#cloud-config
#
# Ergo (IRC server) -- harden SSH, then deploy, on a fresh host.
#
# Fill in REPO_URL and the values in the runcmd block, then paste this as the
# instance user-data. DNS for ERGO_DOMAIN must point at this host and ports
# 80/443 must be reachable before boot, or the Let's Encrypt cert request fails
# (Ergo then keeps serving a self-signed cert until certsync catches up).
# 6697/tcp (IRC over TLS) is opened on the host firewall as well.

packages:
  - git

runcmd:
  - hostnamectl set-hostname irc || true
  - |
    set -e
    REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
    REPO_BRANCH=main
    HARDEN_SSH=1                 # harden SSH on this fresh VM (set 0 to skip)
    SSH_PORT=22
    ALLOWED_IP=                  # optional: whitelist your client IP in sshguard
    git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
    cd /opt/automations

    # Harden SSH first (PQ KEX, key-only auth, sshguard + deny-by-default
    # firewall). Because the Ergo stack uses host networking, that firewall
    # genuinely governs 80/443/6697 -- deploy.sh registers them with it.
    if [ "$HARDEN_SSH" = 1 ]; then
      SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" SKIP_PROMPTS=1 FORCE=1 \
        bash scripts/harden-ssh.sh
    fi

    # Deploy Ergo. The admin oper password is generated and stored in
    # /srv/ergo/secrets/admin.pass (also printed to this log once).
    ERGO_DOMAIN=irc.example.com \
    ACME_EMAIL=admin@example.com \
    NETWORK_NAME=ExampleNet \
    HISTORY=sqlite \
    PLAINTEXT=0 \
    UPDATE_POLICY=latest \
    SKIP_PROMPTS=1 \
    bash deployments/ergo/deploy.sh