fix(ssh-ca): install sudo before the Claude sudo rules

The edge-host base install has no sudo, so /etc/sudoers.d is missing and the sudoers template fails. DSM keeps its own sudo and is skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(edge-host): add edge-2 as second edge host
2026-11-06 11:17:15 +01:00 · 2026-11-06 10:59:25 +01:00 · 2026-11-06 09:00:02 +00:00
7 changed files with 19 additions and 2 deletions
@@ -22,6 +22,7 @@ proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root
 # sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
+edge-2.iot.renner.uno ansible_user=root

 # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
 [synology_nas]
@@ -73,6 +74,7 @@ proxy-1.renner.uno
 proxy-2.renner.uno
 netbird.renner.uno
 edge-1.iot.renner.uno
+edge-2.iot.renner.uno
 nas-1.renner.uno
 nas-2.renner.uno

@@ -83,6 +83,9 @@
      edge-1.iot.renner.uno:
        priority: 70
        state: "BACKUP"
+      edge-2.iot.renner.uno:
+        priority: 60
+        state: "BACKUP"

  roles:
    - role: chrony-ntp-server
@@ -16,7 +16,7 @@ edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
 # kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
 # its password to edge-mqtt-cred and rotates it when the bridge reports
 # "not connected"; there is no copy in ansible-vault.
-edge_mqtt_bridge_account: edge-1
+edge_mqtt_bridge_account: "{{ inventory_hostname_short }}"
 # HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
 # certificate from the MQTT CA with this CN is accepted.
 edge_mqtt_cred_port: 8443
@@ -7,7 +7,7 @@ connection {{ edge_mqtt_bridge_account }}
 address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
 bridge_cafile {{ edge_mqtt_bridge_cafile }}
 bridge_insecure false
-remote_clientid edge1-bridge
+remote_clientid {{ edge_mqtt_bridge_account | replace('-', '') }}-bridge
 cleansession false
 try_private true
 restart_timeout 5 30
@@ -143,6 +143,12 @@
    group: root
    mode: "0644"

+- name: Install sudo
+  ansible.builtin.package:
+    name: sudo
+    state: present
+  when: not ssh_ca_synouser.stat.exists
+
 - name: Install the Claude sudo rules
  ansible.builtin.template:
    src: sudoers-claude.j2
@@ -61,6 +61,11 @@
  # No sml2mqtt/#: the SML meter reader is retired for good (owner,
  # 2026-09-19; grid data comes from the E380 on the CAN bus).
  acl: ["readwrite open3e/#"]
+# edge-2's local mosquitto bridge, same role and pinning as edge-1.
+- name: edge-2
+  auth: password
+  deliver: {esp32: "https://edge-2.iot.renner.uno:8443"}
+  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
 # shelly-manager device id. ACL as the former shared user `shellies`
@@ -516,6 +516,7 @@ spec:
              - matchPattern: "*"
    - toFQDNs:
        - matchName: "edge-1.iot.renner.uno"
+        - matchName: "edge-2.iot.renner.uno"
      toPorts:
        - ports:
            - port: "8443"