57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
#cloud-config
|
|
#
|
|
# Generic base-host bootstrap -- Alpine, Debian, or Alma Linux.
|
|
#
|
|
# On first boot this:
|
|
# 1. Installs prerequisites (bash, git, curl) for whichever distro this is.
|
|
# 2. Clones this repo to /opt/automations.
|
|
# 3. Sets the hostname per the Network Domain Name Schema and installs the
|
|
# shared MOTD banner (scripts/setup-host.sh).
|
|
# 4. Seeds root's authorized_keys from globals/ (URL-preferred).
|
|
# 5. Applies SSH hardening: key-only auth, post-quantum KEX, sshguard
|
|
# (scripts/harden-ssh.sh).
|
|
#
|
|
# Fill in REPO_URL, HOST, and the other values, then paste as instance
|
|
# user-data. For a bastion host use jumphost.yml instead.
|
|
#
|
|
# NOTE: harden-ssh.sh prints a freshly generated root private key to stdout,
|
|
# which lands in the cloud provider's console/serial log. Either capture it
|
|
# from there, or rely on the keys seeded from globals/ and ignore it.
|
|
|
|
runcmd:
|
|
- |
|
|
set -e
|
|
# ===== config =====
|
|
REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
|
|
REPO_BRANCH=main
|
|
HOST=sto-1 # <svc>-<n>; FQDN becomes HOST.BASE_DOMAIN
|
|
BASE_DOMAIN=srvno.de
|
|
DATACENTER="Globally Everywhere"
|
|
SSH_PORT=22
|
|
ALLOWED_IP= # optional: whitelist your client IP in sshguard
|
|
AUTO_UPDATE=1 # schedule daily unattended updates (0 to skip)
|
|
# ==================
|
|
|
|
# Prerequisites (OS-agnostic).
|
|
if command -v apk >/dev/null 2>&1; then apk add --no-cache bash git curl
|
|
elif command -v apt-get >/dev/null 2>&1; then apt-get update -qq && apt-get install -y -qq bash git curl
|
|
elif command -v dnf >/dev/null 2>&1; then dnf install -y -q bash git curl
|
|
fi
|
|
|
|
git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
|
|
cd /opt/automations
|
|
|
|
# Hostname + shared MOTD.
|
|
HOST="$HOST" BASE_DOMAIN="$BASE_DOMAIN" DATACENTER="$DATACENTER" bash scripts/setup-host.sh
|
|
|
|
# Seed root's authorized_keys from globals/ (SSH_KEYS_URL or authorized_keys).
|
|
. scripts/lib.sh && load_globals \
|
|
&& install -d -m 700 /root/.ssh \
|
|
&& resolve_ssh_keys >> /root/.ssh/authorized_keys || true
|
|
sort -u /root/.ssh/authorized_keys -o /root/.ssh/authorized_keys 2>/dev/null || true
|
|
|
|
# SSH hardening (key-only, PQ KEX, sshguard).
|
|
SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" FORCE=1 bash scripts/harden-ssh.sh
|