Function render_script 

pub fn render_script(
    upload: &str,
    sha256: &str,
    ca_pem: &str,
    leaf: &Leaf,
    port: u16,
    allow_from: &[String],
    ssh_port: Option<u16>,
    public_ingress: bool,
) -> String

The root script: everything idempotent, so a second server add (or a rerun after a failure) converges. ssh_port stays open in the firewall; a dedicated VM, bootstrapped through incus, has none.