Agent installation

Install AI Agent

The following installation is under OS "Rocky Linux 9.8 (Blue Onyx)".

Dev VM Environment Setup Documentation

Reconstructed from the live system (dnf history, installed packages, repo configs, and dotfiles) on 2026-10-07. Use this as a rebuild checklist if this box is ever re-provisioned.

1. Base system

OS: Rocky Linux 9.8 (Blue Onyx), kernel 5.14.0-687.53.1.el9_8
Virtualization: VirtualBox VM (hostname s240), installed from anaconda-ks.cfg (kickstart file present at /root/anaconda-ks.cfg — keep this if you need to reproduce the exact initial partitioning/install options)
Access: SSH (root) + VS Code Remote-SSH (VS Code Server auto-installs itself into ~/.vscode-server on first connect — no manual step needed)

2. Extra YUM/DNF repositories

###### GitHub CLI
cat <<'EOF' > /etc/yum.repos.d/gh-cli.repo
[gh-cli]
name=packages for the GitHub CLI
baseurl=https://cli.github.com/packages/rpm
enabled=1
gpgcheck=1
gpgkey=https://cli.github.com/packages/githubcli-archive-keyring.asc
EOF

###### HashiCorp (Terraform)
dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo

###### Microsoft (Azure CLI, VS Code server deps)
dnf install -y https://packages.microsoft.com/config/rhel/9.0/packages-microsoft-prod.rpm

###### VS Code
cat <<'EOF' > /etc/yum.repos.d/vscode.repo
[code]
name=Visual Studio Code
baseurl=https://packages.microsoft.com/yumrepos/vscode
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
EOF

3. Package installation order (from `dnf history`)

dnf update -y
dnf install -y jq
dnf install -y git
dnf install -y samba          # historical, confirm still needed
dnf install -y npm
dnf install -y pip
dnf install -y terraform
dnf install -y whois
dnf install -y gh
dnf install -y ruby
dnf install -y docker         # resolves to podman + podman-docker on RHEL9
dnf install -y go             # golang, golang-bin, golang-race, golang-src
dnf install -y telnet
dnf install -y azure-cli
dnf update -y
dnf install -y ./session-manager-plugin.rpm   # AWS SSM Session Manager plugin
dnf groupinstall -y "Development Tools"
dnf install -y git curl wget
dnf install -y code           # VS Code (rarely used directly; server side runs via Remote-SSH)
dnf module install -y nodejs:24
dnf update -y

Current versions on this box: git 2.52.0, terraform 1.16.5, ruby 3.0.7, go 1.26.7, podman 5.8.2 (docker CLI emulated), azure-cli 2.90.0, nodejs 24.21.0, python3 3.9.25, java (OpenJDK) 1.8.0_504, session-manager-plugin 1.2.835.0.

4. AWS CLI v2 (NOT from dnf — official installer, lives in /usr/local/bin)

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip awscliv2.zip && ./aws/install
aws --version   # aws-cli/2.15.36

5. GitHub Copilot CLI

Installed globally via npm:

npm install -g @github/copilot

Also present globally: serverless@3.38.0 (npm install -g serverless).

6. Authentication / credentials needed at each step

Step	Command	Credential/secret required
GitHub access	`gh auth login`	GitHub account with org access; during login, choose SSH protocol and either authenticate via browser (OAuth) or paste a GitHub PAT with scopes: `repo`, `workflow`, `gist`, `admin:public_key`, `admin:org`, `write:packages`
Git-over-SSH	generate/reuse `~/.ssh/id_ed25519`	SSH key must be added to the GitHub account's SSH keys settings page
Clone org repos	`git clone git@github.com:<org>/<repo>.git`	GitHub user must be a member of the org/team with repo access
AWS CLI	`aws configure` or `aws configure sso`	Either (a) an IAM Identity Center SSO start URL + region, or (b) an AWS access key ID/secret key per profile — ask your AWS admin which model this org uses and request the relevant profile/role names
Azure CLI	`az login`	Azure AD account with access to the relevant subscription(s)
Terraform Cloud/Enterprise	`terraform login`	Terraform Cloud/Enterprise org name + a user API token (generated from the TFC/TFE UI)
kubectl	`aws eks update-kubeconfig --name <cluster> --region <region>` (or equivalent for your cluster provider)	Valid AWS credentials (above) with EKS describe permissions, plus the cluster name/region
New Relic CLI	`newrelic profile add` (or equivalent)	New Relic account ID + license/API key
Qualys Cloud Agent	run `install-qualys-agent-rhel.sh`	Qualys Activation ID and Customer ID, issued by your security team
AWS SSM agent	run `enable-ssm.sh.txt`	IAM role/instance profile with SSM permissions attached to the host

None of these secrets are stored in this document — request them from the relevant system owner (GitHub org admin, AWS admin, security team, etc.) at the point you reach that step.

7. Project repositories

Clone whichever repos your work requires once GitHub access (§6) is configured, e.g.:

mkdir -p /opt/copilot && cd /opt/copilot
git clone git@github.com:<org>/<repo>.git

Info needs confirm

Whether AWS access in this environment is via IAM Identity Center (SSO) or static access keys — this determines whether you run aws configure sso or aws configure.
Whether samba, telnet, whois are still actually required, or were one-off/legacy installs.
Whether the Qualys agent and SSM registration are mandatory for any new box per your org's compliance policy, or optional.
Any VPN/bastion requirement to reach this VM's SSH endpoint from outside its current network.
Whether you want the kickstart file (anaconda-ks.cfg) extracted for a full disk/partition-level rebuild, or whether package-level provisioning (this doc) is sufficient.

Github auth

Use Kantar laptop to do Github auth.
search ox0_2024-10-17
for GitHub PAT (personal access token (classic)) for user ox0.

gh auth login

gh auth status
github.com
  ✓ Logged in to github.com account ox0 (/root/.config/gh/hosts.yml)
  - Active account: true
  - Git operations protocol: ssh
  - Token: gho_************************************
  - Token scopes: 'admin:org', 'admin:public_key', 'gist', 'repo', 'workflow', 'write:packages'

Credentials Status — Currently Satisfied

Verified on this host. Only credentials confirmed active/working are listed; kubectl, Qualys Cloud Agent, and AWS SSM Agent are excluded as not currently needed.

Credential	Status	Location
GitHub (gh CLI + SSH key)	✅ Authenticated, SSH works	`~/.config/gh/hosts.yml` (gh token), `~/.ssh/id_ed25519` (SSH key)
AWS CLI (per-profile IAM user)	✅ Live credentials work	`~/.aws/config` (profiles), `~/.aws/credentials` (keys)
Azure CLI	✅ Logged in	`~/.azure/` (session/token cache)
Terraform Cloud token	✅ Present and valid	`~/.terraform.d/credentials.tfrc.json`
New Relic	✅ Credentials file present	`~/.newrelic/credentials.json`