#cloud-config
#
# Authoritative Knot DNS node — harden SSH, then deploy, on a fresh Alpine host.
# Native (no container): Knot binds :53 directly. Alpine only.
#
# Fill in REPO_URL and the values in the runcmd block, then paste this as the
# instance user-data.
#
# A SECONDARY needs the primary's TSIG secrets, byte for byte, or nothing will
# ever transfer — take them from the primary's deploy summary (or its
# /etc/knot/secrets.conf) and paste them below. A PRIMARY generates its own and
# prints them once; capture them from the console before they scroll away.

packages:
  - git

runcmd:
  - hostnamectl set-hostname anycast-dns-3 || true
  - |
    set -e
    REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
    REPO_BRANCH=main
    HARDEN_SSH=1                 # harden SSH on this fresh VM (set 0 to skip)
    SSH_PORT=22
    ALLOWED_IP=                  # optional: whitelist your client IP in sshguard
    git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
    cd /opt/automations

    # Harden SSH: PQ KEX, key-only auth, sshguard. Seeds root from
    # globals/authorized_keys (or SSH_KEYS_URL).
    if [ "$HARDEN_SSH" = 1 ]; then
      SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" SKIP_PROMPTS=1 FORCE=1 \
        bash scripts/harden-ssh.sh
    fi

    # Host firewall, so deploy.sh's 53/tcp+udp drop-in has somewhere to register.
    SKIP_PROMPTS=1 FORCE=1 bash scripts/harden-firewall.sh || true

    # Deploy the node. ROLE=primary holds and signs the zones; ROLE=secondary
    # transfers them in and signs nothing. NODE_ID becomes server.identity and
    # NSID, so make it the estate's node name.
    ROLE=secondary \
    NODE_ID=ANYCAST-DNS-3 \
    PRIMARY_ADDR=10.1.24.64 \
    LISTEN='0.0.0.0@53, ::@53' \
    DATACENTER='Stockholm SE' \
    PEERS='10.1.24.64 10.1.24.68' \
    TSIG_AUTHORITIVE=REPLACE_WITH_THE_PRIMARYS_SECRET \
    TSIG_ADMIN=REPLACE_WITH_THE_PRIMARYS_SECRET \
    SKIP_PROMPTS=1 \
    bash deployments/knot-dns/deploy.sh

    # The node now serves NO zones — DNS policy and zone data are delivered by
    # the `dns` repo's pipeline. Add this node there (and to the primary's
    # remotes.conf, unless a catalog zone picks it up) to put it in rotation.