From 6bb23e70d69a315748a3ef4fed5e62c12a62f2d2 Mon Sep 17 00:00:00 2001
From: Greg Karekinian <greg@kosmos.org>
Date: Thu, 23 Jul 2026 15:45:46 +0200
Subject: [PATCH 1/2] Split users creation to its own recipe

---
 site-cookbooks/kosmos-base/recipes/default.rb | 20 +---------------
 site-cookbooks/kosmos-base/recipes/users.rb   | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+), 19 deletions(-)
 create mode 100644 site-cookbooks/kosmos-base/recipes/users.rb

diff --git a/site-cookbooks/kosmos-base/recipes/default.rb b/site-cookbooks/kosmos-base/recipes/default.rb
index fb12b80..40bbac8 100644
--- a/site-cookbooks/kosmos-base/recipes/default.rb
+++ b/site-cookbooks/kosmos-base/recipes/default.rb
@@ -60,25 +60,7 @@ package "vim"
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
-  # Searches data bag "users" for groups attribute "sysadmin".
-  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
-    group_id 2300
-    action %i[remove create]
-  end
-
-  sudo "sysadmin" do
-    groups "sysadmin"
-    nopasswd true
-    defaults [
-      # not default on Ubuntu, explicitely enable. Uses a minimal white list of
-      # environment variables
-      "env_reset",
-      # Send emails on unauthorized attempts
-      "mail_badpass",
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
-    ]
-  end
+  include_recipe "kosmos-base::users"
 
   include_recipe "kosmos-base::firewall"
 
diff --git a/site-cookbooks/kosmos-base/recipes/users.rb b/site-cookbooks/kosmos-base/recipes/users.rb
new file mode 100644
index 0000000..5fd768c
--- /dev/null
+++ b/site-cookbooks/kosmos-base/recipes/users.rb
@@ -0,0 +1,24 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: default
+#
+
+# Searches data bag "users" for groups attribute "sysadmin".
+# Places returned users in Unix group "sysadmin" with GID 2300.
+users_manage "sysadmin" do
+  group_id 2300
+  action %i[remove create]
+end
+
+sudo "sysadmin" do
+  groups "sysadmin"
+  nopasswd true
+  defaults [
+    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
+    # environment variables
+    "env_reset",
+    # Send emails on unauthorized attempts
+    "mail_badpass",
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+  ]
+end

From 527603bd63c5b32ac8e57a2ac7b2394c84631260 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Thu, 23 Jul 2026 17:43:36 +0200
Subject: [PATCH 2/2] Add script for mass-converging

E.g. just the new users recipe
---
 scripts/knife/converge_all.sh | 70 +++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100755 scripts/knife/converge_all.sh

diff --git a/scripts/knife/converge_all.sh b/scripts/knife/converge_all.sh
new file mode 100755
index 0000000..4a15c83
--- /dev/null
+++ b/scripts/knife/converge_all.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+#
+# Converge every node in nodes/ with a runlist override (-o).
+#
+# Usage:
+#   ./converge_all.sh "recipe[kosmos-base::users]"
+#
+# Port selection per node:
+#   - nodes WITH a normal.vm_host attribute (KVM guests):  port 22
+#   - nodes WITHOUT a normal.vm_host attribute (bare metal): port 2222
+#
+# Runs sequentially and aborts on the first failure (set -euo pipefail).
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 '<runlist override>'" >&2
+  echo "  e.g. $0 \"recipe[kosmos-base::users]\"" >&2
+  exit 1
+fi
+
+RUNLIST="$1"
+
+shopt -s nullglob
+nodes=( nodes/*.json )
+
+if [[ ${#nodes[@]} -eq 0 ]]; then
+  echo "No nodes found in nodes/" >&2
+  exit 1
+fi
+
+total=${#nodes[@]}
+i=0
+
+for f in "${nodes[@]}"; do
+  i=$((i + 1))
+
+  IFS=$'\x1f' read -r node_name vm_host knife_host < <(python3 -c '
+import json, sys
+d = json.load(open(sys.argv[1]))
+print("\x1f".join([
+    d.get("name", "") or "",
+    d.get("normal", {}).get("vm_host", "") or "",
+    d.get("normal", {}).get("knife_zero", {}).get("host", "") or "",
+]))
+' "$f")
+
+  if [[ -z "$node_name" ]]; then
+    echo "[$i/$total] $f: could not read node name, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -z "$knife_host" ]]; then
+    echo "[$i/$total] $node_name: no knife_zero.host set, skipping" >&2
+    exit 1
+  fi
+
+  if [[ -n "$vm_host" ]]; then
+    port=22
+    label="vm_host=${vm_host}"
+  else
+    port=2222
+    label="bare metal"
+  fi
+
+  echo "[$i/$total] $node_name ($label, port ${port}, host ${knife_host})"
+  knife zero converge "name:${node_name}" -a knife_zero.host -p"${port}" -o "${RUNLIST}"
+done
+
+echo "Converged ${total} node(s) successfully."