Edge provision
An idempotent bash bootstrap for edge Linux hosts: re-run it as often as you like, and it reports only what it changed.
The problem
Writing a script that configures a server is easy; writing one that can be re-run without breaking anything, on day one as on day one hundred, is not.
What it does
Every operation (users, directories, packages, config files, kernel and SSH
hardening) goes through an ensure_* function that checks first and acts only if
needed. At the end an honest summary says what changed: on the second run, zero
changes, and a container test proves it.
There is a dry-run mode that previews changes without applying them, and per-host settings live in a separate file: onboarding a new node needs no code changes. It comes from the scripts I use to bring up devices installed in the field.