ml
a462ff1729
- ansible.cfg: suppress Python interpreter discovery warning - ansible/inventory.ini: add ansible_host; server IP is now defined in one place and read dynamically by run-bootstrap.sh - group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible (previously vault.yml did not match any group name and was silently ignored) - scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private keys automatically, show actual SSH error when root login fails - scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group membership alone was not enough) - nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine, switched to CMD form with start_period) - group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not exist; correct tag is 1.6.x-apache) - docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for setting the server IP, expand bootstrap step with preflight detail, fix step numbering
44 lines
1.2 KiB
Bash
Executable File
44 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run once as root on a fresh server to create the deploy user Ansible connects as.
|
|
# Usage: bash bootstrap-deploy-user.sh <ssh-public-key>
|
|
|
|
set -euo pipefail
|
|
|
|
SSH_PUBKEY="${1:?Usage: bootstrap-deploy-user.sh <ssh-public-key>}"
|
|
DEPLOY_USER="deploy"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "ERROR: must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Creating user '${DEPLOY_USER}'"
|
|
if id "${DEPLOY_USER}" &>/dev/null; then
|
|
echo " user already exists, skipping"
|
|
else
|
|
adduser --disabled-password --gecos "" "${DEPLOY_USER}"
|
|
fi
|
|
|
|
echo "==> Adding '${DEPLOY_USER}' to sudo group"
|
|
usermod -aG sudo "${DEPLOY_USER}"
|
|
|
|
echo "==> Granting '${DEPLOY_USER}' passwordless sudo"
|
|
echo "${DEPLOY_USER} ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${DEPLOY_USER}"
|
|
chmod 440 "/etc/sudoers.d/${DEPLOY_USER}"
|
|
|
|
echo "==> Installing SSH authorized key"
|
|
SSH_DIR="/home/${DEPLOY_USER}/.ssh"
|
|
AUTH_KEYS="${SSH_DIR}/authorized_keys"
|
|
mkdir -p "${SSH_DIR}"
|
|
if grep -qF "${SSH_PUBKEY}" "${AUTH_KEYS}" 2>/dev/null; then
|
|
echo " key already present, skipping"
|
|
else
|
|
echo "${SSH_PUBKEY}" >> "${AUTH_KEYS}"
|
|
fi
|
|
chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${SSH_DIR}"
|
|
chmod 700 "${SSH_DIR}"
|
|
chmod 600 "${AUTH_KEYS}"
|
|
|
|
echo ""
|
|
echo "Done."
|