fix: Minor fixes to provision logic

Author: adskyiproger

infrastructure/server-setup/files/add-k8s-user.sh

@@ -6,7 +6,7 @@ K8S_CA_CERT="/etc/kubernetes/pki/ca.crt"
 K8S_CA_KEY="/etc/kubernetes/pki/ca.key"
 K8S_ADMIN_KUBECONFIG="/etc/kubernetes/admin.conf"
 OUTPUT_BASE="./user-kubeconfigs"
-PUBLIC_API_SERVER_IP=${PUBLIC_API_SERVER_IP:-"localhost"}
+PUBLIC_API_SERVER_IP=${PUBLIC_API_SERVER_IP:-"91.99.202.110"}   # <--- <<< replace with your public IP address
 API_SERVER_PORT="6443"
 ZIP_PASSWORD_PROMPT="Enter zip password (leave empty for no password): "
 ASK_PASSWORD=${ASK_PASSWORD:-yes}
@@ -16,7 +16,7 @@ if [ "$(id -u)" -ne 0 ]; then
   exit 1
 fi
 # ====== USERNAME INPUT ======
-USERNAME="${1:-}-$(hostname -s)"
+USERNAME="${1:-}"
 if [ -z "$USERNAME" ]; then
   read -rp "Enter username: " USERNAME
   [[ -z "$USERNAME" ]] && echo "Username cannot be empty!" && exit 1

infrastructure/server-setup/tasks/all/users.yml

@@ -278,6 +278,14 @@
     - ansible_facts['distribution'] == 'Ubuntu'
     - ansible_facts['distribution_version'] == '24.04'
 
+- name: Ensure privilege separation directory exists
+  ansible.builtin.file:
+    path: /run/sshd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
 - name: Check SSH config syntax
   ansible.builtin.command:
     cmd: sshd -t

infrastructure/server-setup/tasks/k8s/decrypt-on-boot.yml

@@ -14,6 +14,23 @@
     content: |
       DISK_ENCRYPTION_KEY={{ disk_encryption_key }}
 
+- name: Ensure destination directory exists
+  ansible.builtin.file:
+    path: /opt/opencrvs/scripts/cryptfs
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+    recurse: yes
+
+- name: Install k8s-help script
+  copy:
+    src: ../cryptfs/decrypt.sh
+    dest: "/opt/opencrvs/scripts/cryptfs/decrypt.sh"
+    owner: "{{ ansible_user }}"
+    group: 'application'
+    mode: '0755'
+
 - name: Copy reboot.service systemd file. Must decrypt disk on reboot
   ansible.builtin.copy:
     dest: /etc/systemd/system/reboot.service
@@ -25,7 +42,7 @@
       Description=Mount encrypted dir
 
       [Service]
-      ExecStart=bash /opt/opencrvs/infrastructure/cryptfs/decrypt.sh -key /root/disk-encryption-key.txt >> /var/log/cryptfs-reboot.log 2>&1
+      ExecStart=bash /opt/opencrvs/scripts/cryptfs/decrypt.sh -key /root/disk-encryption-key.txt >> /var/log/cryptfs-reboot.log 2>&1
 
       [Install]
       WantedBy=multi-user.target