post-bootstrap script

[Ccccraz]

🚀 Overview

We’ve been exploring how to securely distribute sensitive information to Cagelab instances.
Examples of such data include:

• 🔑 Netbird key
• 🔐 SSH public key (secure, but inconvenient to manage via GitHub)

---

🛠️ Proposed Approach: Two-Step Setup

1. bootstrap.sh
   Runs inside the target Cagelab instance, preparing the environment:

   • Install Netbird
   • Install SSH server
   • Perform basic setup

2. post-bootstrap script
   Runs on a separate machine (e.g., an office workstation).
   The user manually provides sensitive information here, such as:

   • Netbird key
   • Updated SSH public keys

---

🔄 Sequence (Two-Step)

sequenceDiagram
    participant Workstation as Workstation (Office PC)
    participant Cagelab as Cagelab Instance

    Cagelab->>Cagelab: Run bootstrap.sh
    Note over Cagelab: Basic setup completed

    Workstation->>Cagelab: Run post-bootstrap script provides Netbird key && etc..
    Note over Cagelab: Sensitive data configured

Loading

---

🔍 Further Simplification

• Windows (SSH disabled by default): must follow the two-step process above.
• Linux (SSH enabled by default): can often be simplified into one step, enabling full remote configuration.

In the Linux case, the control server directly calls bootstrap.sh and provides sensitive information as parameters.
This eliminates the need for a separate post-bootstrap step.

---

🔄 Sequence (One-Step, Linux)

sequenceDiagram
    participant Control as Control Server
    participant Cagelab as Cagelab Instance (Linux)

    Control->>Cagelab: Invoke bootstrap.sh with parameters (Netbird key, SSH public keys, etc.)
    Note over Cagelab: bootstrap.sh
    Note over Cagelab: Applies sensitive data

Loading

---

📊 Comparison

System Type	Approach	Notes
🪟 Windows	Two steps → run bootstrap.sh (basic setup), then post-bootstrap (inject sensitive info)	Separation required since the instance cannot initially receive sensitive data directly
🐧 Linux	One step → control server directly invokes bootstrap.sh with sensitive parameters	Enables complete remote configuration without a separate step

[iandol]

https://documentation.ubuntu.com/server/how-to/security/openssh-server/index.html#import-keys-from-public-keyservers <-- for ubuntu you can automatically import ssh public keys from github

Of course the usual issue is VPN requirement if github is blocked...