#cloud-config
#
# Pocket-ID (OIDC provider) — unattended deploy on a fresh Alpine host.
#
# Fill in REPO_URL and the values in the runcmd block, then paste this as the
# instance user-data. DNS for POCKETID_DOMAIN must point at this host and
# ports 80/443 must be reachable before boot, or the LE cert request fails.

packages:
  - git

runcmd:
  - hostnamectl set-hostname pocket-id || true
  - |
    set -e
    REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
    REPO_BRANCH=main
    git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
    cd /opt/automations

    # Optional: install shared admin SSH keys from globals/ for root before deploy
    #   . scripts/lib.sh && load_globals \
    #     && install -d -m700 /root/.ssh && resolve_ssh_keys >> /root/.ssh/authorized_keys

    # Optional: harden SSH first (prints a fresh root key — capture it!)
    #   SKIP_PROMPTS=1 FORCE=1 bash scripts/harden-ssh.sh

    POCKETID_DOMAIN=id.example.com \
    ACME_EMAIL=admin@example.com \
    SKIP_PROMPTS=1 \
    bash deployments/pocket-id/deploy.sh