feat: rig CLI — bootstrap, coolify install, curl installer #1

Merged

dan-claude-bot merged 8 commits from feat/rig into main

2026-07-11 08:34:50 +00:00

dan-claude-bot commented

2026-07-11 08:26:09 +00:00

(Migrated from github.com)

What

The rig box-plumbing CLI (born as deployor in claude-hdb/deployor2, PR #1 there reviewed + merged; imported here under the canonical name and org):

bin/rig dispatcher + commands/bootstrap.sh (sshd hardening, unattended-upgrades, tailscale join — convergent, root-run) + commands/coolify-install.sh (version-pinned Coolify install, AUTOUPDATE=false, pin required)
install.sh — curl tarball installer (claudebox pattern; /usr/local/bin symlink when root)
test/cli.sh — 16 dependency-free checks; shellcheck + tests in CI
Final commit renames deployor→rig throughout (command, RIG_* env vars, log prefixes, 99-rig.conf drop-in) and sets canonical heavy-duty/rig URLs

Verification

Full gate green post-rename: shellcheck silent across all scripts, 16/16 tests.
History carries the original SDD reviews (per-task + whole-branch, clean) from the deployor build.
install.sh remains functionally untestable pre-merge (downloads the main tarball, which lacks bin/rig until this lands) — its gate is the post-merge throwaway-Incus rehearsal.

Credential model

The only box-side credential is a single-use tailnet pre-auth key, env/prompt only, never written to disk.

🤖 Generated with Claude Code

## What The rig box-plumbing CLI (born as `deployor` in claude-hdb/deployor2, PR #1 there reviewed + merged; imported here under the canonical name and org): - `bin/rig` dispatcher + `commands/bootstrap.sh` (sshd hardening, unattended-upgrades, tailscale join — convergent, root-run) + `commands/coolify-install.sh` (version-pinned Coolify install, `AUTOUPDATE=false`, pin required) - `install.sh` — curl tarball installer (claudebox pattern; `/usr/local/bin` symlink when root) - `test/cli.sh` — 16 dependency-free checks; shellcheck + tests in CI - Final commit renames deployor→rig throughout (command, `RIG_*` env vars, log prefixes, `99-rig.conf` drop-in) and sets canonical `heavy-duty/rig` URLs ## Verification - Full gate green post-rename: shellcheck silent across all scripts, 16/16 tests. - History carries the original SDD reviews (per-task + whole-branch, clean) from the deployor build. - `install.sh` remains functionally untestable pre-merge (downloads the `main` tarball, which lacks `bin/rig` until this lands) — its gate is the post-merge throwaway-Incus rehearsal. ## Credential model The only box-side credential is a single-use tailnet pre-auth key, env/prompt only, never written to disk. 🤖 Generated with [Claude Code](https://claude.com/claude-code)