DroArc reaches every managed host as the machine account drouser (its SSH identity — see DROARC_SSH_USER). This runbook covers how a host gets its two standard accounts, in the order that prevents lock-out.

The two-account model

Keep them separate: machine commands are audited in droarc_commands, human access via shell history, and either key rotates without touching the other (ISO 27001:A.5.16).

Bootstrap order (the chicken-and-egg)

A fresh host has no drouser yet, so first contact is made as a privileged bootstrap user (root, or a cloud-init sudoer):

bootstrap user (root) --creates--> drouser --creates--> dolapo1

HostBootstrap.ensure_access/2 is the default action, run on every adopt. It is idempotent and never disables root SSH:

• drouser already reachable → steady state: ensure dolapo1 → {:ok, :ready}
• only the bootstrap user reachable → fresh host: create drouser, then dolapo1 → {:ok, :bootstrapped}
• neither reachable → {:error, :unreachable} (needs console recovery)

Provisioning a host from the CLI

mix dro.droarc.provision_host --host 10.10.10.40 --bootstrap
mix dro.droarc.provision_host --host 10.10.10.40 --bootstrap --as ubuntu  # non-root bootstrap user
mix dro.droarc.provision_host --host 10.10.10.40 --check                  # is drouser present?

Set DROARC_BOOTSTRAP_KEY_PATH in production so the bootstrap SSH pins an explicit identity instead of falling back to the ambient ssh-agent.

Hardening root — a deliberate, separate step

The 2026-06 lock-out happened when root was disabled before the managed-account keys were installed. Root-hardening is therefore never part of the default action. Run it only after access is confirmed:

mix dro.droarc.provision_host --host 10.10.10.40 --disable-root-ssh
mix dro.droarc.provision_host --host 10.10.10.40 --all   # provision + disable root

If a host is already locked out

If root is disabled and neither drouser nor dolapo1 has a working key, no automated path can recover it — re-key from the provider console (or rescue mode), then re-run --bootstrap.