#cloud-config

users:
    - name: finxol
      groups: users, admin, docker
      sudo: ALL=(ALL) NOPASSWD:ALL
      shell: /bin/bash
      ssh_authorized_keys:
          # id_rsa.pub
          - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC10FwjHert2ks+hzt6MIRS/5HAasryp5jhBv7y7Ig531epIpwKrVIEX5/o0c8aPzfsVtMRSLSBJxPHxKMPJwZmjMJz5uCO09aalsFLC5hmA9M6HWt7Tm+4U3GxO73yfQKfzy9NEvFVR9McMeNLuk7aQP+hnaf9E/FYjW0obk9LOgjk/zG1rB5zs70+WCP5B1YXpkiPzubyw1CPeMx5UFrLd3cJUhgiKF+VdP52xis9EDZ+S7G3fknHmSUIRy9/xWSuOr9VB7nGATRGFhZKa4xzd9d/FGLhempkPdD9WTnsPMRD4Fneq5wXd7Qr2J8fIX8G6v71G1Xj56Y7D70OIYtwfa1uwtIUO4HdNnIoLGBj9QkW5LCx+wB4i/FwQ0IKCJzDx6HdnT2dSOoGVCoW8AnUpBZSDNKmEa5hlhriJse46ThjLvYpRcS2nIEO705qeb9kxW67jAFmedU8xwcdb9UJ5AOzQanCYIBKa9Cgm+hi0UoCQfktlfJQ8ASicMie/XE= finxol@Colins-MacBook-Pro.local

package_update: true
package_upgrade: true

write_files:
    - path: /etc/ssh/sshd_config.d/ssh-hardening.conf
      content: |
          UsePAM yes
          PasswordAuthentication no
          KbdInteractiveAuthentication no
          PermitRootLogin no
          PermitEmptyPasswords no
          X11Forwarding no
          AllowAgentForwarding no
          ClientAliveInterval 300
          ClientAliveCountMax 2
          LoginGraceTime 60
          MaxAuthTries 3
          MaxSessions 4
          AuthorizedKeysFile .ssh/authorized_keys
          AllowUsers finxol

runcmd:
    - apt-get install -y git gpg ca-certificates curl apt-transport-https debian-keyring debian-archive-keyring
    - apt-get install -y bat
    - "[[ -f /usr/bin/batcat ]] && [[ ! -f /usr/bin/bat ]] && ln -s /usr/bin/batcat /usr/bin/bat || true"
    - mkdir -p /etc/apt/keyrings
    - wget -qO- https://raw.githubusercontent.com/eza-community/eza/main/deb.asc | gpg --dearmor -o /etc/apt/keyrings/gierens.gpg
    - echo "deb [signed-by=/etc/apt/keyrings/gierens.gpg] http://deb.gierens.de stable main" | tee /etc/apt/sources.list.d/gierens.list
    - chmod 644 /etc/apt/keyrings/gierens.gpg /etc/apt/sources.list.d/gierens.list
    - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
    - chmod a+r /etc/apt/keyrings/docker.asc
    - sh -c 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null'
    - curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    - echo "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/debian/ any main" | tee /etc/apt/sources.list.d/caddy-stable.list
    - chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/sources.list.d/caddy-stable.list
    - apt-get update
    - apt-get install -y eza
    - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
    - apt-get install -y caddy
    - apt-get install -y chrony
    - groupadd docker || true
    - usermod -aG docker finxol
    - systemctl enable --now chrony
    - systemctl restart sshd
    - reboot