57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
#cloud-config
|
|
#
|
|
# WebFinger + redirect — unattended deploy on a fresh Alpine host.
|
|
#
|
|
# Fill in REPO_URL and the values in the runcmd block, then paste this as the
|
|
# instance user-data. DNS for BASE_DOMAIN must point at this host and ports
|
|
# 80/443 must be reachable before boot, or the LE cert request fails.
|
|
|
|
packages:
|
|
- git
|
|
|
|
runcmd:
|
|
- hostnamectl set-hostname webfinger || true
|
|
- |
|
|
set -e
|
|
REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
|
|
REPO_BRANCH=main
|
|
git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
|
|
cd /opt/automations
|
|
|
|
# Optional: install shared admin SSH keys from globals/ for root before deploy
|
|
# . scripts/lib.sh && load_globals \
|
|
# && install -d -m700 /root/.ssh && resolve_ssh_keys >> /root/.ssh/authorized_keys
|
|
|
|
# Optional: harden SSH first (prints a fresh root key — capture it!)
|
|
# SKIP_PROMPTS=1 FORCE=1 bash scripts/harden-ssh.sh
|
|
|
|
BASE_DOMAIN=example.com \
|
|
ISSUER_URL=https://auth.example.com \
|
|
REDIRECT_URL=https://example.org \
|
|
ACME_EMAIL=admin@example.com \
|
|
SKIP_PROMPTS=1 \
|
|
bash deployments/webfinger/deploy.sh
|