From 1ba3d10e3f4291970c31189ac6a54ad7c68a7c66 Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Wed, 8 Jul 2026 13:16:59 -0500
Subject: [PATCH] pushing updates

---
 IMPLEMENTATION.md                      | 24 +++++++++++++++++++++---
 README.md                              | 13 +++++++++----
 inventory/host_vars/ai-server-4080.yml |  2 ++
 scripts/provision.sh                   |  2 +-
 4 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/IMPLEMENTATION.md b/IMPLEMENTATION.md
index 0253595..0f8b571 100644
--- a/IMPLEMENTATION.md
+++ b/IMPLEMENTATION.md
@@ -87,17 +87,32 @@ Ansible needs SSH + sudo on each target before playbooks work.
    ssh westfarn@10.0.0.77
    ssh westfarn@10.0.0.176
    ```
-4. On ai-server-4080 (control node), install Ansible:
+4. **First-time only** — grant passwordless sudo on each new host before the first
+   `provision.sh` run. Ubuntu 26.04 ships `sudo-rs` by default; Ansible's
+   `--ask-become-pass` does not recognize its password prompt, so bootstrap sudo
+   manually over SSH instead:
+   ```bash
+   ssh -t westfarn@10.0.0.176   # repeat for each host IP
+   ```
+   On the host:
+   ```bash
+   echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
+   sudo chmod 440 /etc/sudoers.d/westfarn
+   exit
+   ```
+   The `common` role writes the same file on later runs; this one-time step is only
+   needed before Ansible can escalate privileges the first time.
+5. On ai-server-4080 (control node), install Ansible:
    ```bash
    sudo apt update && sudo apt install -y ansible
    # or: pip install ansible
    ```
-5. Install Galaxy collections:
+6. Install Galaxy collections:
    ```bash
    cd ~/Documents/repos/server-infra
    ansible-galaxy collection install -r requirements.yml
    ```
-6. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
+7. Update `inventory/host_vars/ai-server-4080.yml` with this machine's LAN IP (`ansible_host`).
 
 ## Testing on a Single Server
 
@@ -112,6 +127,9 @@ ansible adama -m ping
 
 ### Provision one host
 
+New hosts need the one-time passwordless sudo bootstrap in
+[Prerequisites](#prerequisites-one-time-bootstrap) before the first run.
+
 ```bash
 # Dry run (no changes)
 ./scripts/provision.sh adama --check
diff --git a/README.md b/README.md
index ee96a0a..c8958f0 100644
--- a/README.md
+++ b/README.md
@@ -10,15 +10,20 @@ ansible-galaxy collection install -r requirements.yml
 
 # Bootstrap SSH key to each host (one-time, before Ansible)
 ssh-copy-id westfarn@10.0.0.77
+ssh-copy-id westfarn@10.0.0.176
+
+# First-time only: passwordless sudo on each new host (before first provision)
+ssh -t westfarn@10.0.0.176   # repeat for each host IP
+# on the host:
+echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
+sudo chmod 440 /etc/sudoers.d/westfarn
+exit
 
 # Test connectivity to one host
 ansible adama -m ping
 
 # Provision one host (dry run first)
-./scripts/provision.sh adama --check --ask-become-pass
-./scripts/provision.sh adama --ask-become-pass   # first run; sudo password once
-
-# Later runs (after common role sets passwordless sudo)
+./scripts/provision.sh adama --check
 ./scripts/provision.sh adama
 
 # Provision all hosts
diff --git a/inventory/host_vars/ai-server-4080.yml b/inventory/host_vars/ai-server-4080.yml
index b1652d5..3f64015 100644
--- a/inventory/host_vars/ai-server-4080.yml
+++ b/inventory/host_vars/ai-server-4080.yml
@@ -4,6 +4,8 @@
 ansible_host: 10.0.0.128
 
 ansible_control_node: true
+# Deploy/ansible runs on this host; avoid self-SSH (breaks after long tasks / CI keys).
+ansible_connection: local
 act_runner_enabled: true
 
 # This host's pre-existing ~/.ssh/id_ed25519 is a personal key WITH a passphrase,
diff --git a/scripts/provision.sh b/scripts/provision.sh
index c351d88..ea6cf79 100755
--- a/scripts/provision.sh
+++ b/scripts/provision.sh
@@ -26,7 +26,7 @@ Options:
 Examples:
   $(basename "$0") adama --check    # dry run on adama only
   $(basename "$0") adama            # provision adama
-  $(basename "$0") adama --ask-pass --ask-become-pass  # first run, password auth
+  $(basename "$0") adama --ask-pass  # first SSH login before ssh-copy-id
   $(basename "$0") ai-server-4080   # provision the control node
   $(basename "$0")                  # provision all hosts
 EOF