aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

feat: enable Paperclip remote VM execution via SSH #222

Merged
aaron merged 3 commits from feat/paperclip-remote-vm-execution into live 2026-06-11 22:27:10 +00:00
Conversation 0 Commits 3 Files changed 10 +128 -6
aaron commented 2026-06-11 22:26:47 +00:00
Owner
Copy link

Enables Paperclip agents to execute via SSH on Management VM 110.

Ansible changes:

  • mgmt-security: add prod_network_cidr / prod_ssh_allow_pattern variables and UFW allow rule
  • mgmt-security: dual AllowUsers lines in sshd_config for mgmt + prod networks
  • mgmt-base: create operator user, provision .ssh dir and dev-agent public key
  • mgmt-tools: install Node.js + npm (stat-guarded), install pi-coding-agent@0.74.0
  • inventory: populate VM 110 IPs (mgmt 192.168.1.10, VLAN 10.10.10.5)

Helm changes:

  • paperclip/values.yaml: add ssh config block and secrets.sshKey
  • CiliumNetworkPolicy: conditional toCIDR egress rule for VM 110:22
  • Deployment: conditional dev-agent-ssh secret volume mount at /home/node/.ssh/id_ed25519

K8s manifests:

  • ExternalSecret to replicate dev-agent-ssh from secrets → paperclip namespace
Enables Paperclip agents to execute via SSH on Management VM 110. **Ansible changes:** - mgmt-security: add `prod_network_cidr` / `prod_ssh_allow_pattern` variables and UFW allow rule - mgmt-security: dual `AllowUsers` lines in sshd_config for mgmt + prod networks - mgmt-base: create `operator` user, provision `.ssh` dir and dev-agent public key - mgmt-tools: install Node.js + npm (stat-guarded), install `pi-coding-agent@0.74.0` - inventory: populate VM 110 IPs (mgmt 192.168.1.10, VLAN 10.10.10.5) **Helm changes:** - paperclip/values.yaml: add `ssh` config block and `secrets.sshKey` - CiliumNetworkPolicy: conditional `toCIDR` egress rule for VM 110:22 - Deployment: conditional `dev-agent-ssh` secret volume mount at `/home/node/.ssh/id_ed25519` **K8s manifests:** - ExternalSecret to replicate `dev-agent-ssh` from `secrets` → `paperclip` namespace
fix(ansible): create operator user, populate inventory, allow package downgrades
Some checks failed
0/0 projects applied successfully.
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Release / release (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
5d0358b1cf
aaron merged commit 41165afaa4 into live 2026-06-11 22:27:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!222
No description provided.