loki-system-logs.sh: persist promtail positions, enable on boot, safer apt

- Move positions.yaml from /tmp (wiped on reboot) to /var/lib/promtail so
  promtail resumes where it left off after a reboot instead of either
  re-ingesting (duplicate lines in Loki) or skipping a chunk when a log
  was rotated during downtime.
- Create /var/lib/promtail with promtail:nogroup ownership (the
  apt-installed promtail user's primary group is nogroup).
- systemctl enable promtail so the service auto-starts on boot; previously
  only restart was called, so promtail did not survive a VM reboot.
- set -euo pipefail + DEBIAN_FRONTEND=noninteractive so the script aborts
  on first failure and runs cleanly under automation, without debconf
  prompts on minimal hosts.
- Fix shebang typo (#/bin/bash -> #!/bin/bash).

loki-system-logs.sh

@@ -1,13 +1,18 @@
-#/bin/bash
+#!/bin/bash
 # This script will setup Promtail to push to https://int.loki.grid.tf
+set -euo pipefail
 
 ### Install Promtail
+export DEBIAN_FRONTEND=noninteractive
 mkdir -p /etc/apt/keyrings/
 wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
-echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
-apt update && apt install promtail -y
+echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" > /etc/apt/sources.list.d/grafana.list
+apt-get update -qq && apt-get install -y promtail
 usermod -a -G adm promtail
 
+### Ensure persistent positions directory exists (apt-installed promtail user has primary group nogroup)
+install -d -o promtail -g nogroup -m 0755 /var/lib/promtail
+
 ### Set config
 cat << EOF > /etc/promtail/config.yml
 server:
@@ -15,7 +20,7 @@ server:
   grpc_listen_port: 0
 
 positions:
-  filename: /tmp/positions.yaml
+  filename: /var/lib/promtail/positions.yaml
 
 clients:
 - url: https://int.loki.grid.tf/loki/api/v1/push
@@ -62,7 +67,8 @@ RestartSec = 2
 WantedBy=multi-user.target
 EOF
 
-### Reload and restart
+### Reload, enable, restart
 systemctl daemon-reload
+systemctl enable promtail
 systemctl restart promtail
 systemctl status promtail --no-pager