commit adffa436dd210c7b892de1c57d198a3c6b4ea3e1 · finxol.io/config

+56
cloud-init.yaml
···

       1
       1
       +
       #cloud-config

     

       2
       2
       +
       

     

       3
       3
       +
       users:

     

       4
       4
       +
           - name: finxol

     

       5
       5
       +
             groups: users, admin, docker

     

       6
       6
       +
             sudo: ALL=(ALL) NOPASSWD:ALL

     

       7
       7
       +
             shell: /bin/bash

     

       8
       8
       +
             ssh_authorized_keys:

     

       9
       9
       +
                 # id_rsa.pub

     

       10
       10
       +
                 - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC10FwjHert2ks+hzt6MIRS/5HAasryp5jhBv7y7Ig531epIpwKrVIEX5/o0c8aPzfsVtMRSLSBJxPHxKMPJwZmjMJz5uCO09aalsFLC5hmA9M6HWt7Tm+4U3GxO73yfQKfzy9NEvFVR9McMeNLuk7aQP+hnaf9E/FYjW0obk9LOgjk/zG1rB5zs70+WCP5B1YXpkiPzubyw1CPeMx5UFrLd3cJUhgiKF+VdP52xis9EDZ+S7G3fknHmSUIRy9/xWSuOr9VB7nGATRGFhZKa4xzd9d/FGLhempkPdD9WTnsPMRD4Fneq5wXd7Qr2J8fIX8G6v71G1Xj56Y7D70OIYtwfa1uwtIUO4HdNnIoLGBj9QkW5LCx+wB4i/FwQ0IKCJzDx6HdnT2dSOoGVCoW8AnUpBZSDNKmEa5hlhriJse46ThjLvYpRcS2nIEO705qeb9kxW67jAFmedU8xwcdb9UJ5AOzQanCYIBKa9Cgm+hi0UoCQfktlfJQ8ASicMie/XE= finxol@Colins-MacBook-Pro.local

     

       11
       11
       +
       

     

       12
       12
       +
       package_update: true

     

       13
       13
       +
       package_upgrade: true

     

       14
       14
       +
       

     

       15
       15
       +
       write_files:

     

       16
       16
       +
           - path: /etc/ssh/sshd_config.d/ssh-hardening.conf

     

       17
       17
       +
             content: |

     

       18
       18
       +
                 UsePAM yes

     

       19
       19
       +
                 PasswordAuthentication no

     

       20
       20
       +
                 KbdInteractiveAuthentication no

     

       21
       21
       +
                 PermitRootLogin no

     

       22
       22
       +
                 PermitEmptyPasswords no

     

       23
       23
       +
                 X11Forwarding no

     

       24
       24
       +
                 AllowAgentForwarding no

     

       25
       25
       +
                 ClientAliveInterval 300

     

       26
       26
       +
                 ClientAliveCountMax 2

     

       27
       27
       +
                 LoginGraceTime 60

     

       28
       28
       +
                 MaxAuthTries 3

     

       29
       29
       +
                 MaxSessions 4

     

       30
       30
       +
                 AuthorizedKeysFile .ssh/authorized_keys

     

       31
       31
       +
                 AllowUsers finxol

     

       32
       32
       +
       

     

       33
       33
       +
       runcmd:

     

       34
       34
       +
           - apt-get install -y git gpg ca-certificates curl apt-transport-https debian-keyring debian-archive-keyring

     

       35
       35
       +
           - apt-get install -y bat

     

       36
       36
       +
           - "[[ -f /usr/bin/batcat ]] && [[ ! -f /usr/bin/bat ]] && ln -s /usr/bin/batcat /usr/bin/bat || true"

     

       37
       37
       +
           - mkdir -p /etc/apt/keyrings

     

       38
       38
       +
           - wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | gpg --dearmor -o /etc/apt/keyrings/gierens.gpg

     

       39
       39
       +
           - echo "deb [signed-by=/etc/apt/keyrings/gierens.gpg] http://deb.gierens.de stable main" | tee /etc/apt/sources.list.d/gierens.list

     

       40
       40
       +
           - chmod 644 /etc/apt/keyrings/gierens.gpg /etc/apt/sources.list.d/gierens.list

     

       41
       41
       +
           - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc

     

       42
       42
       +
           - chmod a+r /etc/apt/keyrings/docker.asc

     

       43
       43
       +
           - sh -c 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null'

     

       44
       44
       +
           - curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg

     

       45
       45
       +
           - echo "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/debian/ any main" | tee /etc/apt/sources.list.d/caddy-stable.list

     

       46
       46
       +
           - chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/sources.list.d/caddy-stable.list

     

       47
       47
       +
           - apt-get update

     

       48
       48
       +
           - apt-get install -y eza

     

       49
       49
       +
           - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

     

       50
       50
       +
           - apt-get install -y caddy

     

       51
       51
       +
           - apt-get install -y chrony

     

       52
       52
       +
           - groupadd docker || true

     

       53
       53
       +
           - usermod -aG docker finxol

     

       54
       54
       +
           - systemctl enable --now chrony

     

       55
       55
       +
           - systemctl restart sshd

     

       56
       56
       +
           - reboot