You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
103 lines
3.2 KiB
103 lines
3.2 KiB
#cloud-config
|
|
# vim: syntax=yaml
|
|
|
|
resize_rootfs: true
|
|
|
|
users:
|
|
- name: nicolas
|
|
gecos: Nicolas MASSE
|
|
groups: wheel
|
|
lock_passwd: false
|
|
passwd: $6$XUTB20jVVXIqh78k$L1A9Lft5JlbOtNbeDP.fOZ5giLl09LfJGGCon5uwtsIhPJoNkj4SIk08Rb6vSowOps2ik5tlUwT2ZOZ6jjr7.0
|
|
ssh_authorized_keys:
|
|
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR1tt58X0+vbvsCR12gMAqr+g7vjt1Fx/qqz9EiboIs nicolas@localhost.localdomain
|
|
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFW62WJXI1ZCMfNA4w0dMpL0fsldhbEfULNGIUB0nQui nmasse@localhost.localdomain
|
|
|
|
packages:
|
|
# Useful tools
|
|
- net-tools
|
|
- hdparm
|
|
- iptraf
|
|
- iotop
|
|
- vim-enhanced
|
|
- tmux
|
|
- rsync
|
|
- tree
|
|
- unzip
|
|
- tar
|
|
- tcpdump
|
|
- telnet
|
|
- strace
|
|
- bind-utils
|
|
# Load Balancer
|
|
- haproxy
|
|
- firewalld
|
|
|
|
# Uncomment the following lines for HTTP proxy support
|
|
#
|
|
# bootcmd:
|
|
# - |
|
|
# cloud-init-per once env sh -c "mkdir -p /etc/systemd/system/cloud-config.service.d &&
|
|
# mkdir -p /etc/systemd/system/cloud-final.service.d && { cat > /etc/cloud/env <<-EOF
|
|
# http_proxy=http://admin.itix.lab:3128
|
|
# https_proxy=http://admin.itix.lab:3128
|
|
# EOF
|
|
# } && { cat > /etc/systemd/system/cloud-config.service.d/override.conf <<-EOF
|
|
# [Service]
|
|
# EnvironmentFile=/etc/cloud/env
|
|
# EOF
|
|
# } && { cat > /etc/systemd/system/cloud-final.service.d/override.conf <<-EOF
|
|
# [Service]
|
|
# EnvironmentFile=/etc/cloud/env
|
|
# EOF
|
|
# } && systemctl daemon-reload"
|
|
|
|
runcmd:
|
|
# Enable KVM virsh console access
|
|
- [ "systemctl", "enable", "serial-getty@ttyS0.service" ]
|
|
- [ "systemctl", "start", "--no-block", "serial-getty@ttyS0.service" ]
|
|
# Disable SSH password authentication
|
|
- [ "sed", "-i.post-install", "-e", "s/PasswordAuthentication yes/PasswordAuthentication no/", "/etc/ssh/sshd_config" ]
|
|
- [ "systemctl", "restart", "sshd" ]
|
|
# Enable sudo without password
|
|
- [ "sed", "-i.post-install", "-e", "s/^%wheel\tALL=(ALL)\tALL/%wheel ALL=(ALL) NOPASSWD: ALL/", "/etc/sudoers" ]
|
|
# Fix file permissions
|
|
- [ "chown", "-R", "nicolas:nicolas", "/home/nicolas" ]
|
|
# Configure HAProxy
|
|
- [ "setsebool", "-P", "haproxy_connect_any=1" ]
|
|
- [ "systemctl", "enable", "haproxy" ]
|
|
- [ "systemctl", "restart", "haproxy" ]
|
|
- [ "firewall-offline-cmd", "--add-service=http" ]
|
|
- [ "firewall-offline-cmd", "--add-service=https" ]
|
|
- [ "firewall-offline-cmd", "--add-port=6443/tcp" ]
|
|
- [ "firewall-offline-cmd", "--add-port=22623/tcp" ]
|
|
- [ "systemctl", "enable", "firewalld" ]
|
|
- [ "systemctl", "start", "firewalld" ]
|
|
|
|
write_files:
|
|
- path: /root/.bashrc
|
|
# PS1='\[\033[01;31m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]# '
|
|
content: |
|
|
UFMxPSdcW1wwMzNbMDE7MzFtXF1cdUBcaFxbXDAzM1swMG1cXTpcW1wwMzNbMDE7MzRtXF1cd1xb
|
|
XDAzM1swMG1cXSMgJwo=
|
|
encoding: base64
|
|
append: true
|
|
|
|
- path: /etc/skel/.bashrc
|
|
# PS1='\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
|
|
content: |
|
|
UFMxPSdcW1wwMzNbMDE7MzJtXF1cdUBcaFxbXDAzM1swMG1cXTpcW1wwMzNbMDE7MzRtXF1cd1xb
|
|
XDAzM1swMG1cXVwkICcK
|
|
encoding: base64
|
|
append: true
|
|
|
|
- path: /home/nicolas/.bashrc
|
|
# PS1='\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
|
|
content: |
|
|
UFMxPSdcW1wwMzNbMDE7MzJtXF1cdUBcaFxbXDAzM1swMG1cXTpcW1wwMzNbMDE7MzRtXF1cd1xb
|
|
XDAzM1swMG1cXVwkICcK
|
|
encoding: base64
|
|
append: true
|
|
|
|
- path: /etc/haproxy/haproxy.cfg
|
|
content: ${jsonencode(haproxy_cfg)}
|
|
|