#cloud-config
# Cloud-init configuration for asxpio-services server
# Debian 13 (trixie) - Services Server

hostname: asxpio-services
fqdn: asxpio-services.asxp.io
manage_etc_hosts: true

# Package management
package_update: true
package_upgrade: true

packages:
  - fail2ban
  - curl
  - gpg
  - htop
  - ncdu
  - tree
  - apt-transport-https
  - ca-certificates
  - gnupg
  - lsb-release

# Create users (docker group will be added later in runcmd)
users:
  - name: asxpi
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ+/5F7SxdTVW47iiStLpGK77oWfR5NgaK4tTSR/aVB me@asxp.io
  - name: zerrtika
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
  - name: deploy
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTDPg3mV55lO8uBnvpcGRxJ2vMRP0qB3Pxhg+C8rwj9 asxpio-deploy

# SSH hardening
ssh_pwauth: false
disable_root: false
ssh_deletekeys: false

# Write files
write_files:
  # Docker daemon configuration
  - path: /etc/docker/daemon.json
    content: |
      {
        "live-restore": true,
        "storage-driver": "overlay2",
        "log-opts": {
          "max-size": "20m"
        }
      }
    owner: root:root
    permissions: '0644'

  # Custom bash prompt for asxpi user
  - path: /home/asxpi/.bashrc_custom
    content: |
      # Custom bash prompt styling for asxpio servers
      export PS1="\[$(tput bold)\]\[\033[38;5;4m\][\[$(tput sgr0)\]\t\[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]]\[$(tput sgr0)\] \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\][\[$(tput sgr0)\]\u@\h \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]\w]\[$(tput sgr0)\] \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]\\$\[$(tput sgr0)\] \[$(tput sgr0)\]"
    owner: root:root
    permissions: '0644'

  # SSH hardening config
  - path: /etc/ssh/sshd_config.d/99-hardening.conf
    content: |
      PasswordAuthentication no
      PermitRootLogin prohibit-password
      PubkeyAuthentication yes
    owner: root:root
    permissions: '0644'

runcmd:
  # Install Docker
  - curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
  - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
  - apt-get update
  - apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

  # Enable and start Docker
  - systemctl enable docker
  - systemctl start docker

  # Add users to docker group (after docker is installed)
  - usermod -aG docker asxpi
  - usermod -aG docker zerrtika
  - usermod -aG docker deploy

  # Enable and start fail2ban
  - systemctl enable fail2ban
  - systemctl start fail2ban

  # Fix home directory ownership and setup bashrc for asxpi
  - chown asxpi:asxpi /home/asxpi
  - chown asxpi:asxpi /home/asxpi/.bashrc_custom
  - cp /etc/skel/.bashrc /home/asxpi/.bashrc
  - cp /etc/skel/.profile /home/asxpi/.profile
  - chown asxpi:asxpi /home/asxpi/.bashrc /home/asxpi/.profile
  - echo '[ -f ~/.bashrc_custom ] && source ~/.bashrc_custom' >> /home/asxpi/.bashrc

  # Fix home directory ownership for deploy user
  - chown deploy:deploy /home/deploy

  # Set up weekly Docker image pruning
  - echo '0 3 * * 1 docker image prune -af > /var/log/docker-prune.log 2>&1' | crontab -

  # Restart SSH to apply hardening
  - systemctl restart sshd

final_message: |
  ==========================================
  asxpio-services server is ready!
  ==========================================
  Hostname: asxpio-services
  OS: Debian 13 (trixie)
  User: asxpi (sudo + docker access)
  SSH: Key-only authentication enabled
  Docker: Installed with compose plugin

  You can now SSH: ssh asxpi@$(hostname -I | awk '{print $1}')
  ==========================================