amadan
infra: tito host-init script (was missing from the module)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+28
−0
infra/tito/host-init.sh+28 −0
diff --git a/infra/tito/host-init.sh b/infra/tito/host-init.sh| new file mode 100644 |
| index 000000000..6406cb6e7 |
| --- /dev/null |
| +++ b/infra/tito/host-init.sh |
| @@ -0,0 +1,28 @@ |
| +#!/bin/bash |
| +# 🤖 First-boot init for the carlos tito IE host (Debian arm64). |
| +# Deliberately minimal: the carlos binary arrives via bootstrap after the |
| +# box is up — this script only prepares the ground the binary expects. |
| +set -euo pipefail |
| + |
| +useradd --system --home /opt/carlos --shell /usr/sbin/nologin carlos || true |
| +mkdir -p /data /opt/carlos/versions /opt/carlos/live /etc/carlos |
| +chown -R carlos:carlos /data /opt/carlos |
| +chmod 0700 /data |
| + |
| +cat >/etc/tmpfiles.d/carlos.conf <<'EOF' |
| +d /run/carlos 0755 carlos carlos - |
| +EOF |
| +systemd-tmpfiles --create /etc/tmpfiles.d/carlos.conf |
| + |
| +export DEBIAN_FRONTEND=noninteractive |
| +apt-get update -q |
| +apt-get install -qy unattended-upgrades curl awscli |
| +systemctl enable --now unattended-upgrades |
| + |
| +# Admin access is SSM Session Manager only — no SSH ingress exists. |
| +curl -fsSL -o /tmp/amazon-ssm-agent.deb \ |
| + "https://s3.eu-west-1.amazonaws.com/amazon-ssm-eu-west-1/latest/debian_arm64/amazon-ssm-agent.deb" |
| +dpkg -i /tmp/amazon-ssm-agent.deb |
| +systemctl enable --now amazon-ssm-agent |
| + |
| +echo "carlos host ready — awaiting bootstrap" >/etc/motd |