setup-cloud-agent-machine.sh

#!/usr/bin/env bash
set -euo pipefail

TARGET_DIR="${HOME}"
PASS_PREFIX="agents/cline-pass"
TAILSCALE_HOSTNAME="${HOSTNAME:-agentdev}"
INSTALL_SYSTEM=true
INSTALL_TAILSCALE=true
TAILSCALE_UP=false
LINGER_USER=""
CONFIGURE_GIT=true
GIT_USER_NAME="Matt Lee"
GIT_USER_EMAIL="mr-lee@users.noreply.github.com"
CONFIGURE_GPG_AGENT=true
GPG_CACHE_TTL=604800
INSTALL_AGENTS=true
CONFIGURE_CLINE_PASS=true
INSTALL_TMUX_AGENT=true
INSTALL_CLOUD_HELPERS=true
ENABLE_FIREWALL=false
TAILSCALE_ONLY_SSH=false
HARDEN_SSH=false
DRY_RUN=false

usage() {
  cat <<'EOF'
usage: setup-cloud-agent-machine.sh [options]

Credential-free bootstrap for an agentic cloud dev machine.

Defaults:
  - install Ubuntu/Debian base packages when apt/sudo are available
  - install GitHub CLI and configure baseline Git identity/remotes
  - install Tailscale and Mosh, but do not run tailscale up unless requested
  - configure gpg-agent so pass unlocks cache for one week
  - install Codex, Claude Code, Cline, Cursor Agent, Antigravity CLI, Pi, Hermes, and opencode
  - configure Cline Pass adapters for Pi, Hermes, and opencode
  - install tmux-agent wrappers for stable phone/laptop sessions
  - install cloud-agent-doctor, cloud-agent-update, and agent-workspace helpers
  - do not enable firewall or rewrite sshd settings unless explicitly requested

Options:
  --target DIR                 Install user files into DIR instead of $HOME
  --pass-prefix PREFIX         pass(1) prefix for Linux secrets (default: agents/cline-pass)
  --tailscale-hostname NAME    Hostname for optional tailscale up
  --tailscale-up               Run sudo tailscale up after installing Tailscale
  --linger-user USER           Enable systemd user lingering for persistent agent/GPG sessions
  --git-user-name NAME         Git user.name (default: Matt Lee)
  --git-user-email EMAIL       Git user.email (default: mr-lee@users.noreply.github.com)
  --gpg-cache-ttl SECONDS      pass/GPG private-key cache TTL (default: 604800, one week)
  --enable-firewall            Enable UFW: deny incoming, allow outgoing, allow public SSH and Tailscale SSH/Mosh
  --tailscale-only-ssh         Enable UFW with SSH/Mosh allowed only on tailscale0
  --harden-ssh                 Disable password/kbd-interactive/root SSH in sshd_config.d
  --no-system                  Skip apt/system package installation
  --no-git-config              Skip baseline Git configuration
  --no-gpg-agent-config        Skip gpg-agent pass cache configuration
  --no-tailscale               Skip Tailscale installation
  --no-agents                  Skip agent CLI installation
  --no-cline-pass              Skip Cline Pass adapter configuration
  --no-tmux-agent              Skip tmux-agent wrapper installation
  --no-cloud-helpers           Skip cloud-agent-doctor/update/workspace helpers
  --dry-run                    Print commands without changing the machine
  -h, --help                   Show this help

Post-run auth/credential steps are printed at the end. No API keys, OAuth tokens,
Tailscale auth keys, or model credentials are written by this script.
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --target)
      TARGET_DIR="$2"
      shift 2
      ;;
    --pass-prefix)
      PASS_PREFIX="$2"
      shift 2
      ;;
    --tailscale-hostname)
      TAILSCALE_HOSTNAME="$2"
      shift 2
      ;;
    --tailscale-up)
      TAILSCALE_UP=true
      shift
      ;;
    --linger-user)
      LINGER_USER="$2"
      shift 2
      ;;
    --git-user-name)
      GIT_USER_NAME="$2"
      shift 2
      ;;
    --git-user-email)
      GIT_USER_EMAIL="$2"
      shift 2
      ;;
    --gpg-cache-ttl)
      GPG_CACHE_TTL="$2"
      shift 2
      ;;
    --enable-firewall)
      ENABLE_FIREWALL=true
      shift
      ;;
    --tailscale-only-ssh)
      ENABLE_FIREWALL=true
      TAILSCALE_ONLY_SSH=true
      shift
      ;;
    --harden-ssh)
      HARDEN_SSH=true
      shift
      ;;
    --no-system)
      INSTALL_SYSTEM=false
      shift
      ;;
    --no-git-config)
      CONFIGURE_GIT=false
      shift
      ;;
    --no-gpg-agent-config)
      CONFIGURE_GPG_AGENT=false
      shift
      ;;
    --no-tailscale)
      INSTALL_TAILSCALE=false
      shift
      ;;
    --no-agents)
      INSTALL_AGENTS=false
      shift
      ;;
    --no-cline-pass)
      CONFIGURE_CLINE_PASS=false
      shift
      ;;
    --no-tmux-agent)
      INSTALL_TMUX_AGENT=false
      shift
      ;;
    --no-cloud-helpers)
      INSTALL_CLOUD_HELPERS=false
      shift
      ;;
    --dry-run)
      DRY_RUN=true
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "ERROR: unknown option: $1" >&2
      usage >&2
      exit 2
      ;;
  esac
done

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
LOCAL_BIN="${TARGET_DIR}/.local/bin"
SUDO=()
if [[ "${EUID}" -ne 0 ]]; then
  SUDO=(sudo)
fi

run() {
  printf '+'
  printf ' %q' "$@"
  printf '\n'
  if [[ "$DRY_RUN" != true ]]; then
    "$@"
  fi
}

run_shell() {
  printf '+ bash -lc %q\n' "$*"
  if [[ "$DRY_RUN" != true ]]; then
    bash -lc "$*"
  fi
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1
}

has_apt() {
  need_cmd apt-get
}

node_major() {
  if need_cmd node; then
    node --version | sed -E 's/^v([0-9]+).*/\1/'
  else
    echo 0
  fi
}

ensure_path_block() {
  local file="$1"
  local begin="# >>> cloud-agent-machine path"
  local end="# <<< cloud-agent-machine path"
  local line='export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.npm-global/bin:$HOME/.grok/bin:$PATH"'

  if [[ "$DRY_RUN" == true ]]; then
    echo "  ensure PATH block in ${file}"
    return
  fi

  touch "$file"
  if grep -qxF "$begin" "$file"; then
    return
  fi
  {
    printf '\n%s\n' "$begin"
    printf '%s\n' "$line"
    printf '%s\n' "$end"
  } >> "$file"
}

ensure_gpg_tty_block() {
  local file="$1"
  local begin="# >>> cloud-agent-machine gpg tty"
  local end="# <<< cloud-agent-machine gpg tty"

  if [[ "$DRY_RUN" == true ]]; then
    echo "  ensure GPG_TTY block in ${file}"
    return
  fi

  touch "$file"
  if grep -qxF "$begin" "$file"; then
    return
  fi
  {
    printf '\n%s\n' "$begin"
    printf '%s\n' 'if command -v gpg-connect-agent >/dev/null 2>&1 && [ -t 0 ]; then'
    printf '%s\n' '  export GPG_TTY="$(tty)"'
    printf '%s\n' '  gpg-connect-agent updatestartuptty /bye >/dev/null 2>&1 || true'
    printf '%s\n' 'fi'
    printf '%s\n' "$end"
  } >> "$file"
}

configure_gpg_agent() {
  local gnupg_dir="${TARGET_DIR}/.gnupg"
  local config="${gnupg_dir}/gpg-agent.conf"
  local begin="# >>> cloud-agent-machine pass cache"
  local end="# <<< cloud-agent-machine pass cache"

  if [[ ! "$GPG_CACHE_TTL" =~ ^[0-9]+$ ]]; then
    echo "ERROR: --gpg-cache-ttl must be an integer number of seconds" >&2
    exit 2
  fi

  if [[ "$DRY_RUN" == true ]]; then
    echo "  ensure gpg-agent pass cache ttl ${GPG_CACHE_TTL}s in ${config}"
    return
  fi

  mkdir -p "$gnupg_dir"
  chmod 700 "$gnupg_dir"
  touch "$config"
  chmod 600 "$config"

  local tmp
  tmp="$(mktemp "${config}.XXXXXX")"
  {
    printf '%s\n' "$begin"
    printf 'default-cache-ttl %s\n' "$GPG_CACHE_TTL"
    printf 'max-cache-ttl %s\n' "$GPG_CACHE_TTL"
    printf '%s\n' "$end"
    printf '\n'
    awk -v begin="$begin" -v end="$end" '
      $0 == begin { skip = 1; next }
      $0 == end { skip = 0; next }
      skip { next }
      $1 == "default-cache-ttl" { next }
      $1 == "max-cache-ttl" { next }
      { print }
    ' "$config"
  } > "$tmp"
  chmod 600 "$tmp"
  mv "$tmp" "$config"

  if need_cmd gpgconf; then
    run gpgconf --reload gpg-agent
  fi
}

install_system_packages() {
  if ! has_apt; then
    echo "  skip system packages: apt-get not found"
    return
  fi

  run "${SUDO[@]}" apt-get update
  run "${SUDO[@]}" apt-get install -y \
    build-essential ca-certificates curl dbus-x11 fail2ban git gnupg jq \
    libsecret-1-0 libsecret-tools mosh pass pipx python3 python3-yaml ripgrep \
    tmux ufw unzip xz-utils

  install_github_cli

  if ! need_cmd fd && need_cmd fdfind && [[ ! -e "${LOCAL_BIN}/fd" ]]; then
    run mkdir -p "$LOCAL_BIN"
    run ln -s "$(command -v fdfind)" "${LOCAL_BIN}/fd"
  fi

  if [[ "$(node_major)" -lt 22 ]]; then
    run_shell 'curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/nodesource.gpg'
    run_shell 'echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list >/dev/null'
    run "${SUDO[@]}" apt-get update
    run "${SUDO[@]}" apt-get install -y nodejs
  fi
}

install_github_cli() {
  if need_cmd gh; then
    echo "  ok  gh already installed"
    return
  fi
  if ! has_apt; then
    echo "  skip gh: apt-get not found"
    return
  fi

  if run "${SUDO[@]}" apt-get install -y gh; then
    return
  fi

  echo "  gh package not available from current apt sources; adding GitHub CLI apt repository"
  run "${SUDO[@]}" mkdir -p -m 755 /etc/apt/keyrings
  run_shell 'curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null'
  run "${SUDO[@]}" chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
  run_shell 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null'
  run "${SUDO[@]}" apt-get update
  run "${SUDO[@]}" apt-get install -y gh
}

install_tailscale() {
  if need_cmd tailscale; then
    echo "  ok  tailscale already installed"
  else
    run_shell 'curl -fsSL https://tailscale.com/install.sh | sh'
  fi

  if [[ "$TAILSCALE_UP" == true ]]; then
    run "${SUDO[@]}" tailscale up --hostname "$TAILSCALE_HOSTNAME"
  fi
}

enable_user_linger() {
  if [[ -z "$LINGER_USER" ]]; then
    return
  fi
  if ! need_cmd loginctl; then
    echo "  skip linger: loginctl not found"
    return
  fi

  run "${SUDO[@]}" loginctl enable-linger "$LINGER_USER"
}

configure_git() {
  if ! need_cmd git; then
    echo "  skip git config: git not found"
    return
  fi

  run git config --global user.name "$GIT_USER_NAME"
  run git config --global user.email "$GIT_USER_EMAIL"
  run git config --global init.defaultBranch main
  run git config --global url.git@github.com:.insteadOf https://github.com/
  ensure_github_ssh_config
}

ensure_github_ssh_config() {
  local ssh_dir="${TARGET_DIR}/.ssh"
  local config="${ssh_dir}/config"
  local begin="# >>> cloud-agent-machine github ssh"
  local end="# <<< cloud-agent-machine github ssh"

  if [[ "$DRY_RUN" == true ]]; then
    echo "  ensure GitHub SSH config in ${config}"
    return
  fi

  mkdir -p "$ssh_dir"
  chmod 700 "$ssh_dir"
  touch "$config"
  chmod 600 "$config"
  if grep -qxF "$begin" "$config"; then
    return
  fi

  local tmp
  tmp="$(mktemp "${ssh_dir}/.config.github.XXXXXX")"
  {
    printf '%s\n' "$begin"
    printf '%s\n' 'Host github.com'
    printf '%s\n' '  HostName github.com'
    printf '%s\n' '  User git'
    printf '%s\n' '  IdentityFile ~/.ssh/id_ed25519_github'
    printf '%s\n' '  IdentitiesOnly yes'
    printf '%s\n' "$end"
    printf '\n'
    cat "$config"
  } > "$tmp"
  chmod 600 "$tmp"
  mv "$tmp" "$config"
}

install_agents() {
  run mkdir -p "$LOCAL_BIN"
  export PATH="${LOCAL_BIN}:${TARGET_DIR}/.opencode/bin:${TARGET_DIR}/.npm-global/bin:${TARGET_DIR}/.grok/bin:${PATH}"

  ensure_path_block "${TARGET_DIR}/.profile"
  ensure_gpg_tty_block "${TARGET_DIR}/.profile"
  if [[ -e "${TARGET_DIR}/.bashrc" || ! -e "${TARGET_DIR}/.zshrc" ]]; then
    ensure_path_block "${TARGET_DIR}/.bashrc"
    ensure_gpg_tty_block "${TARGET_DIR}/.bashrc"
  fi

  if need_cmd npm; then
    run npm config set prefix "$TARGET_DIR/.local"
    run npm install -g @openai/codex @anthropic-ai/claude-code cline opencode-ai
    run npm install -g @earendil-works/pi-coding-agent --ignore-scripts
  else
    echo "  WARN  npm missing; skipping Codex/Claude/Cline/Pi/opencode installs" >&2
  fi

  if ! need_cmd cursor-agent; then
    run_shell 'curl -fsSL https://cursor.com/install -o /tmp/cursor-agent-install.sh && bash /tmp/cursor-agent-install.sh'
  else
    echo "  ok  cursor-agent already installed"
  fi

  if ! need_cmd uv; then
    run_shell 'curl -LsSf https://astral.sh/uv/install.sh | sh'
    export PATH="${LOCAL_BIN}:${HOME}/.cargo/bin:${PATH}"
  fi

  if need_cmd uv && need_cmd pipx; then
    run uv python install 3.11
    local python311
    if [[ "$DRY_RUN" == true ]]; then
      python311="<uv-python-3.11>"
    else
      python311="$(uv python find 3.11)"
    fi
    if [[ "$DRY_RUN" == true ]]; then
      run pipx install --python "$python311" hermes-agent
    elif pipx list 2>/dev/null | grep -q 'package hermes-agent'; then
      run pipx upgrade hermes-agent
    else
      run pipx install --python "$python311" hermes-agent
    fi
  else
    echo "  WARN  uv or pipx missing; skipping Hermes install" >&2
  fi

  if ! need_cmd agy; then
    run_shell 'curl -fsSL https://antigravity.google/cli/install.sh | bash -s -- --dir "$HOME/.local/bin"'
  else
    echo "  ok  agy already installed"
  fi
}

configure_cline_pass() {
  local setup="${SCRIPT_DIR}/setup-cline-pass-agents.sh"
  if [[ ! -x "$setup" ]]; then
    echo "  WARN  setup-cline-pass-agents.sh not found or not executable; skipping" >&2
    return
  fi

  run "$setup" --target "$TARGET_DIR" --pass-prefix "$PASS_PREFIX"
}

install_tmux_agent() {
  local source="${SCRIPT_DIR}/tmux-agent"
  if [[ ! -f "$source" ]]; then
    echo "  WARN  tmux-agent not found next to setup script; skipping" >&2
    return
  fi

  run mkdir -p "$LOCAL_BIN"
  run install -m 755 "$source" "${LOCAL_BIN}/tmux-agent"
  local name
  for name in pilot codex-tmux claude-tmux cline-tmux cursor-tmux agy-tmux antigravity-tmux pi-tmux hermes-tmux opencode-tmux; do
    run ln -sfn tmux-agent "${LOCAL_BIN}/${name}"
  done
}

install_cloud_helpers() {
  run mkdir -p "$LOCAL_BIN"

  local helper
  for helper in cloud-agent-doctor cloud-agent-update agent-workspace; do
    local source="${SCRIPT_DIR}/${helper}"
    if [[ -f "$source" ]]; then
      run install -m 755 "$source" "${LOCAL_BIN}/${helper}"
    else
      echo "  WARN  ${helper} not found next to setup script; skipping" >&2
    fi
  done
}

enable_firewall() {
  if ! need_cmd ufw; then
    echo "  skip firewall: ufw not found"
    return
  fi

  run "${SUDO[@]}" ufw default deny incoming
  run "${SUDO[@]}" ufw default allow outgoing
  if [[ "$TAILSCALE_ONLY_SSH" != true ]]; then
    run "${SUDO[@]}" ufw allow 22/tcp comment "SSH key auth"
  fi
  run "${SUDO[@]}" ufw allow in on tailscale0 to any port 22 proto tcp comment "SSH over Tailscale"
  run "${SUDO[@]}" ufw allow in on tailscale0 to any port 60000:61000 proto udp comment "Mosh over Tailscale"
  run "${SUDO[@]}" ufw --force enable
}

harden_ssh() {
  local conf="/etc/ssh/sshd_config.d/99-cloud-agent-hardening.conf"
  local body='PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
X11Forwarding no
'

  if [[ "$DRY_RUN" == true ]]; then
    echo "  write ${conf}"
    echo "  restart ssh"
    return
  fi

  printf '%s' "$body" | "${SUDO[@]}" tee "$conf" >/dev/null
  "${SUDO[@]}" sshd -t
  "${SUDO[@]}" systemctl restart ssh
}

print_summary() {
  cat <<EOF

Done.

Credential setup is intentionally separate.

Linux pass setup:
  gpg --full-generate-key
  gpg --list-secret-keys --keyid-format LONG
  pass init <gpg-key-id-or-fingerprint>
  pass insert ${PASS_PREFIX}/pi
  pass insert ${PASS_PREFIX}/hermes
  pass insert ${PASS_PREFIX}/opencode

Interactive auth:
  codex login
  claude auth login
  cline auth cline
  cursor-agent login
  agy

GitHub auth:
  ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_github -C "\$(hostname)-github" -N ""
  gh auth login --hostname github.com --git-protocol ssh --web
  gh ssh-key add ~/.ssh/id_ed25519_github.pub --title "\$(hostname)-agent"
  gh auth setup-git --hostname github.com

pass/GPG cache:
  gpg-agent pass cache TTL: ${GPG_CACHE_TTL}s

Tailscale:
  sudo tailscale up --hostname ${TAILSCALE_HOSTNAME}

Recommended verification:
  codex login status
  claude auth status --text
  gh auth status
  ssh -T git@github.com
  cline version
  cursor-agent status
  agy --version
  pi --version
  hermes --version
  opencode --version
  tmux-agent --help
  cloud-agent-doctor
  agent-workspace init

Stable tmux launchers:
  pilot
  codex-tmux
  claude-tmux
  cline-tmux
  cursor-tmux
  agy-tmux
  pi-tmux
  hermes-tmux
  opencode-tmux

Workspace conventions:
  agent-workspace init
  agent-workspace clone <owner/repo>
  agent-workspace open <repo> pilot

Firewall/SSH hardening is opt-in:
  ./setup-cloud-agent-machine.sh --enable-firewall
  ./setup-cloud-agent-machine.sh --tailscale-only-ssh
  ./setup-cloud-agent-machine.sh --harden-ssh
EOF
}

echo "Cloud agent machine setup -> ${TARGET_DIR}"
if [[ "$DRY_RUN" == true ]]; then
  echo "(dry run - no changes will be made)"
fi
echo

if [[ "$INSTALL_SYSTEM" == true ]]; then
  echo "System packages"
  install_system_packages
fi

if [[ "$INSTALL_TAILSCALE" == true ]]; then
  echo
  echo "Tailscale"
  install_tailscale
fi

if [[ "$CONFIGURE_GIT" == true ]]; then
  echo
  echo "Git"
  configure_git
fi

if [[ "$CONFIGURE_GPG_AGENT" == true ]]; then
  echo
  echo "GPG agent"
  configure_gpg_agent
fi

if [[ -n "$LINGER_USER" ]]; then
  echo
  echo "User linger"
  enable_user_linger
fi

if [[ "$INSTALL_AGENTS" == true ]]; then
  echo
  echo "Agent CLIs"
  install_agents
fi

if [[ "$CONFIGURE_CLINE_PASS" == true ]]; then
  echo
  echo "Cline Pass adapters"
  configure_cline_pass
fi

if [[ "$INSTALL_TMUX_AGENT" == true ]]; then
  echo
  echo "tmux-agent"
  install_tmux_agent
fi

if [[ "$INSTALL_CLOUD_HELPERS" == true ]]; then
  echo
  echo "Cloud helpers"
  install_cloud_helpers
fi

if [[ "$ENABLE_FIREWALL" == true ]]; then
  echo
  echo "Firewall"
  enable_firewall
fi

if [[ "$HARDEN_SSH" == true ]]; then
  echo
  echo "SSH hardening"
  harden_ssh
fi

print_summary