Repository navigation
fix(setup): non-root + tailscale provisioning on fresh Debian 13 - #54
Merged
Merged
Conversation
Found provisioning a fresh OVH Debian 13 VPS as `debian` with --network tailscale. Each fix was reproduced and verified live there. - ssh: offer only host-key algorithms known_hosts holds for the host - ssh: Upload applies the mode after writing (0440 was unwritable off-root) - harden/setup: sbin probes (ufw, auditctl, visudo, ufw status) via sudo - network: tailscale/headscale join via --auth-key=file: (CLI ignores TS_AUTHKEY); parse status JSON instead of a compact substring - setup: leave an already-joined tailnet node alone on re-run (the unconditional state wipe logged servers out); surface join output on timeout - setup/doctor: install and check cron - deploy/validate: DNS check accepts the server's interface addresses when it is reached over a mesh IP Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…he redirect Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provisioning a fresh OVH Debian 13 VPS as
debianwith--network tailscaleexposed a chain of bugs. They never showed up before because the other fleet boxes are root or were only set up once. Each fix was reproduced and verified live on that box (deploy-ovh2).Fixes
known_hostsholds for the host. Before, a box first trusted by stockssh(ed25519) failed with a mismatch when Go negotiated ecdsa. Confirmed live: the old binary fails and the new one connects.chmodnow runs aftercat. A 0440 target such as the sudoers audit drop-in could not be written by a non-root user, which aborted hardening.ufw,auditctl,visudoandufw statusare in/usr/sbin, which isn't on a non-root user's PATH. ufw and auditd were reinstalled on every run, the firewall stage reported "No active firewall", andvisudowas not found.--auth-key=file:<staged path>. tailscale 1.104 ignoresTS_AUTHKEYand fell back to an interactive login URL, verified live. The key still never appears in argv, and the staged file is removed when the CLI exits."BackendState":"Running"substring never matched the pretty-printed output./var/lib/tailscaleon an already-joined node. The wipe plus a re-up with the spent one-time key logged the server out. Verified live: a re-run with a fake key leaves the node joined.hostname -I). A server registered by its Tailscale IP refused every public domain.Verified live on deploy-ovh2
go vet ./...andgo test ./...pass.debianwith--network tailscale.doctor: 15 ok, 0 warn, 0 fail.traefik/whoami): health check, HTTPS, remove.Not live-verified: the join-output-on-timeout message. It would have meant logging the node out again.
🤖 Generated with Claude Code