From f988bb1131b71d4ad2a69bb54c33bad2b3be8937 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Fri, 19 Jun 2026 10:34:40 -0500
Subject: [PATCH] devserver/terraform: clear the password aging policies

I was running into these with ansible tasks that required `become`, so
this clears them from the get go since we don't do any password auth
anyways.
---
 devserver/terraform/droplet.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/devserver/terraform/droplet.tf b/devserver/terraform/droplet.tf
index e500f5d..16dcfff 100644
--- a/devserver/terraform/droplet.tf
+++ b/devserver/terraform/droplet.tf
@@ -20,6 +20,11 @@ resource "digitalocean_droplet" "devserver" {
 
     ssh_pwauth: false
     disable_root: true
+
+    # Clear the password aging policy since we don't log in with passwords
+    runcmd:
+      - chage -d $(date +%Y-%m-%d) -m 0 -M 99999 -I -1 -E -1 devict
+      - chage -d $(date +%Y-%m-%d) -m 0 -M 99999 -I -1 -E -1 root
   EOT
 }
 
-- 
2.51.2