Starts with a basic debian image plus one custom caida package which will reach out to a HTTPS REST API at Caida.
The node sends some basic information about itself to CAIDA. For example, it'll send its IP address, IPv6 address if it has one, DNS configuration, a traceroute back to the CAIDA server, etc.
The Caida REST API creates an empty package specific debian repo at CAIDA, in
the form:
https://dpkg.caida.org/ark-private/randomnumber/
For example:
https://dpkg.caida.org/ark-private/FSRjdAcR8F3BpTtFZDvj/
and returns the selected random number to the client.
The client places this in /etc/apt/sources.list.d/caida.list:
deb [trusted=yes] https://dpkg.caida.org/ark-private/FSRjdAcR8F3BpTtFZDvj/
stable main
Next, the site host logs in to his CAIDA web account on CAIDA's web server and takes ownership of the new node. He does so by identifying its IP address, probably. He adds additional information like the node's physical address, name of the service provider, etc. Then it goes to CAIDA staff to approve the node.
Until approved, the random-number directory on the dpkg server is just a symbolic link to a debian archive which is completely empty.
Once the node is approved, the link on the dpkg server is replaced with a debian archive containing the node's configuration packages which pull down (depend on) all the other software and configuration it needs. Upon automatic apt upgrade, the node finds a new version of the package "configuration" which is the master package for dependencies on everything else, including the natp-ssh package which contains the ssh keys for natportal.