110 lines
3.7 KiB
Django/Jinja
110 lines
3.7 KiB
Django/Jinja
#cloud-config
|
|
hostname: {{ cloud_init_hostname | default(nbops_hostname) }}
|
|
fqdn: {{ cloud_init_fqdn | default(nbops_fqdn) }}
|
|
manage_etc_hosts: true
|
|
timezone: {{ cloud_init_timezone | default(nbops_timezone) }}
|
|
locale: {{ cloud_init_locale | default(nbops_locale) }}
|
|
{% set serial_console_enabled = cloud_init_serial_console_enabled | default(true) %}
|
|
{% set serial_console_tty = cloud_init_serial_console_tty | default('ttyS0') %}
|
|
{% set serial_console_term = cloud_init_serial_console_term | default('xterm-256color') %}
|
|
|
|
users:
|
|
- default
|
|
- name: {{ cloud_init_admin_user | default(nbops_admin_user) }}
|
|
groups: {{ cloud_init_admin_groups | default(nbops_admin_groups) | join(',') }}
|
|
shell: /bin/bash
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
{% for key in cloud_init_ssh_authorized_keys | default([]) %}
|
|
- {{ key }}
|
|
{% endfor %}
|
|
|
|
disable_root: true
|
|
ssh_pwauth: false
|
|
|
|
package_update: true
|
|
package_upgrade: true
|
|
packages:
|
|
- ansible
|
|
- apt-transport-https
|
|
- bash-completion
|
|
- ca-certificates
|
|
- chrony
|
|
- curl
|
|
- git
|
|
- gnupg
|
|
- jq
|
|
- locales
|
|
- needrestart
|
|
- python3
|
|
- python3-apt
|
|
- qemu-guest-agent
|
|
- rsync
|
|
- sudo
|
|
- ufw
|
|
- unattended-upgrades
|
|
- vim
|
|
|
|
write_files:
|
|
- path: /etc/ssh/sshd_config.d/10-nbops-cloud-init.conf
|
|
owner: root:root
|
|
permissions: "0644"
|
|
content: |
|
|
PermitRootLogin no
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PubkeyAuthentication yes
|
|
UseDNS no
|
|
X11Forwarding no
|
|
- path: /etc/docker/daemon.json
|
|
owner: root:root
|
|
permissions: "0644"
|
|
content: |
|
|
{
|
|
"log-driver": "local",
|
|
"live-restore": true,
|
|
"storage-driver": "overlay2",
|
|
"iptables": true
|
|
}
|
|
- path: /etc/sysctl.d/99-nbops.conf
|
|
owner: root:root
|
|
permissions: "0644"
|
|
content: |
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|
|
fs.inotify.max_user_watches = 1048576
|
|
fs.inotify.max_user_instances = 1024
|
|
{% if serial_console_enabled | bool %}
|
|
- path: /etc/systemd/system/serial-getty@{{ serial_console_tty }}.service.d/10-nbops-xterm.conf
|
|
owner: root:root
|
|
permissions: "0644"
|
|
content: |
|
|
[Service]
|
|
Environment=TERM={{ serial_console_term }}
|
|
{% endif %}
|
|
|
|
runcmd:
|
|
- install -m 0755 -d /etc/apt/keyrings
|
|
- curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
|
|
- chmod a+r /etc/apt/keyrings/docker.asc
|
|
- sh -c 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list'
|
|
- apt-get update
|
|
- apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
- mkdir -p /srv/docker /srv/config /srv/backups /srv/data /srv/media /etc/pki/internal/private /etc/pki/internal/certs /usr/local/share/ca-certificates/internal
|
|
- chmod 0700 /etc/pki/internal/private
|
|
- ufw default deny incoming
|
|
- ufw default allow outgoing
|
|
- ufw allow {{ cloud_init_ssh_port | default(nbops_ssh_port) }}/tcp
|
|
- ufw --force enable
|
|
- systemctl enable --now chrony qemu-guest-agent docker unattended-upgrades
|
|
{% if serial_console_enabled | bool %}
|
|
- systemctl daemon-reload
|
|
- systemctl enable --now serial-getty@{{ serial_console_tty }}.service
|
|
{% endif %}
|
|
- sysctl --system
|
|
- ansible-galaxy collection install -r {{ cloud_init_repo_path | default('/opt/nbops-ansible') }}/requirements.yml || true
|
|
- ansible-pull -U {{ cloud_init_repo_url }} -i localhost, -c local {{ cloud_init_playbook | default('playbooks/pull.yml') }} --accept-host-key
|
|
|
|
final_message: "nbops cloud-init bootstrap complete after $UPTIME seconds"
|