feat(cloud-init): user-data-node.yaml and user-data-publisher.yaml with an origin node

[thiras]

Summary

Stacked on #133 (which is stacked on #130). One cloud-init template per kind of operator:

• user-data.yaml → user-data-node.yaml for node operators: a cache node.
• user-data-sponsord.yaml → user-data-publisher.yaml for publishers: an origin node, sponsord and its onramp on one VM. Each group can be deleted.
  • localhost is in decdn_nodes and decdn_origin_nodes as siblings, because the lint refuses children:.
  • The template ships an http origin backend to fill in.

bootstrap.sh:

• refuses an origin outside decdn_nodes;
• checks an origin's baseline play as decdn_origin_nodes, because its play is origin.yml's, not node.yml's decdn_nodes:!decdn_origin_nodes;
• tells an S3 origin that its keys go in decdn.env;
• gives decdn_origin_nodes no secrets of its own.

lint.py:

• refuses an origin without decdn_nodes;
• refuses an origin with no backend in decdn_origin_nodes.vars.

Molecule: cloud-init-sponsord is renamed cloud-init-publisher. It now also boots the origin node:

• the decdn/decdn and decdn/sponsord stub releases are served under their own mirror bases;
• a new refusal case covers an origin outside decdn_nodes;
• the node's secret is added to the gate assertions;
• verify checks decdn-node is running and that node.toml's [cache.origin] is the configured http backend.

Test plan

• make lint-cloud-init
• make test-scripts. New lint negatives: origin without decdn_nodes, origin without a backend, origin node from source, S3 keys in the origin vars. Plus baseline-plays.sh on the publisher template's host, and the relaxed hint-arm check.
• make lint, ansible-lint
• make molecule SCENARIOS='cloud-init cloud-init-publisher': both 7/7

Downstream

internal-devops: a renamed molecule scenario or template that it references needs the same rename.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Origin linting accepts incomplete backends, and two operator-facing instructions are misleading.

2 open findings

• Validate origin kind and required fields before accepting backend · New
• Render S3 environment assignments on separate lines · New

What changed in this PR

Introduces operator-specific cloud-init paths for cache-node and publisher deployments, with publisher hosts now including an origin node.

Changes:

• Renames cloud-init templates and Molecule coverage around node/publisher personas.
• Adds origin inventory validation, secret gating, and deployment coverage.
• Updates documentation, CI references, and script tests.

File	Description
tests/​scripts-test.sh	Updates template names and origin checks.
README.md	Documents the new templates.
Makefile	Updates cloud-init lint inputs.
CONTRIBUTING.md	Updates command and scenario documentation.
cloud-init/​user-data-publisher.yaml	Adds the publisher origin node inventory.
cloud-init/​user-data-node.yaml	Reframes the node template as cache-only.
cloud-init/​tests/​lint.py	Adds origin membership and backend validation.
cloud-init/​README.md	Documents publisher deployment and secrets.
cloud-init/​bootstrap.sh	Adds origin membership, baseline, and secret handling.
ansible/​roles/​sponsord/​README.md	Renames publisher Molecule coverage.
ansible/​roles/​sponsord_onramp/​README.md	Renames publisher Molecule coverage.
ansible/​README.md	Updates scenario naming.
ansible/​molecule/​cloud-init/​prepare.yml	Updates shared-scenario references.
ansible/​molecule/​cloud-init/​molecule.yml	Updates node template references.
ansible/​molecule/​cloud-init/​includes/​refuse.yml	Updates publisher scenario references.
ansible/​molecule/​cloud-init/​converge.yml	Boots the renamed node template.
ansible/​molecule/​cloud-init-publisher/​verify.yml	Verifies the origin node and backend.
ansible/​molecule/​cloud-init-publisher/​side_effect.yml	Tests origin guards and node secrets.
ansible/​molecule/​cloud-init-publisher/​prepare.yml	Creates separate signed release mirrors.
ansible/​molecule/​cloud-init-publisher/​molecule.yml	Defines publisher scenario behavior.
ansible/​molecule/​cloud-init-publisher/​converge.yml	Boots and configures the publisher template.
ansible/​Makefile	Renames the slow Molecule scenario.
AGENTS.md	Updates repository cloud-init guidance.
.github/​workflows/​molecule.yml	Updates scenario timing documentation.
.github/​workflows/​ci.yml	Updates cloud-init CI documentation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.