fix(edge-host-iso): include sudo in the base system

The ssh-ca role installs the claude-bot sudo rules into /etc/sudoers.d,
which a base system without sudo does not have.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/docs/edge-host.md

@@ -164,9 +164,7 @@ role keeps logs off local flash and monitors wear:
 - **Docker logs to journald** (`docker-daemon.json`, `log-driver: journald`)
   instead of unbounded json files under `/var/lib/docker/containers`. Both
   compose services inherit it; `docker logs` still works.
-- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`, which
-  runs the upstream `grafana/alloy` image with `/run/log/journal` mounted
-  read-only; Arch's `grafana-alloy` package has no `loki.source.journal`). Its
+- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`). Its
   WAL/positions sit on `/run/alloy` (tmpfs), so the agent writes nothing to
   the eMMC either. Net effect: no log writes hit local flash — the trade-off
   is that logs are RAM-only and lost on reboot unless already shipped.

ansible/inventory/pve_hosts.yml

@@ -22,7 +22,6 @@ proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root
 # sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
-edge-2.iot.renner.uno ansible_user=root
 
 # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
 [synology_nas]
@@ -74,7 +73,6 @@ proxy-1.renner.uno
 proxy-2.renner.uno
 netbird.renner.uno
 edge-1.iot.renner.uno
-edge-2.iot.renner.uno
 nas-1.renner.uno
 nas-2.renner.uno
 

ansible/plays/install-edge-host.yml

@@ -34,7 +34,6 @@
   roles:
     - certificates
     - common
-    - pacman-cache
     - edge-flash-wear
     - docker-install
     - edge-log-shipper

ansible/plays/install-ntp-ha.yml

@@ -83,9 +83,6 @@
       edge-1.iot.renner.uno:
         priority: 70
         state: "BACKUP"
-      edge-2.iot.renner.uno:
-        priority: 60
-        state: "BACKUP"
 
   roles:
     - role: chrony-ntp-server

ansible/roles/edge-log-shipper/defaults/main.yml

@@ -7,9 +7,7 @@
 
 edge_alloy_config_file: /etc/alloy/edge.alloy
 edge_alloy_http_port: 12345
-# Upstream image: Arch's grafana-alloy 1.21 is built without
-# loki.source.journal. Renovate-tracked (customManagers in renovate.json).
-edge_alloy_image: grafana/alloy:v1.21.3@sha256:8ab871206bd2d8f89277f53abffee5f452a293980788d52f85fa183a87a505a4
+edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
 edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
 edge_loki_username: edge-1
 edge_alloy_labels:

ansible/roles/edge-log-shipper/tasks/main.yml

@@ -6,18 +6,15 @@
 # directly, so one journal source covers everything. Alloy s storage/WAL sits
 # on /run (tmpfs) so it does not write to flash either.
 
-# Alloy runs from the upstream image (see edge-alloy.service); the Arch package
-# lacks journal support.
-- name: Remove the grafana-alloy package
+- name: Install grafana-alloy
   ansible.builtin.package:
     name: grafana-alloy
-    state: absent
+    state: present
 
 - name: Create alloy system group
   ansible.builtin.group:
     name: alloy
     system: true
-  register: edge_alloy_group
 
 - name: Create alloy system user
   ansible.builtin.user:
@@ -27,25 +24,6 @@
     system: true
     create_home: false
     shell: /usr/bin/nologin
-  register: edge_alloy_user
-
-- name: Look up the systemd-journal group
-  ansible.builtin.getent:
-    database: group
-    key: systemd-journal
-
-- name: Set the container identity
-  ansible.builtin.set_fact:
-    edge_alloy_uid: "{{ edge_alloy_user.uid }}"
-    edge_alloy_gid: "{{ edge_alloy_group.gid }}"
-    edge_alloy_journal_gid: "{{ ansible_facts.getent_group['systemd-journal'][1] }}"
-
-- name: Pull the alloy image
-  ansible.builtin.command:
-    argv: [docker, pull, "{{ edge_alloy_image }}"]
-  register: edge_alloy_pull
-  changed_when: "'Downloaded newer image' in edge_alloy_pull.stdout"
-  notify: Restart alloy
 
 - name: Create alloy config directory
   ansible.builtin.file:

ansible/roles/edge-log-shipper/templates/edge-alloy.service.j2

@@ -1,35 +1,32 @@
 [Unit]
-Description=Grafana Alloy (journal -> Loki)
+Description=Grafana Alloy (edge-1 log shipper -> Loki)
 Documentation=https://grafana.com/docs/alloy/
-After=docker.service network-online.target
-Requires=docker.service
+After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-# WAL + positions on tmpfs so the agent never writes to the eMMC.
-ExecStartPre=/usr/bin/install -d -o alloy -g alloy -m 0750 /run/alloy
-ExecStartPre=-/usr/bin/docker rm -f edge-alloy
-# Attached run with --log-driver none: the container's output reaches the
-# journal once, through this unit.
-ExecStart=/usr/bin/docker run --rm --name edge-alloy \
-  --log-driver none \
-  --network host \
-  --user {{ edge_alloy_uid }}:{{ edge_alloy_gid }} \
-  --group-add {{ edge_alloy_journal_gid }} \
-  --read-only --tmpfs /tmp \
-  --cap-drop ALL --security-opt no-new-privileges \
-  -v /run/log/journal:/run/log/journal:ro \
-  -v /etc/machine-id:/etc/machine-id:ro \
-  -v {{ edge_alloy_config_file }}:/etc/alloy/config.alloy:ro \
-  -v /run/alloy:/var/lib/alloy \
-  {{ edge_alloy_image }} run \
+User=alloy
+Group=alloy
+# Read the (volatile) systemd journal.
+SupplementaryGroups=systemd-journal
+# WAL + positions on tmpfs so the agent never writes to the eMMC. %t is the
+# runtime dir root (/run); RuntimeDirectory creates /run/alloy owned by us.
+RuntimeDirectory=alloy
+ExecStart={{ edge_alloy_bin }} run \
   --server.http.listen-addr=127.0.0.1:{{ edge_alloy_http_port }} \
-  --storage.path=/var/lib/alloy \
-  /etc/alloy/config.alloy
-ExecStop=/usr/bin/docker stop edge-alloy
-Restart=always
+  --storage.path=%t/alloy \
+  {{ edge_alloy_config_file }}
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
 RestartSec=10s
+LimitNOFILE=65536
+
+# Hardening (bare metal, no LXC namespace limits here).
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target

ansible/roles/mqtt-bridge/defaults/main.yml

@@ -16,7 +16,7 @@ edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
 # kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
 # its password to edge-mqtt-cred and rotates it when the bridge reports
 # "not connected"; there is no copy in ansible-vault.
-edge_mqtt_bridge_account: "{{ inventory_hostname_short }}"
+edge_mqtt_bridge_account: edge-1
 # HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
 # certificate from the MQTT CA with this CN is accepted.
 edge_mqtt_cred_port: 8443

ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2

@@ -7,7 +7,7 @@ connection {{ edge_mqtt_bridge_account }}
 address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
 bridge_cafile {{ edge_mqtt_bridge_cafile }}
 bridge_insecure false
-remote_clientid {{ edge_mqtt_bridge_account | replace('-', '') }}-bridge
+remote_clientid edge1-bridge
 cleansession false
 try_private true
 restart_timeout 5 30

ansible/roles/pacman-cache/files/pacman-cache.hook

@@ -1,14 +0,0 @@
-# Managed by ansible (roles/pacman-cache).
-# Downloaded packages are not kept; older versions come from the Arch Linux
-# Archive.
-[Trigger]
-Operation = Install
-Operation = Upgrade
-Operation = Remove
-Type = Package
-Target = *
-
-[Action]
-Description = Removing downloaded packages from the cache...
-When = PostTransaction
-Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete

ansible/roles/pacman-cache/tasks/main.yml

@@ -1,21 +0,0 @@
----
-# Keep the pacman package cache empty. pacman keeps every downloaded package;
-# on a 7 GB eMMC root the cache grows to gigabytes. Arch hosts only.
-
-- name: Ensure the pacman hook directory exists
-  ansible.builtin.file:
-    path: /etc/pacman.d/hooks
-    state: directory
-    mode: "0755"
-
-- name: Empty the package cache after every transaction
-  ansible.builtin.copy:
-    src: pacman-cache.hook
-    dest: /etc/pacman.d/hooks/pacman-cache.hook
-    mode: "0644"
-
-- name: Empty the package cache
-  ansible.builtin.command:
-    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
-  register: pacman_cache_clean
-  changed_when: pacman_cache_clean.stdout | length > 0

ansible/roles/ssh-ca/tasks/main.yml

@@ -143,12 +143,6 @@
     group: root
     mode: "0644"
 
-- name: Install sudo
-  ansible.builtin.package:
-    name: sudo
-    state: present
-  when: not ssh_ca_synouser.stat.exists
-
 - name: Install the Claude sudo rules
   ansible.builtin.template:
     src: sudoers-claude.j2

kubernetes/apps/home-assistant/mqtt-accounts.yaml

@@ -61,11 +61,6 @@
   # No sml2mqtt/#: the SML meter reader is retired for good (owner,
   # 2026-09-19; grid data comes from the E380 on the CAN bus).
   acl: ["readwrite open3e/#"]
-# edge-2's local mosquitto bridge, same role and pinning as edge-1.
-- name: edge-2
-  auth: password
-  deliver: {esp32: "https://edge-2.iot.renner.uno:8443"}
-  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
 # shelly-manager device id. ACL as the former shared user `shellies`

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -516,7 +516,6 @@ spec:
               - matchPattern: "*"
     - toFQDNs:
         - matchName: "edge-1.iot.renner.uno"
-        - matchName: "edge-2.iot.renner.uno"
       toPorts:
         - ports:
             - port: "8443"