terraform: never replace a running server

hcloud replaces a server when user_data, image or ssh_keys change, and
cloud-init only runs at first boot anyway. An edit to cloud-init, like
adding a user, would therefore plan the destruction of a production
machine. Ignore changes to those three attributes and set
prevent_destroy on both servers, so cloud-init describes a rebuild and
nothing else.

Add user zerrtika to cloud-init to match the servers; the user was
created on them by playbook 04.

Assisted-by: Claude:fable-5-2

terraform/cloud-init/ops.yaml

@@ -32,6 +32,14 @@ users:
     ssh_authorized_keys:
       - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ+/5F7SxdTVW47iiStLpGK77oWfR5NgaK4tTSR/aVB me@asxp.io
 
+  - name: zerrtika
+    groups: sudo
+    shell: /bin/bash
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: true
+    ssh_authorized_keys:
+      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
+
   - name: deploy
     groups: sudo
     shell: /bin/bash
@@ -90,6 +98,7 @@ runcmd:
 
   # Add users to docker group (after docker is installed)
   - usermod -aG docker asxpi
+  - usermod -aG docker zerrtika
   - usermod -aG docker deploy
 
   # Enable and start fail2ban

terraform/cloud-init/services.yaml

@@ -31,6 +31,13 @@ users:
     lock_passwd: true
     ssh_authorized_keys:
       - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ+/5F7SxdTVW47iiStLpGK77oWfR5NgaK4tTSR/aVB me@asxp.io
+  - name: zerrtika
+    groups: sudo
+    shell: /bin/bash
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: true
+    ssh_authorized_keys:
+      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
   - name: deploy
     groups: sudo
     shell: /bin/bash
@@ -89,6 +96,7 @@ runcmd:
 
   # Add users to docker group (after docker is installed)
   - usermod -aG docker asxpi
+  - usermod -aG docker zerrtika
   - usermod -aG docker deploy
 
   # Enable and start fail2ban