fix(cloud-init): wait for the dpkg lock before apt installs on first boot

jfraeys commented

2026-10-16 10:41:55 -04:00

Owner

The OVH nodes (migration #187) booted with ufw, fail2ban and auditd missing and the firewall off: unattended-upgrades held the dpkg lock, 'apt-get install ufw' failed, and every later ufw rule printed 'ufw: not found'. Adds -o DPkg::Lock::Timeout=300 to the four apt-get installs in services.yml.tpl and essentials.yml.tpl. user_data is in ignore_changes for production nodes on both providers, so running nodes are not replaced. Not changed here: fail2ban and auditd are only enabled in cloud-init, never installed; the hardening role installs them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

The OVH nodes (migration #187) booted with ufw, fail2ban and auditd missing and the firewall off: unattended-upgrades held the dpkg lock, 'apt-get install ufw' failed, and every later ufw rule printed 'ufw: not found'. Adds -o DPkg::Lock::Timeout=300 to the four apt-get installs in services.yml.tpl and essentials.yml.tpl. user_data is in ignore_changes for production nodes on both providers, so running nodes are not replaced. Not changed here: fail2ban and auditd are only enabled in cloud-init, never installed; the hardening role installs them. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit

2026-10-16 10:41:55 -04:00

fix(cloud-init): wait for the dpkg lock instead of failing the apt installs on first boot

Lint / lint (pull_request) Successful in 2m31s

Details

Secret scan / scan (pull_request) Successful in 15s

Details

7847c6311e

On the OVH nodes unattended-upgrades held the dpkg lock, so 'apt-get install ufw' failed
and the firewall was never enabled (also ufw: not found for every later rule).
-o DPkg::Lock::Timeout=300 on the four installs. user_data changes are ignored on
production nodes, so this only affects newly created nodes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys merged commit c1bd29a818 into main

2026-10-16 11:19:02 -04:00

jfraeys referenced this pull request from a commit

2026-10-16 11:19:05 -04:00

Merge pull request 'fix(cloud-init): wait for the dpkg lock before apt installs on first boot' (#215) from jfraeys/fix/cloud-init-dpkg-lock into main

Rows
Columns

fix(cloud-init): wait for the dpkg lock before apt installs on first boot #215