Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.
2026-09-20 12:57:44 +00:00
commit 05ea40562c
8 changed files with 459 additions and 0 deletions
@@ -0,0 +1,42 @@
+#!/bin/bash
+set -euo pipefail
+
+HOME_DIR=/home/developer
+HOST_KEY_DIR="${HOME_DIR}/.ssh-host"
+AUTH_KEYS_SRC=/etc/ssh-authorized-keys/authorized_keys
+
+mkdir -p "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" "${HOST_KEY_DIR}"
+
+# Persist host keys on the PVC so SSH fingerprints stay stable across restarts.
+if [ ! -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" ]; then
+  ssh-keygen -t ed25519 -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" -N "" -q
+fi
+if [ ! -f "${HOST_KEY_DIR}/ssh_host_rsa_key" ]; then
+  ssh-keygen -t rsa -b 4096 -f "${HOST_KEY_DIR}/ssh_host_rsa_key" -N "" -q
+fi
+
+cat > /etc/ssh/sshd_config.d/98-hostkeys.conf <<EOF
+HostKey ${HOST_KEY_DIR}/ssh_host_ed25519_key
+HostKey ${HOST_KEY_DIR}/ssh_host_rsa_key
+EOF
+
+if [ -f "${AUTH_KEYS_SRC}" ]; then
+  install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
+fi
+# sshd StrictModes rejects auth if $HOME is group/world-writable.
+chmod 755 "${HOME_DIR}"
+chmod 700 "${HOME_DIR}/.ssh"
+chown -R developer:developer "${HOME_DIR}"
+
+# DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
+grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \
+  || echo 'DOCKER_HOST=tcp://127.0.0.1:2375' >> /etc/environment
+if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.profile" 2>/dev/null; then
+  printf '\nexport DOCKER_HOST=tcp://127.0.0.1:2375\n' >> "${HOME_DIR}/.profile"
+  chown developer:developer "${HOME_DIR}/.profile"
+fi
+
+# Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
+python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &
+
+exec /usr/sbin/sshd -D -e