#cloud-config
hostname: {{ cloud_init_hostname | default(nbops_hostname) }}
fqdn: {{ cloud_init_fqdn | default(nbops_fqdn) }}
manage_etc_hosts: true
timezone: {{ cloud_init_timezone | default(nbops_timezone) }}
locale: {{ cloud_init_locale | default(nbops_locale) }}

users:
  - default
  - name: {{ cloud_init_admin_user | default(nbops_admin_user) }}
    groups: {{ cloud_init_admin_groups | default(nbops_admin_groups) | join(',') }}
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    lock_passwd: true
    ssh_authorized_keys:
{% for key in cloud_init_ssh_authorized_keys | default([]) %}
      - {{ key }}
{% endfor %}

disable_root: true
ssh_pwauth: false

package_update: true
package_upgrade: true
packages:
  - ansible
  - apt-transport-https
  - bash-completion
  - ca-certificates
  - chrony
  - curl
  - git
  - gnupg
  - jq
  - locales
  - needrestart
  - python3
  - python3-apt
  - qemu-guest-agent
  - rsync
  - sudo
  - ufw
  - unattended-upgrades
  - vim

write_files:
  - path: /etc/ssh/sshd_config.d/10-nbops-cloud-init.conf
    owner: root:root
    permissions: "0644"
    content: |
      PermitRootLogin no
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      PubkeyAuthentication yes
      UseDNS no
      X11Forwarding no
  - path: /etc/docker/daemon.json
    owner: root:root
    permissions: "0644"
    content: |
      {
        "log-driver": "local",
        "live-restore": true,
        "storage-driver": "overlay2",
        "iptables": true
      }
  - path: /etc/sysctl.d/99-nbops.conf
    owner: root:root
    permissions: "0644"
    content: |
      net.ipv4.ip_forward = 1
      net.ipv6.conf.all.forwarding = 1
      fs.inotify.max_user_watches = 1048576
      fs.inotify.max_user_instances = 1024

runcmd:
  - install -m 0755 -d /etc/apt/keyrings
  - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
  - chmod a+r /etc/apt/keyrings/docker.asc
  - sh -c 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list'
  - apt-get update
  - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  - mkdir -p /srv/docker /srv/config /srv/backups /srv/data /srv/media /etc/pki/internal/private /etc/pki/internal/certs /usr/local/share/ca-certificates/internal
  - chmod 0700 /etc/pki/internal/private
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow {{ cloud_init_ssh_port | default(nbops_ssh_port) }}/tcp
  - ufw --force enable
  - systemctl enable --now chrony qemu-guest-agent docker unattended-upgrades
  - sysctl --system
  - ansible-galaxy collection install -r {{ cloud_init_repo_path | default('/opt/nbops-ansible') }}/requirements.yml || true
  - ansible-pull -U {{ cloud_init_repo_url }} -i localhost, -c local {{ cloud_init_playbook | default('playbooks/pull.yml') }} --accept-host-key

final_message: "nbops cloud-init bootstrap complete after $UPTIME seconds"