137 lines
4.6 KiB
YAML
137 lines
4.6 KiB
YAML
#cloud-config
|
|
# Cloud-init configuration for asxpio-ops server
|
|
# Debian 13 (trixie) - Ops Server
|
|
|
|
hostname: asxpio-ops
|
|
fqdn: asxpio-ops.asxp.io
|
|
manage_etc_hosts: true
|
|
|
|
# Package management
|
|
package_update: true
|
|
package_upgrade: true
|
|
|
|
packages:
|
|
- fail2ban
|
|
- wget
|
|
- curl
|
|
- gpg
|
|
- rsync
|
|
- unzip
|
|
- htop
|
|
- ncdu
|
|
- tree
|
|
- git
|
|
- tmux
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- gnupg
|
|
- lsb-release
|
|
|
|
# Create users (docker group will be added later in runcmd)
|
|
users:
|
|
- name: asxpi
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
sudo: ['ALL=(ALL) NOPASSWD:ALL']
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC//ljrf65xbFyGmy/xeZs5GZvkmufCioqIGYguR3c8c/Ff9HiA4oMRT53Qs16KMuXRg62NusVQvJsvyPRSARpBFsoPiZ/YNBteWlqT1aVqeZwPOfUfFycQ2T8a9qtDnZ0WhamSlJMSAHQPkxXNA6S2ZE9y+dMzMc5qPeRwdsQmuvkxjual/35t9qTgCAG7LvKCKPJkLL5YpwLoqWYWTqSJ6RxNLTYNgIhJBZirzB5rNiFDDupnOuTKSpyRJNxyBSapNge5rCnGQYIeoJ4fi+FTi5wzjlC3hC0BN4Oc/zrm1nS9lyPXQS8KV5/vcQlPrvYZmv0LneeQ/gH/jJsSlwRp2qIatoASSfTlz1y1bOOYtPFojJPikXiXeZMCdlam1II6B94z1ybOIO8TqyKDVs4eHRFfYO72zv0sGsTr7t0C7+N9Wrpmhk38zdlLagZ6HO7KSyoAHm+fQc58fXmOhz4vfYrbmYRPgO0VO03fEb7lSFPPLaSseT0tayli05irJpc= asxpi@laptop
|
|
- name: deploy
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
sudo: ['ALL=(ALL) NOPASSWD:ALL']
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGTDPg3mV55lO8uBnvpcGRxJ2vMRP0qB3Pxhg+C8rwj9 asxpio-deploy
|
|
|
|
# SSH hardening
|
|
ssh_pwauth: false
|
|
disable_root: false
|
|
ssh_deletekeys: false
|
|
|
|
# Write files
|
|
write_files:
|
|
# Docker daemon configuration
|
|
- path: /etc/docker/daemon.json
|
|
content: |
|
|
{
|
|
"live-restore": true,
|
|
"storage-driver": "overlay2",
|
|
"log-opts": {
|
|
"max-size": "20m"
|
|
}
|
|
}
|
|
owner: root:root
|
|
permissions: '0644'
|
|
|
|
# Custom bash prompt for asxpi user
|
|
- path: /home/asxpi/.bashrc_custom
|
|
content: |
|
|
# Custom bash prompt styling for asxpio servers
|
|
export PS1="\[$(tput bold)\]\[\033[38;5;4m\][\[$(tput sgr0)\]\t\[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]]\[$(tput sgr0)\] \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\][\[$(tput sgr0)\]\u@\h \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]\w]\[$(tput sgr0)\] \[$(tput sgr0)\]\[$(tput bold)\]\[\033[38;5;4m\]\\$\[$(tput sgr0)\] \[$(tput sgr0)\]"
|
|
owner: root:root
|
|
permissions: '0644'
|
|
|
|
# SSH hardening config
|
|
- path: /etc/ssh/sshd_config.d/99-hardening.conf
|
|
content: |
|
|
PasswordAuthentication no
|
|
PermitRootLogin prohibit-password
|
|
PubkeyAuthentication yes
|
|
owner: root:root
|
|
permissions: '0644'
|
|
|
|
runcmd:
|
|
# Install Docker
|
|
- curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
|
|
- echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
- apt-get update
|
|
- apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
|
|
# Enable and start Docker
|
|
- systemctl enable docker
|
|
- systemctl start docker
|
|
|
|
# Add users to docker group (after docker is installed)
|
|
- usermod -aG docker asxpi
|
|
- usermod -aG docker deploy
|
|
|
|
# Enable and start fail2ban
|
|
- systemctl enable fail2ban
|
|
- systemctl start fail2ban
|
|
|
|
# Fix home directory ownership and setup bashrc for asxpi
|
|
- chown asxpi:asxpi /home/asxpi
|
|
- chown asxpi:asxpi /home/asxpi/.bashrc_custom
|
|
- cp /etc/skel/.bashrc /home/asxpi/.bashrc
|
|
- cp /etc/skel/.profile /home/asxpi/.profile
|
|
- chown asxpi:asxpi /home/asxpi/.bashrc /home/asxpi/.profile
|
|
- echo '[ -f ~/.bashrc_custom ] && source ~/.bashrc_custom' >> /home/asxpi/.bashrc
|
|
|
|
# Fix home directory ownership for deploy user
|
|
- chown deploy:deploy /home/deploy
|
|
|
|
# Create directory structure for services
|
|
- mkdir -p /opt/{traefik,forgejo,grafana,prometheus,loki,promtail,static-sites}
|
|
- mkdir -p /opt/traefik/config
|
|
- mkdir -p /opt/static-sites/{asxp.io,czsk.it,childfr.ee,builds,upload}
|
|
- chown -R asxpi:asxpi /opt/*
|
|
|
|
# Set up weekly Docker image pruning
|
|
- echo '0 3 * * 1 docker image prune -af > /var/log/docker-prune.log 2>&1' | crontab -
|
|
|
|
# Restart SSH to apply hardening
|
|
- systemctl restart sshd
|
|
|
|
final_message: |
|
|
==========================================
|
|
asxpio-ops server is ready!
|
|
==========================================
|
|
Hostname: asxpio-ops
|
|
OS: Debian 13 (trixie)
|
|
User: asxpi (sudo + docker access)
|
|
SSH: Key-only authentication enabled
|
|
Docker: Installed with compose plugin
|
|
|
|
You can now SSH: ssh asxpi@$(hostname -I | awk '{print $1}')
|
|
==========================================
|