom for 0600 secrets,
failures surface in systemctl status instead of being mailed into the void, and
Persistent=true catches a run missed while the box was down.
Two hazards the cast script missed, carried into the unit:
- aws-cli >= 2.23 enables default upload checksums that S3-compatible backends
reject; Debian 13 ships 2.23.6, so the unit defaults both checksum knobs to
when_required.
- A failed pg_dump piped into age still yields a valid, tiny, encrypted file
that uploads cleanly every night and looks exactly like a working backup. The
script now refuses to upload an empty artifact.
Closes#8
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
