node_bootstrap
Provision a fresh Ubuntu VPS as a hardened Tailscale, Docker, and remnanode node, dry-running plans before applying fleet setup and audits.
Instructions
Turn a fresh Ubuntu server into a node with vps-edge-run.sh (github.com/akadorkin/remnanode-install-script): user + sudo, Tailscale (--ssh, exit node), Docker, hardening (ssh, fail2ban, UFW tailscale-only), tuning, node_exporter, geo updater, certbot certificate for the domain, remnanode with the panel's SECRET_KEY. That is only the start of the current baseline: afterwards ops-scripts fleet-node-seal.sh (ipset blocklists, MGMT-PORTS, node_exporter, beszel-agent, log-upload) — the node_add runbook (scenario_start) runs the whole sequence; fleet_audit shows what is missing. Runs detached on the server over its public IP (the firewall reset cuts public ssh); poll with job_status. The server reboots 3 min after success. Needs the domain's A record pointing at the server.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | inventory host (with bootstrap.address) or a new name | |
| user | No | sudo user to create (default: inventory/defaults user) | |
| apply | No | false (default) = dry run: show what will happen on which hosts and a planHash. true = run it; needs planHash | |
| domain | No | remnanode TLS domain (default: inventory domain) | |
| address | No | public IP / ssh target of the fresh server (default: bootstrap.address from the inventory) | |
| sshPort | No | ||
| sshUser | No | initial ssh user (root on most VPS) | root |
| hostname | No | ||
| planHash | No | planHash from the dry run of the very same call, good for one apply; refused if targets or their state changed since | |
| remnanode | No | ||
| secretKey | No | remnanode SECRET_KEY; default: fetched from the panel (/api/keygen) | |
| tailscaleAuthKey | No | tskey-auth-… to join the tailnet unattended; else the log shows a login URL to open |