ml
03d2f6d57a
- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a fresh server, verifies SSH login, checks vault as a preflight step - scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the SSH public key as an argument (read from keys/ by run-bootstrap.sh) - scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required secrets are present and non-empty - docs/runbook.md: restructured into correct order (collections → DNS → vault → bootstrap → playbook), added scripts reference table, moved first-run notes for Gitea/Keycloak/registry into their own section - README.md: added scripts/ to repo layout
40 lines
1.0 KiB
Bash
Executable File
40 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run once as root on a fresh server to create the deploy user Ansible connects as.
|
|
# Usage: bash bootstrap-deploy-user.sh <ssh-public-key>
|
|
|
|
set -euo pipefail
|
|
|
|
SSH_PUBKEY="${1:?Usage: bootstrap-deploy-user.sh <ssh-public-key>}"
|
|
DEPLOY_USER="deploy"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "ERROR: must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Creating user '${DEPLOY_USER}'"
|
|
if id "${DEPLOY_USER}" &>/dev/null; then
|
|
echo " user already exists, skipping"
|
|
else
|
|
adduser --disabled-password --gecos "" "${DEPLOY_USER}"
|
|
fi
|
|
|
|
echo "==> Adding '${DEPLOY_USER}' to sudo group"
|
|
usermod -aG sudo "${DEPLOY_USER}"
|
|
|
|
echo "==> Installing SSH authorized key"
|
|
SSH_DIR="/home/${DEPLOY_USER}/.ssh"
|
|
AUTH_KEYS="${SSH_DIR}/authorized_keys"
|
|
mkdir -p "${SSH_DIR}"
|
|
if grep -qF "${SSH_PUBKEY}" "${AUTH_KEYS}" 2>/dev/null; then
|
|
echo " key already present, skipping"
|
|
else
|
|
echo "${SSH_PUBKEY}" >> "${AUTH_KEYS}"
|
|
fi
|
|
chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${SSH_DIR}"
|
|
chmod 700 "${SSH_DIR}"
|
|
chmod 600 "${AUTH_KEYS}"
|
|
|
|
echo ""
|
|
echo "Done."
|