Skip to main content
Glama

node_bootstrap

Provision a fresh Ubuntu VPS as a hardened Tailscale, Docker, and remnanode node, dry-running plans before applying fleet setup and audits.

Instructions

Turn a fresh Ubuntu server into a node with vps-edge-run.sh (github.com/akadorkin/remnanode-install-script): user + sudo, Tailscale (--ssh, exit node), Docker, hardening (ssh, fail2ban, UFW tailscale-only), tuning, node_exporter, geo updater, certbot certificate for the domain, remnanode with the panel's SECRET_KEY. That is only the start of the current baseline: afterwards ops-scripts fleet-node-seal.sh (ipset blocklists, MGMT-PORTS, node_exporter, beszel-agent, log-upload) — the node_add runbook (scenario_start) runs the whole sequence; fleet_audit shows what is missing. Runs detached on the server over its public IP (the firewall reset cuts public ssh); poll with job_status. The server reboots 3 min after success. Needs the domain's A record pointing at the server.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hostYesinventory host (with bootstrap.address) or a new name
userNosudo user to create (default: inventory/defaults user)
applyNofalse (default) = dry run: show what will happen on which hosts and a planHash. true = run it; needs planHash
domainNoremnanode TLS domain (default: inventory domain)
addressNopublic IP / ssh target of the fresh server (default: bootstrap.address from the inventory)
sshPortNo
sshUserNoinitial ssh user (root on most VPS)root
hostnameNo
planHashNoplanHash from the dry run of the very same call, good for one apply; refused if targets or their state changed since
remnanodeNo
secretKeyNoremnanode SECRET_KEY; default: fetched from the panel (/api/keygen)
tailscaleAuthKeyNotskey-auth-… to join the tailnet unattended; else the log shows a login URL to open

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that execution is detached over the public IP, that the firewall reset severs public SSH, that polling must go through job_status, and that the server reboots 3 minutes after success. It also reveals the two-phase baseline (bootstrap then fleet-node-seal.sh) with ipset blocklists, MGMT-PORTS and agents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action followed by the sequence and caveats, and every clause carries real information. It is dense and somewhat run-on, with the baseline description packed into a single sprawling sentence, but nothing is wasted given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, annotation-free, output-schema-free provisioning tool this is remarkably complete: prerequisites, side effects (SSH severance, reboot), async lifecycle, dry-run semantics, and the follow-on sealing phase are all covered. An agent has enough to reason about blast radius before invoking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema documents most parameters. The description adds operational meaning by tying secretKey to the panel's SECRET_KEY, framing planHash as a one-shot dry-run token, and noting the Tailscale auth path (--ssh, exit node), though thinner params like hostname and remnanode remain unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Turn a fresh Ubuntu server into a node'), names the concrete script it drives, and enumerates the resulting stack. It clearly differentiates itself from siblings by positioning scenario_start as the full-sequence runner and fleet_audit as the gap reporter.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: scenario_start runs the whole sequence while this is 'only the start of the current baseline', fleet_audit shows what is missing, and job_status is the polling mechanism. It also states the prerequisite (domain A record pointing at the server) and the apply/planHash gate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.