Adds a non-root admin user (sudo group, never docker, NOPASSWD sudo,
key-only) on every role, with its authorized_keys seeded ONCE from root's
at creation — live proof the operator holds the private key. --admin-key
composes an explicit key with the seed.
Adds --lock-root (PermitRootLogin no), role-gated: refused (exit 2) on
control-plane (Coolify self-SSH) and workload (needs Coolify's experimental
non-root mode rig doesn't provision), allowed on runner. Before closing
root's door it verifies the admin is reachable (account not expired, real
shell, sane authorized_keys, sudo -n true, sshd -T -C resolution permits
the login); any failure leaves the door open and says why.
The PermitRootLogin no drop-in is 00-rig-root.conf, sorting BEFORE
00-rig.conf so first-wins sshd_config semantics actually apply it, installed
with the same validate-before-restart + sshd -t + rollback + sshd -T
effective-assert dance as the base hardening.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3ae3e3fea3