boxman 0.1.0__tar.gz

boxman-0.1.0/PKG-INFO

@@ -0,0 +1,169 @@
+Metadata-Version: 2.4
+Name: boxman
+Version: 0.1.0
+Summary: Set up and manage an Ubuntu development box
+Project-URL: Homepage, https://github.com/vivainio/boxman
+Project-URL: Documentation, https://vivainio.github.io/boxman/
+Project-URL: Repository, https://github.com/vivainio/boxman
+Project-URL: Issues, https://github.com/vivainio/boxman/issues
+Keywords: ubuntu,development,ec2,cloudformation,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Provides-Extra: ec2
+Requires-Dist: boto3>=1.34; extra == "ec2"
+
+# boxman
+
+[Read the Boxman book](https://vivainio.github.io/boxman/) for the concepts, setup steps, and command reference.
+
+Set up and manage an Ubuntu 24.04 development box. `boxman` is a Python command
+with system, user, and vault operations.
+
+## Install a host
+
+From this checkout, run the system step as root, then the user step from each
+login account. The first command works with the Ubuntu system Python before
+`uv` is installed:
+
+```bash
+sudo python3 -m boxman.cli system
+python3 -m boxman.cli user
+```
+
+With `uv` available, run it without installing the package:
+
+```bash
+uvx --from . boxman vault status
+```
+
+After publishing the repository, `uvx --from
+git+https://github.com/vivainio/boxman boxman ...` can run the same console
+command. For a persistent command, use `uv tool install .` from this checkout.
+
+`boxman system` uses zipget to install the apt packages declared in
+`linux-tools.toml`, sets up Git LFS, and configures rootless Podman for normal
+login users. It accepts explicit usernames, or `--packages-only` for a
+container build. It downloads zipget if no version supporting
+`recipe --system-only` is on root's PATH. A fresh install needs a released
+zipget with that option.
+
+`boxman user` installs the tools in the recipe, Node.js 22, Claude Code,
+Copilot CLI, and uv. Run the user step for each account.
+Run `boxman verify` afterward to check the installed commands and rootless
+Podman.
+
+The same package set can be used in a dev container:
+
+```bash
+podman build -f container/Dockerfile -t boxman-dev .
+```
+
+The container build skips host login-user and systemd configuration. FUSE
+mounting may require additional container privileges, so the vault commands
+are intended for the native host.
+
+## Private directory
+
+The recipe installs `gocryptfs` and FUSE 3. Each user initializes their own
+vault once and unlocks it after a reboot or unmount:
+
+```bash
+uvx --from . boxman vault init
+uvx --from . boxman vault unlock
+uvx --from . boxman vault status
+uvx --from . boxman claude  # starts Claude with its config in the mounted vault
+uvx --from . boxman vault lock  # after stopping processes that use the mount
+```
+
+Encrypted files live in `~/.private.cipher`; the plaintext mount is
+`~/private`. Initialization and unlocking prompt for the password. Keep the
+password and gocryptfs recovery key outside the host. Back up the encrypted
+directory, including `gocryptfs.conf`, while keeping the plaintext mount out
+of backups.
+
+`boxman claude` refuses to run unless the vault is mounted. Use it before the
+first Claude login. It sets `CLAUDE_CONFIG_DIR` to `~/private/claude` and does
+not move existing credentials from `~/.claude`. Configure other tools'
+credential locations separately if they should use the vault. Persistent
+agents need the vault mounted while they use credentials. Locking fails while
+a process holds files in the mount open.
+
+The vault protects its backing files and snapshots while locked. It does not
+hide credentials from the user's running processes or a host administrator
+while unlocked. Keep home directory permissions private to each Unix owner.
+
+## EC2 host
+
+Install the optional AWS dependency, then create
+`${XDG_CONFIG_HOME:-~/.config}/boxman/ec2.toml`:
+
+```bash
+uv tool install '.[ec2]'
+mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/boxman"
+```
+
+```toml
+[ec2]
+profile = "your-aws-profile"
+region = "your-region"
+stack_name = "your-stack-name"
+
+[ec2.tags]
+Owner = "your-owner"
+Environment = "your-environment"
+```
+
+The config contains no credentials; AWS uses the named profile. Supply the tags
+required by your account. The TOML file selects the AWS profile, region, stack,
+and tags. Command-line options override the file;
+`--tag KEY=VALUE` adds or overrides a tag. `--config PATH` selects another TOML
+file. Put global options before the action:
+
+```bash
+boxman ec2 init --vpc-id vpc-... --subnet-id subnet-... \
+  --instance-type t3.xlarge --volume-size-gb 100 \
+  --instance-name mybox \
+  --ami-id /aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id
+boxman ec2 deploy
+boxman ec2 status
+boxman ec2 start
+boxman ec2 stop
+boxman ec2 connect -u myuser
+boxman ec2 ssh -u myuser
+boxman ec2 ssh-config -u myuser --alias mybox
+boxman ec2 run -u myuser 'uname -a'
+```
+
+`init` writes `${XDG_CONFIG_HOME:-~/.config}/boxman/stacks/<stack_name>.yaml`
+with the instance settings as parameter defaults and refuses to overwrite an
+existing file. Edit that YAML to customize the stack. `deploy` reads the YAML
+for the configured stack name and sends its defaults as CloudFormation
+parameters. Tags from `[ec2.tags]` and repeatable
+`--tag KEY=VALUE` options become CloudFormation stack tags. A single config
+file selects one stack; use `--config PATH` for another box.
+
+Deployment creates or updates a CloudFormation stack containing an Ubuntu EC2
+instance, an SSM role, and an EC2 Instance Connect Endpoint. SSH uses that
+endpoint and installs a generated public key through SSM. `ssh-config` writes a
+marked host entry to `~/.ssh/config`. The stack name selects the instance for
+all subsequent commands. Starting, stopping, and deploying incur AWS charges.
+
+## Release
+
+Build the Zensical book locally with `zensical build --clean`. The docs workflow
+publishes it to GitHub Pages when documentation changes on `main`.
+
+A published GitHub release triggers the PyPI workflow. Use a `vX.Y.Z` tag;
+the workflow sets the package version from the release tag, builds the wheel
+and source distribution, and publishes with PyPI trusted publishing. Configure
+a PyPI trusted publisher for repository `vivainio/boxman`, workflow
+`publish.yml`, environment `pypi` before the first release.

boxman-0.1.0/README.md

@@ -0,0 +1,146 @@
+# boxman
+
+[Read the Boxman book](https://vivainio.github.io/boxman/) for the concepts, setup steps, and command reference.
+
+Set up and manage an Ubuntu 24.04 development box. `boxman` is a Python command
+with system, user, and vault operations.
+
+## Install a host
+
+From this checkout, run the system step as root, then the user step from each
+login account. The first command works with the Ubuntu system Python before
+`uv` is installed:
+
+```bash
+sudo python3 -m boxman.cli system
+python3 -m boxman.cli user
+```
+
+With `uv` available, run it without installing the package:
+
+```bash
+uvx --from . boxman vault status
+```
+
+After publishing the repository, `uvx --from
+git+https://github.com/vivainio/boxman boxman ...` can run the same console
+command. For a persistent command, use `uv tool install .` from this checkout.
+
+`boxman system` uses zipget to install the apt packages declared in
+`linux-tools.toml`, sets up Git LFS, and configures rootless Podman for normal
+login users. It accepts explicit usernames, or `--packages-only` for a
+container build. It downloads zipget if no version supporting
+`recipe --system-only` is on root's PATH. A fresh install needs a released
+zipget with that option.
+
+`boxman user` installs the tools in the recipe, Node.js 22, Claude Code,
+Copilot CLI, and uv. Run the user step for each account.
+Run `boxman verify` afterward to check the installed commands and rootless
+Podman.
+
+The same package set can be used in a dev container:
+
+```bash
+podman build -f container/Dockerfile -t boxman-dev .
+```
+
+The container build skips host login-user and systemd configuration. FUSE
+mounting may require additional container privileges, so the vault commands
+are intended for the native host.
+
+## Private directory
+
+The recipe installs `gocryptfs` and FUSE 3. Each user initializes their own
+vault once and unlocks it after a reboot or unmount:
+
+```bash
+uvx --from . boxman vault init
+uvx --from . boxman vault unlock
+uvx --from . boxman vault status
+uvx --from . boxman claude  # starts Claude with its config in the mounted vault
+uvx --from . boxman vault lock  # after stopping processes that use the mount
+```
+
+Encrypted files live in `~/.private.cipher`; the plaintext mount is
+`~/private`. Initialization and unlocking prompt for the password. Keep the
+password and gocryptfs recovery key outside the host. Back up the encrypted
+directory, including `gocryptfs.conf`, while keeping the plaintext mount out
+of backups.
+
+`boxman claude` refuses to run unless the vault is mounted. Use it before the
+first Claude login. It sets `CLAUDE_CONFIG_DIR` to `~/private/claude` and does
+not move existing credentials from `~/.claude`. Configure other tools'
+credential locations separately if they should use the vault. Persistent
+agents need the vault mounted while they use credentials. Locking fails while
+a process holds files in the mount open.
+
+The vault protects its backing files and snapshots while locked. It does not
+hide credentials from the user's running processes or a host administrator
+while unlocked. Keep home directory permissions private to each Unix owner.
+
+## EC2 host
+
+Install the optional AWS dependency, then create
+`${XDG_CONFIG_HOME:-~/.config}/boxman/ec2.toml`:
+
+```bash
+uv tool install '.[ec2]'
+mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/boxman"
+```
+
+```toml
+[ec2]
+profile = "your-aws-profile"
+region = "your-region"
+stack_name = "your-stack-name"
+
+[ec2.tags]
+Owner = "your-owner"
+Environment = "your-environment"
+```
+
+The config contains no credentials; AWS uses the named profile. Supply the tags
+required by your account. The TOML file selects the AWS profile, region, stack,
+and tags. Command-line options override the file;
+`--tag KEY=VALUE` adds or overrides a tag. `--config PATH` selects another TOML
+file. Put global options before the action:
+
+```bash
+boxman ec2 init --vpc-id vpc-... --subnet-id subnet-... \
+  --instance-type t3.xlarge --volume-size-gb 100 \
+  --instance-name mybox \
+  --ami-id /aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id
+boxman ec2 deploy
+boxman ec2 status
+boxman ec2 start
+boxman ec2 stop
+boxman ec2 connect -u myuser
+boxman ec2 ssh -u myuser
+boxman ec2 ssh-config -u myuser --alias mybox
+boxman ec2 run -u myuser 'uname -a'
+```
+
+`init` writes `${XDG_CONFIG_HOME:-~/.config}/boxman/stacks/<stack_name>.yaml`
+with the instance settings as parameter defaults and refuses to overwrite an
+existing file. Edit that YAML to customize the stack. `deploy` reads the YAML
+for the configured stack name and sends its defaults as CloudFormation
+parameters. Tags from `[ec2.tags]` and repeatable
+`--tag KEY=VALUE` options become CloudFormation stack tags. A single config
+file selects one stack; use `--config PATH` for another box.
+
+Deployment creates or updates a CloudFormation stack containing an Ubuntu EC2
+instance, an SSM role, and an EC2 Instance Connect Endpoint. SSH uses that
+endpoint and installs a generated public key through SSM. `ssh-config` writes a
+marked host entry to `~/.ssh/config`. The stack name selects the instance for
+all subsequent commands. Starting, stopping, and deploying incur AWS charges.
+
+## Release
+
+Build the Zensical book locally with `zensical build --clean`. The docs workflow
+publishes it to GitHub Pages when documentation changes on `main`.
+
+A published GitHub release triggers the PyPI workflow. Use a `vX.Y.Z` tag;
+the workflow sets the package version from the release tag, builds the wheel
+and source distribution, and publishes with PyPI trusted publishing. Configure
+a PyPI trusted publisher for repository `vivainio/boxman`, workflow
+`publish.yml`, environment `pypi` before the first release.

boxman-0.1.0/boxman/cli.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Set up and manage a Linux development box."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def fail(message: str) -> None:
+    raise SystemExit(message)
+
+
+def run(*args: str) -> None:
+    result = subprocess.run(args, check=False)
+    if result.returncode:
+        raise SystemExit(result.returncode)
+
+
+def mounted(path: Path) -> bool:
+    return subprocess.run(
+        ("mountpoint", "-q", str(path)),
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        check=False,
+    ).returncode == 0
+
+
+def vault_paths() -> tuple[Path, Path]:
+    home = Path.home()
+    cipher, plain = home / ".private.cipher", home / "private"
+    if cipher.is_symlink() or plain.is_symlink():
+        fail("Private vault paths must not be symlinks")
+    return cipher, plain
+
+
+def private_dir(path: Path) -> None:
+    path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    path.chmod(0o700)
+
+
+def vault(action: str) -> None:
+    if os.geteuid() == 0:
+        fail("Run vault commands as your login user, not root")
+    os.umask(0o077)
+    cipher, plain = vault_paths()
+
+    if action == "status":
+        print("Private vault is unlocked" if mounted(plain) else "Private vault is locked")
+    elif action == "init":
+        if mounted(plain):
+            fail("Private vault is already unlocked")
+        if (cipher / "gocryptfs.conf").exists():
+            fail("Private vault is already initialized")
+        private_dir(cipher)
+        private_dir(plain)
+        if any(cipher.iterdir()):
+            fail("Encrypted backing directory is not empty")
+        if any(plain.iterdir()):
+            fail("Plaintext mount directory is not empty")
+        run("gocryptfs", "-init", str(cipher))
+        print("Keep the password and recovery key outside this host.")
+    elif action == "unlock":
+        if not (cipher / "gocryptfs.conf").is_file():
+            fail("Private vault is not initialized; run boxman vault init")
+        private_dir(cipher)
+        private_dir(plain)
+        if mounted(plain):
+            print("Private vault is already unlocked")
+            return
+        if any(plain.iterdir()):
+            fail("Plaintext mount directory is not empty; refusing to hide its files")
+        run("gocryptfs", str(cipher), str(plain))
+    elif action == "lock":
+        if not mounted(plain):
+            print("Private vault is already locked")
+            return
+        run("fusermount3", "-u", str(plain))
+    else:
+        fail("Usage: boxman vault {init|unlock|lock|status}")
+
+
+def claude(args: list[str]) -> None:
+    if os.geteuid() == 0:
+        fail("Run Claude as your login user, not root")
+    _, plain = vault_paths()
+    if not mounted(plain):
+        fail("Private vault is locked; run boxman vault unlock first")
+    config = plain / "claude"
+    if config.is_symlink():
+        fail("Claude config directory must not be a symlink")
+    os.umask(0o077)
+    private_dir(config)
+    os.environ["CLAUDE_CONFIG_DIR"] = str(config)
+    os.execvp("claude", ["claude", *args])
+
+
+def main() -> None:
+    if len(sys.argv) < 2:
+        fail("Usage: boxman {system|user|vault|claude|verify|ec2} ...")
+    command, *args = sys.argv[1:]
+    if command == "system":
+        from boxman import system
+
+        system.main(args)
+    elif command == "user":
+        if args:
+            fail("Usage: boxman user")
+        from boxman import user
+
+        user.main()
+    elif command == "vault":
+        if len(args) != 1:
+            fail("Usage: boxman vault {init|unlock|lock|status}")
+        vault(args[0])
+    elif command == "claude":
+        claude(args)
+    elif command == "ec2":
+        from boxman import ec2
+
+        ec2.main(args)
+    elif command == "verify":
+        if args:
+            fail("Usage: boxman verify")
+        from boxman import verify
+
+        verify.main()
+    else:
+        fail("Usage: boxman {system|user|vault|claude|verify|ec2} ...")
+
+
+if __name__ == "__main__":
+    main()

boxman-0.1.0/boxman/data/ec2-template.yaml

@@ -0,0 +1,126 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  EC2 development box:
+  one instance, no inbound security-group rules, SSM-only access.
+
+Parameters:
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+  SubnetId:
+    Type: AWS::EC2::Subnet::Id
+  InstanceType:
+    Type: String
+  VolumeSizeGb:
+    Type: Number
+  InstanceName:
+    Type: String
+  LatestAmiId:
+    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
+
+Resources:
+  SecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupName: !Sub "${AWS::StackName}-sg"
+      GroupDescription: Shared coding-agent dev box - no inbound rules, SSM only
+      VpcId: !Ref VpcId
+      Tags:
+        - Key: Name
+          Value: !Sub "${AWS::StackName}-sg"
+      # No SecurityGroupIngress here: no inbound rules from the internet, on
+      # purpose. The only inbound access is via SecurityGroupIngressFromEice
+      # below, scoped to the Instance Connect Endpoint's own security group.
+      # No SecurityGroupEgress: keeps CloudFormation's default allow-all outbound.
+
+  EiceSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupName: !Sub "${AWS::StackName}-eice-sg"
+      GroupDescription: EC2 Instance Connect Endpoint - no inbound rules needed
+      VpcId: !Ref VpcId
+      Tags:
+        - Key: Name
+          Value: !Sub "${AWS::StackName}-eice-sg"
+
+  SecurityGroupIngressFromEice:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: !Ref SecurityGroup
+      IpProtocol: tcp
+      FromPort: 22
+      ToPort: 22
+      SourceSecurityGroupId: !Ref EiceSecurityGroup
+      Description: SSH from the EC2 Instance Connect Endpoint only
+
+  InstanceConnectEndpoint:
+    Type: AWS::EC2::InstanceConnectEndpoint
+    Properties:
+      SubnetId: !Ref SubnetId
+      SecurityGroupIds:
+        - !Ref EiceSecurityGroup
+      PreserveClientIp: true
+      Tags:
+        - Key: Name
+          Value: !Sub "${AWS::StackName}-eice"
+
+  InstanceRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub "${AWS::StackName}-ssm-role"
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: ec2.amazonaws.com
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
+      Tags:
+        - Key: Name
+          Value: !Sub "${AWS::StackName}-ssm-role"
+
+  InstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      InstanceProfileName: !Sub "${AWS::StackName}-ssm-profile"
+      Roles:
+        - !Ref InstanceRole
+
+  Instance:
+    Type: AWS::EC2::Instance
+    Properties:
+      ImageId: !Ref LatestAmiId
+      InstanceType: !Ref InstanceType
+      SubnetId: !Ref SubnetId
+      SecurityGroupIds:
+        - !Ref SecurityGroup
+      IamInstanceProfile: !Ref InstanceProfile
+      BlockDeviceMappings:
+        - DeviceName: /dev/sda1
+          Ebs:
+            VolumeSize: !Ref VolumeSizeGb
+            VolumeType: gp3
+            DeleteOnTermination: true
+      MetadataOptions:
+        HttpTokens: required
+        HttpPutResponseHopLimit: 2
+      Tags:
+        - Key: Name
+          Value: !Ref InstanceName
+
+Outputs:
+  InstanceId:
+    Value: !Ref Instance
+  SecurityGroupId:
+    Value: !Ref SecurityGroup
+  InstanceRoleArn:
+    Value: !GetAtt InstanceRole.Arn
+  InstanceProfileArn:
+    Value: !GetAtt InstanceProfile.Arn
+  # No PublicIp output: !GetAtt Instance.PublicIp fails outright whenever the
+  # instance isn't running (stopped by uptime governance, mid-restart, etc.),
+  # breaking every subsequent stack operation. basbox.py status() already
+  # reads the live public IP via ec2:DescribeInstances instead.
+  InstanceConnectEndpointId:
+    Value: !Ref InstanceConnectEndpoint

boxman-0.1.0/boxman/data/linux-tools.toml

@@ -0,0 +1,80 @@
+# zipget recipe for boxman on Ubuntu 24.04
+
+[system_packages]
+apt = [
+  "acl", "build-essential", "ca-certificates", "curl", "dbus-user-session",
+  "direnv", "file", "fuse3", "fuse-overlayfs", "gh", "git", "git-lfs",
+  "gocryptfs", "jq",
+  "less", "lf", "libsecret-tools", "openssh-client", "podman", "python3",
+  "python3-venv", "python-is-python3", "rsync", "shellcheck",
+  "slirp4netns", "uidmap", "unzip", "xz-utils", "zip", "zstd",
+]
+
+[vars]
+bin_dir = "~/.local/bin"
+
+[herdr]
+# Agent multiplexer - https://herdr.dev
+github = { repo = "herdrdev/herdr", asset = "herdr-linux-x86_64" }
+save_as = "${bin_dir}/herdr"
+executable = true
+
+[cship]
+# Claude Code statusline - https://cship.dev
+github = { repo = "stephenleo/cship", asset = "cship-x86_64-unknown-linux-musl" }
+save_as = "${bin_dir}/cship"
+executable = true
+
+[microsoft-edit]
+# Terminal-based text editor - https://github.com/microsoft/edit
+# Note: only gnu builds available (no musl)
+github = { repo = "microsoft/edit", asset = "x86_64-linux-gnu.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "edit"
+
+[starship]
+# Cross-shell prompt - https://github.com/starship/starship
+github = { repo = "starship/starship", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "starship"
+
+[ripgrep]
+# Fast regex search tool - https://github.com/BurntSushi/ripgrep
+github = { repo = "BurntSushi/ripgrep", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "*/rg"
+
+[fd]
+# Fast find alternative - https://github.com/sharkdp/fd
+github = { repo = "sharkdp/fd", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "*/fd"
+
+[bat]
+# Cat with syntax highlighting - https://github.com/sharkdp/bat
+github = { repo = "sharkdp/bat", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "*/bat"
+
+[fzf]
+# Fuzzy finder - https://github.com/junegunn/fzf
+github = { repo = "junegunn/fzf", asset = "linux_amd64.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "fzf"
+
+[zoxide]
+# Smarter cd command - https://github.com/ajeetdsouza/zoxide
+github = { repo = "ajeetdsouza/zoxide", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "zoxide"
+
+[delta]
+# Git diff viewer - https://github.com/dandavison/delta
+github = { repo = "dandavison/delta", asset = "x86_64-unknown-linux-musl.tar.gz" }
+unzip_to = "${bin_dir}"
+files = "*/delta"
+
+[aws-cli]
+# AWS CLI v2 - official installer
+url = "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"
+unzip_to = "./aws-cli-installer"