feat(kyber): add bounded Incus Crabbox pilot

[shunkakinoki]

Summary

Add a Kyber-only direct Incus pilot for Crabbox. Home Manager installs the CLI defaults and an explicit kyber-incus-setup command; switching does not install or start Incus automatically.

Tracker linkage

• Linear: none — operator-requested infrastructure pilot.
• Bead: qpt1h — repository scope kept in the internal task tracker per repository privacy guidance.

Contract

flowchart LR
  HM[Kyber Home Manager] --> Config[Crabbox user defaults]
  HM --> Setup[Explicit setup command]
  Setup --> Incus[Local Incus daemon and bounded project]
  Config --> CLI[Crabbox CLI]
  CLI --> Incus
  Incus --> Guests[Up to two container leases]

Loading

Before / after

Surface	Before	After
Kyber CLI defaults	No managed user config	Direct Incus over a local Unix socket
Provisioning	No Incus setup	Ubuntu packages and owned preseed resources
Capacity	No pilot project	Two instances; 4 CPUs / 8 GiB each; 64 GiB loop-backed storage pool
Other hosts and coordinator	Existing behavior	Unchanged

Breaking and irreversible changes

• Behavioral: Kyber user defaults become Incus; repo configuration and explicit overrides still take precedence.
• Compile-time: no upstream Crabbox or public API changes.
• Durable state and rollback: explicit setup installs Ubuntu packages, creates named Incus resources, installs a narrow Docker egress oneshot, and grants the existing operator root-equivalent incus-admin membership. No physical device is formatted. Reverting the Nix import does not remove daemon data or group membership; retirement needs an explicit inventory and cleanup.

Deliberate boundaries

No Matic/Kamino changes, public Incus API, Tailscale guest enrollment, coordinator support, or repository CI routing changes. Trusted Linux containers only; no privileged containers, host socket mounts, nesting, or VMs.

Verification

• Eight behavioral Python tests passed, including wrong-host refusal, native package installation, ownership collisions, API/route failures, repeat setup, and narrow/idempotent firewall rules.
• 200 Crabbox/Kyber/coverage ShellSpec examples passed.
• ShellCheck, Ruff, Nixfmt, inline-shell policy, whitespace checks, YAML relationships, and actual Crabbox config parsing passed.
• Nix config evaluation: Kyber receives the config; Matic and Kamino do not.
• Native setup-wrapper build passed; its Nix closure retains the preseed, network script, and systemd unit. Wrong-host execution refuses before privileges.
• Full Linux Home Manager build is not certified from the macOS author host.
• Read-only Kyber doctor confirms the provider exists but the Incus socket is absent. Session policy blocks privileged installation. No live containers were created; provisioning, concurrent execution, release, and host activation remain unverified.

Keep draft until an authorized operator runs the documented setup and bounded two-lease smoke on Kyber. No merge requested in this iteration.

---

Summary by cubic

Adds a Kyber-only Incus pilot for Crabbox, making Kyber's CLI use Incus directly while leaving other hosts and the coordinator unchanged. It includes an explicit setup command that provisions a bounded two-instance project, but does not start Incus until that command is run.

New Features

• Kyber user defaults now point Crabbox at a local Incus socket via ~/.config/crabbox/config.yaml.
• The new kyber-incus-setup command installs Ubuntu packages, applies a checked-in preseed, and configures a two-instance crabbox project with per-container CPU/memory/disk limits.
• A systemd oneshot installs narrow firewall rules to allow bridge egress through Docker's DOCKER-USER chain.
• Behavior tests cover wrong-host refusal, package installation, ownership collisions, repeat setup, and idempotent firewall rules.

Breaking Changes

• Setup grants the ubuntu user incus-admin membership, which is root-equivalent; a new SSH session is required to use it.
• Reverting the Home Manager import does not uninstall Incus or remove its data; retirement requires explicit cleanup.

^{Written for commit 78d0e04. Summary will update on new commits.}

[indent]

Warning

This organization's free trial has ended, so Indent couldn't start this review. Manage billing to resume reviews on this repository.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[shunkakinoki]

Verified head 78d0e04. The previously failing nix-format and shell-test checks now pass; Python tests/lint and inline-shell checks also pass. Local verification includes 200 focused ShellSpec examples, eight behavioral Python tests, Kyber-only Nix configuration evaluation, and a setup package whose closure retains all three installation assets. Full platform builds remain in progress. No Incus daemon or guests have been created on Kyber: privileged setup is still blocked in this session, so the PR remains draft pending operator installation and the documented two-lease smoke.