Mortdecai
c1558d2630
scripts/tank-automount.sh (run on the Mac, password on stdin) adds a /- direct map and root-owned /etc/auto_smb pointing at //Administrator@ 192.168.0.173/tank with soft. Mounts on first access, unmounts idle, so the laptop can leave the LAN without hung Finder or login dialogs. Findings baked in: - macOS automount does not create direct-map trigger dirs -> mkdir -p - automounted fs are always nobrowse (man auto_master): shows as a folder, not a Locations drive -> Finder Favorite (manual-checklist) - no-tty sudo ticket is per parent pid: sudo inside $(...) fails, so the idempotency check is a pipeline (sudo cmp -s -) - SMB over NFS: Mac seth is uid 501; SMB force user=root matches /mnt/Z Also: checklist Gitea key -> id_ed25519_homelab; the smb://.../tank 'user seth' step was wrong (no such Samba user) and is now the automount. Wired into run.sh. Verified: mount, root-owned write, two all-[skip] reruns. Not yet verified across a reboot (FileVault). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
38 lines
2.0 KiB
Bash
Executable File
38 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# From steel141: sync repo to the Mac, run setup there UNATTENDED, pull backups back, then tank side.
|
|
# Usage: scripts/run.sh [--no-tank]
|
|
#
|
|
# Homebrew's install needs sudo for 10+ min across child processes. We grant a TEMPORARY
|
|
# /etc/sudoers.d/mac-setup (NOPASSWD) for the run and guarantee its removal three ways:
|
|
# 1. explicit removal after setup, 2. an EXIT trap (covers failures / a dropped ssh from here),
|
|
# 3. a 40-min self-destruct on the Mac itself (covers steel141 losing the network).
|
|
# $HOMELAB_PASSWORD is used once (piped, never in argv) to install the drop-in.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
[[ -n ${HOMELAB_PASSWORD:-} ]] || { echo "HOMELAB_PASSWORD must be set"; exit 1; }
|
|
|
|
rsync -a --delete --exclude .git --exclude .backup --exclude Brewfile.lock.json ./ mac:mac/
|
|
|
|
cleanup(){ printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac "sudo -S -p '' rm -f /etc/sudoers.d/mac-setup 2>/dev/null; sudo -K 2>/dev/null" || true; }
|
|
trap cleanup EXIT
|
|
|
|
# Install temp NOPASSWD drop-in (installer is a repo file, rsynced above; password piped to its stdin).
|
|
printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts/_install_sudoers.sh'
|
|
|
|
# sudo is now passwordless on the Mac; run setup unattended (Homebrew + everything).
|
|
ssh -o BatchMode=yes mac "HOSTNAME_WANT=mac ~/mac/scripts/setup.sh"
|
|
|
|
# tank autofs mount (reads the password on stdin: SMB credential + its own sudo -S).
|
|
printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts/tank-automount.sh'
|
|
|
|
# Explicit removal + confirm; then disarm the trap so it doesn't double-run.
|
|
cleanup; trap - EXIT
|
|
ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp sudoers removed" || echo "[WARN] temp sudoers STILL PRESENT"'
|
|
|
|
mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/
|
|
scripts/authorize-mac-key.sh
|
|
[[ ${1:-} == --no-tank ]] && exit 0
|
|
PUB=$(ssh mac cat .ssh/id_ed25519.pub)
|
|
ssh pve173 "PUB='$PUB' bash -s" < scripts/tank-side.sh
|
|
echo "tank side done; test: ssh mac ~/mac/scripts/backup.sh"
|