paperclip: bootstrap scripts for the container #61

New issue

Open

opened 2026-10-25 12:06:20 +00:00 by lab · 0 comments

lab commented

2026-10-25 12:06:20 +00:00

Owner

Context

Mirror the lxc/opencode/ provisioning pattern: a workstation-side script that
pushes secrets over SSH stdin, and a remote script that does the work.

Steps

lxc/paperclip/bootstrap-paperclip-lxc.sh
- require TS_AUTHKEY, GIT_TOKEN, OPENCODE_SERVER_USERNAME,
  OPENCODE_SERVER_PASSWORD (same names as the opencode script)
- push ~/.local/share/opencode/auth.json and the two kubeconfigs
- pipe the remote script over stdin with printf %q quoting
lxc/paperclip/remote-provision.sh
- curl + git from apt
- Tailscale: hostname paperclip-lxc, --accept-dns=false
- user paperclip, home /srv/paperclip
- Node 24 from NodeSource (deb.nodesource.com/setup_24.x)
- opencode pinned to 1.18.25 via the native installer, moved to
  /opt/opencode, symlinked into /usr/local/bin
- npx paperclipai install as user paperclip, so the managed store at
  /srv/paperclip/.paperclip/cli is used
- clone lab/homelab into /srv/paperclip/work/homelab
- idempotent: safe to re-run

Done when

ssh root@192.168.0.54 'su - paperclip -c "node --version && opencode --version && paperclipai --version"'
reports Node >= 24.11, opencode 1.18.25, and a Paperclip version
tailscale ip -4 returns an address

## Context Mirror the `lxc/opencode/` provisioning pattern: a workstation-side script that pushes secrets over SSH stdin, and a remote script that does the work. ## Steps 1. `lxc/paperclip/bootstrap-paperclip-lxc.sh` - require `TS_AUTHKEY`, `GIT_TOKEN`, `OPENCODE_SERVER_USERNAME`, `OPENCODE_SERVER_PASSWORD` (same names as the opencode script) - push `~/.local/share/opencode/auth.json` and the two kubeconfigs - pipe the remote script over stdin with `printf %q` quoting 2. `lxc/paperclip/remote-provision.sh` - `curl` + `git` from apt - Tailscale: hostname `paperclip-lxc`, `--accept-dns=false` - user `paperclip`, home `/srv/paperclip` - Node 24 from NodeSource (`deb.nodesource.com/setup_24.x`) - `opencode` pinned to `1.18.25` via the native installer, moved to `/opt/opencode`, symlinked into `/usr/local/bin` - `npx paperclipai install` as user `paperclip`, so the managed store at `/srv/paperclip/.paperclip/cli` is used - clone `lab/homelab` into `/srv/paperclip/work/homelab` - idempotent: safe to re-run ## Done when - `ssh root@192.168.0.54 'su - paperclip -c "node --version && opencode --version && paperclipai --version"'` reports Node >= 24.11, opencode 1.18.25, and a Paperclip version - `tailscale ip -4` returns an address