Adding a Second Host

First host: see First Deployment. A second host reuses the fleet-wide config; you scope what differs.

Step 1: Add the host

auberge host add agent-box 203.0.113.20 --user root
auberge ssh keygen --host agent-box

The name is permanent identity: bootstrap sets it as the machine’s hostname, and its SSH keys live under ~/.ssh/identities/agent-box/. No name recycling — a rebuilt or repurposed box gets a fresh name.

Step 2: Scope the config

Every top-level config.toml key applies to every host. In particular, infrastructure.yml deploys headscale and blocky wherever their *_subdomain keys answer — withdraw them on hosts that must not serve them (see Host-scoped Config):

[hosts.agent-box]
headscale_subdomain = ""
blocky_subdomain = ""

Step 3: Bootstrap, harden, infrastructure

auberge ansible bootstrap agent-box --ip 203.0.113.20
auberge ansible run --host agent-box --playbook ansible/playbooks/hardening.yml
auberge ansible run --host agent-box --playbook ansible/playbooks/infrastructure.yml

Step 4: Enroll in the tailnet

Nothing to do by hand. The infrastructure run above already enrolled the host: it asked the target whether its tailscaled was authenticated, minted a 1-hour pre-auth key stamped with the host’s tailnet_tag, and handed it to the tailscale role (ADR-0063). The ACL policy, not the target host, decides what the node may reach.

That works because the host declared its trust tier when you added it:

auberge host add agent-box --ip 203.0.113.20 --tailnet-tag agent

Step 5: Verify

ssh agent-box 'sudo ufw status && sudo fail2ban-client status sshd'
ssh agent-box 'tailscale status'

For a tag-confined node, prove the confinement from the node itself: connections to peers outside its allowed set must time out.

Designed and built by Espadat More tools