Ryan Hughes
7e86af28b3
The controller created every builder without a DigitalOcean account key, so DigitalOcean set a root password, emailed it to the token's owner, and turned password logins on: one email and one password-reachable box per builder, 146 of them on Oct 8. DO_SSH_KEYS lists account key IDs attached at creation (Ryan, DHH and Emir in the template). It needs ssh_key:read on the controller's token; without it every create is refused with 403, so it stays empty until the token has it. Builders also turn password SSH off in cloud-init, which holds even while no account key is attached, and Emir joins the operators whose GitHub keys reach root.
25 lines
1.1 KiB
Bash
25 lines
1.1 KiB
Bash
# /etc/omarchy-controller.env — mode 0600, owned by root, read by systemd.
|
|
DIGITALOCEAN_TOKEN=dop_v1_...
|
|
# Fine-grained PAT scoped to the repo: Actions: read, Administration: read+write
|
|
GITHUB_TOKEN=github_pat_...
|
|
REPO=omacom/omarchy-pkgs
|
|
LABEL=omarchy-builder
|
|
TAG=omarchy-builder
|
|
# Builder sizes, tried in order in any region that has them in stock.
|
|
SIZES="g5-32vcpu-64gb-50gb g5-32vcpu-128gb-50gb"
|
|
# Optional: regions to try first, e.g. "ric1". Empty means any.
|
|
REGIONS=
|
|
MAX_DROPLETS=6
|
|
MAX_AGE_MINUTES=200
|
|
# Delete a droplet DigitalOcean still reports as provisioning after this long.
|
|
MAX_BOOT_MINUTES=10
|
|
LOCK=/run/omarchy-controller/lock
|
|
# Operator public keys for root on every builder droplet (JSON array).
|
|
# create.sh fills this from the operators' GitHub keys.
|
|
SSH_KEYS_JSON=[]
|
|
# DigitalOcean account SSH key IDs attached to every builder (JSON array), so
|
|
# DigitalOcean does not email a root password for each one. Needs ssh_key:read
|
|
# on DIGITALOCEAN_TOKEN. List them with: doctl compute ssh-key list
|
|
# Ryan R. Hughes, DHH, Emir.
|
|
DO_SSH_KEYS=[59143572,59143588,59779105]
|