Benjamin DiedrichsenandClaude Fable 5
643d7379ba
PUBKEY defaults to empty now — empty means no key is authorised, and some users need none. GROUPS was always split on whitespace by deploy.py, so the comma-separated prompt label and README were documenting a bug; both now say space-separated. The deploy script checks the Users fact up front and noops when the user exists, since rerunning reset the password and overwrote ~/.config/fish. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ce5atB2tXDXyz2jd9s1bqE
31 lines
1.2 KiB
JavaScript
31 lines
1.2 KiB
JavaScript
import { Manifest, uniqid } from '@bitsquare/nopy-cubes';
|
|
import { z } from 'zod';
|
|
|
|
export default Manifest({
|
|
id: 'user:add',
|
|
name: 'Add a user with fish shell and tools',
|
|
dependencies: () => ['apt:essentials'],
|
|
secrets: ['PASSWORD'],
|
|
schema: z.object({
|
|
USER: z
|
|
.string()
|
|
.describe('Username for the new user account')
|
|
.default(() => `user${uniqid(5)}`),
|
|
// A fixed placeholder, not a generated one: the password is never recorded
|
|
// in a session, so a generated default meant every run produced credentials
|
|
// nobody had seen and a replay produced different ones again.
|
|
PASSWORD: z.string().describe('Password for the new user account').default('changeme'),
|
|
GROUPS: z
|
|
.string()
|
|
.describe('Space-separated list of additional groups (e.g., "docker sudo")')
|
|
.default(''),
|
|
// Empty by default, never a specific key: this used to carry a personal
|
|
// key, which meant an unattended run authorised someone else's key on the
|
|
// new account. Empty means no key is authorised — some users need none.
|
|
PUBKEY: z
|
|
.string()
|
|
.describe('SSH public key to authorize for the user (empty for none)')
|
|
.default(''),
|
|
}),
|
|
});
|