Add hashed valherun password to bootstrap

README.md

@@ -57,7 +57,7 @@ The starter Kickstart includes a `%post` phase that can call your current repos:
 
 The wrapper script is [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh). It clones those repos onto the installed Alma host and then runs the reusable pieces directly:
 
-- a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys/sudo setup
+- a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys/sudo setup and sets a committed salted password hash
 - `kickstart/bash_profiles.sh --adduser`
 - `tools/bin/install_codex_access.sh` with the preferred `codex` public key explicitly passed in
 - `tools/bin/update_sshd_config.sh`

docs/replication.md

@@ -254,14 +254,14 @@ That script:
 2. downloads `/bootstrap/kickstart.tar.gz` from `server1` when available, otherwise clones your `kickstart` repo to `/usr/local/valherun/kickstart`
 3. downloads `/bootstrap/tools.tar.gz` from `server1` when available, otherwise clones your `tools` repo to `/usr/local/valherun/tools`
 4. optionally runs:
-   - a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys and sudo policy
+   - a local non-interactive `valherun` account bootstrap that mirrors your current SSH keys, sudo policy, and a committed salted password hash
    - `kickstart/bash_profiles.sh --adduser`
    - `tools/bin/install_codex_access.sh --pubkey "$CODEX_PUBKEY" --no-reload`
    - `tools/bin/update_sshd_config.sh --no-reload`
 
 This gives you a second-stage bootstrap after the base OS install is complete.
 
-The `valherun` step is handled locally in this repo instead of calling `kickstart/bin/create_valherun.sh` because that upstream helper runs `passwd valherun`, which blocks unattended Kickstart `%post`. The SSH helpers are run with `--no-reload` so the install does not depend on reloading `sshd` inside the installer chroot.
+The `valherun` step is handled locally in this repo instead of calling `kickstart/bin/create_valherun.sh` because that upstream helper runs `passwd valherun`, which blocks unattended Kickstart `%post`. The local helper sets `valherun` with a salted SHA-512 password hash and the expected SSH keys. The SSH helpers are run with `--no-reload` so the install does not depend on reloading `sshd` inside the installer chroot.
 
 The PXE bootstrap also pins the preferred `codex` public key directly in [`scripts/post-install-bootstrap.sh`](/usr/local/valherun/pxe_boot_alma/scripts/post-install-bootstrap.sh) so unattended installs do not inherit the fallback key embedded in the shared `tools` helper.
 

scripts/post-install-bootstrap.sh

@@ -9,6 +9,7 @@ KICKSTART_ARCHIVE_URL="${KICKSTART_ARCHIVE_URL:-http://192.168.50.1/bootstrap/ki
 TOOLS_ARCHIVE_URL="${TOOLS_ARCHIVE_URL:-http://192.168.50.1/bootstrap/tools.tar.gz}"
 PROXY_URL="${PROXY_URL:-http://192.168.50.1:3128}"
 CODEX_PUBKEY="${CODEX_PUBKEY:-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMqVsgYh2b0a13uiEV2AEhuwAEmih11TiJRPPQN4nln codex}"
+VALHERUN_PASSWORD_HASH="${VALHERUN_PASSWORD_HASH:-$6$anR29lW6xTJ9$QazuABtsZZBU5CgjurY8nwFdy6MtodW3RdRClug9tGlhjytaMWfvKTvwbm26J6edQENEyUNgoYBTAu/MJwiDl0}"
 INSTALL_VALHERUN="${INSTALL_VALHERUN:-true}"
 INSTALL_CODEX="${INSTALL_CODEX:-true}"
 UPDATE_SSHD="${UPDATE_SSHD:-true}"
@@ -33,8 +34,7 @@ create_valherun_noninteractive() {
         return
     fi
 
-    useradd -m -s /bin/bash -G users valherun
+    useradd -m -s /bin/bash -G users -p "$VALHERUN_PASSWORD_HASH" valherun
-    passwd -l valherun >/dev/null
 
     install -d -m 700 -o valherun -g valherun /home/valherun/.ssh
     cat > /home/valherun/.ssh/authorized_keys <<'EOF'