Skip to content

Instantly share code, notes, and snippets.

@Bouni

Bouni/cloud-init.yml

Last active May 21, 2025 13:42
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Bouni/99bcd9968874839e3c8d19542cdda945 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Bouni/99bcd9968874839e3c8d19542cdda945 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Bouni revised this gist May 21, 2025. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions cloud-init.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -28,6 +28,7 @@ packages:
    - curl
    - neovim
    - wget
    - unzip
    package_update: true
    package_upgrade: true
    runcmd:
  2. Bouni revised this gist May 21, 2025. 1 changed file with 1 addition and 4 deletions.
    5 changes: 1 addition & 4 deletions cloud-init.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -81,10 +81,7 @@ runcmd:
    - chmod a+r /etc/apt/keyrings/docker.asc

    # Add Docker’s repository
    - echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
    sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
    - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list

    # Install Docker and Docker Compose plugin
    - apt update
  3. Bouni renamed this gist May 21, 2025. 1 changed file with 8 additions and 7 deletions.
    15 changes: 8 additions & 7 deletions cloud-init → cloud-init.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -73,21 +73,22 @@ runcmd:
    - ufw allow 443

    # Install prerequisites for Docker
    - apt-get install -y ca-certificates curl gnupg lsb-release
    - apt install -y ca-certificates curl

    # Add Docker’s official GPG key
    - install -m 0755 -d /etc/apt/keyrings
    - curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    - chmod a+r /etc/apt/keyrings/docker.gpg
    - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
    - chmod a+r /etc/apt/keyrings/docker.asc

    # Add Docker’s repository
    - echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
    $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
    sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

    # Install Docker and Docker Compose plugin
    - apt-get update
    - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
    - apt update
    - apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

    # Enable Docker on boot
    - systemctl enable docker
  4. Bouni revised this gist May 21, 2025. 1 changed file with 16 additions and 0 deletions.
    16 changes: 16 additions & 0 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -93,5 +93,21 @@ runcmd:
    - systemctl enable docker
    - systemctl start docker

    # Add docker group and add user
    - groupadd docker
    - usermod -aG docker user

    # Configure max log size for docker logs
    - |
    cat <<EOF > /etc/docker/daemon.json
    {
    "log-driver": "local",
    "log-opts": {
    "max-size": "10m",
    "max-file": "3"
    }
    }
    EOF

    - reboot

  5. Bouni revised this gist May 21, 2025. No changes.
  6. Bouni revised this gist May 21, 2025. 1 changed file with 7 additions and 2 deletions.
    9 changes: 7 additions & 2 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -37,8 +37,13 @@ runcmd:
    - update-locale LANG=de_DE.UTF-8
    - setupcon

    # install OhMyZsh
    - sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
    # install oh-my-zsh for root and user
    - sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended
    - sed -i 's/robbyrussell/agnoster/' /root/.zshrc
    - runuser -l user -c 'sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended'
    - sed -i 's/robbyrussell/agnoster/' /home/user/.zshrc
    - cp -r /home/user/.oh-my-zsh /etc/skel/
    - cp /home/user/.zshrc /etc/skel/

    # Harden SSH
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
  7. Bouni revised this gist May 21, 2025. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -37,6 +37,9 @@ runcmd:
    - update-locale LANG=de_DE.UTF-8
    - setupcon

    # install OhMyZsh
    - sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

    # Harden SSH
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
    - systemctl enable fail2ban
  8. Bouni revised this gist May 21, 2025. 1 changed file with 8 additions and 7 deletions.
    15 changes: 8 additions & 7 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -53,7 +53,14 @@ runcmd:
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
    - sed -i '$a AllowUsers user' /etc/ssh/sshd_config


    # Copy preset SSH keys (via Hetzner Cloud UI) from root to user
    - mkdir -p /home/user/.ssh
    - cp /root/.ssh/authorized_keys /home/user/.ssh/authorized_keys
    - chown -R user:user /home/user/.ssh
    - chmod 0700 /home/user/.ssh
    - chmod 0600 /home/user/.ssh/authorized_keys

    # Allow HTTPS traffic
    - ufw allow 443

    @@ -79,10 +86,4 @@ runcmd:
    - systemctl start docker

    - reboot

    late_command:

    # Copy preset SSH keys (via Hetzner Cloud UI) from root to user
    - cp /root/.ssh/authorized_keys /home/user/.ssh/authorized_keys
    - chown user:user /home/user/.ssh/authorized_keys
    - chmod 0600 /home/user/.ssh/authorized_keys
  9. Bouni revised this gist May 21, 2025. 1 changed file with 9 additions and 7 deletions.
    16 changes: 9 additions & 7 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -53,12 +53,7 @@ runcmd:
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
    - sed -i '$a AllowUsers user' /etc/ssh/sshd_config

    # Copy preset SSH keys (via Hetzner Cloud UI) from root to user
    - cp /root/.ssh/authorized_keys /home/user/.ssh/authorized_keys
    - chown user:user /home/user/.ssh/authorized_keys
    - chmod 0600 /home/user/.ssh/authorized_keys


    # Allow HTTPS traffic
    - ufw allow 443

    @@ -83,4 +78,11 @@ runcmd:
    - systemctl enable docker
    - systemctl start docker

    - reboot
    - reboot

    late_command:

    # Copy preset SSH keys (via Hetzner Cloud UI) from root to user
    - cp /root/.ssh/authorized_keys /home/user/.ssh/authorized_keys
    - chown user:user /home/user/.ssh/authorized_keys
    - chmod 0600 /home/user/.ssh/authorized_keys
  10. Bouni revised this gist May 21, 2025. 1 changed file with 12 additions and 5 deletions.
    17 changes: 12 additions & 5 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -18,10 +18,9 @@ users:
    - name: user
    groups: users, admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
    - <public_ssh_key>
    shell: /bin/zsh
    packages:
    - zsh
    - fail2ban
    - ufw
    - tree
    @@ -38,11 +37,10 @@ runcmd:
    - update-locale LANG=de_DE.UTF-8
    - setupcon

    # harden SSH
    # Harden SSH
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
    - systemctl enable fail2ban
    - ufw allow 2222
    - ufw allow 443
    - ufw enable
    - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
    @@ -55,6 +53,15 @@ runcmd:
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
    - sed -i '$a AllowUsers user' /etc/ssh/sshd_config

    # Copy preset SSH keys (via Hetzner Cloud UI) from root to user
    - cp /root/.ssh/authorized_keys /home/user/.ssh/authorized_keys
    - chown user:user /home/user/.ssh/authorized_keys
    - chmod 0600 /home/user/.ssh/authorized_keys

    # Allow HTTPS traffic
    - ufw allow 443

    # Install prerequisites for Docker
    - apt-get install -y ca-certificates curl gnupg lsb-release

  11. Bouni revised this gist May 21, 2025. 1 changed file with 24 additions and 2 deletions.
    26 changes: 24 additions & 2 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -29,15 +29,16 @@ packages:
    - curl
    - neovim
    - wget
    - docker
    - docker-compose-plugin
    package_update: true
    package_upgrade: true
    runcmd:
    # Configure Gemran locale and keyboard
    - sed -i 's/^# de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen
    - locale-gen de_DE.UTF-8
    - update-locale LANG=de_DE.UTF-8
    - setupcon

    # harden SSH
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
    - systemctl enable fail2ban
    - ufw allow 2222
    @@ -54,4 +55,25 @@ runcmd:
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
    - sed -i '$a AllowUsers user' /etc/ssh/sshd_config
    # Install prerequisites for Docker
    - apt-get install -y ca-certificates curl gnupg lsb-release

    # Add Docker’s official GPG key
    - install -m 0755 -d /etc/apt/keyrings
    - curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    - chmod a+r /etc/apt/keyrings/docker.gpg

    # Add Docker’s repository
    - echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
    $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

    # Install Docker and Docker Compose plugin
    - apt-get update
    - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

    # Enable Docker on boot
    - systemctl enable docker
    - systemctl start docker

    - reboot
  12. Bouni revised this gist May 21, 2025. 1 changed file with 19 additions and 0 deletions.
    19 changes: 19 additions & 0 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,19 @@
    #cloud-config

    locale: de_DE.UTF-8

    keyboard:
    layout: de
    variant: ""
    model: pc105

    write_files:
    - path: /etc/default/locale
    content: |
    LANG=de_DE.UTF-8
    LANGUAGE=de_DE:de
    LC_ALL=de_DE.UTF-8

    users:
    - name: user
    groups: users, admin
    @@ -19,6 +34,10 @@ packages:
    package_update: true
    package_upgrade: true
    runcmd:
    - sed -i 's/^# de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen
    - locale-gen de_DE.UTF-8
    - update-locale LANG=de_DE.UTF-8
    - setupcon
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
    - systemctl enable fail2ban
    - ufw allow 2222
  13. Bouni revised this gist May 21, 2025. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -4,6 +4,8 @@ users:
    groups: users, admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
    - <public_ssh_key>
    packages:
    - fail2ban
    - ufw
  14. Bouni revised this gist May 21, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -27,7 +27,7 @@ runcmd:
    - sed -i -e '/^\(#\|\)Port/s/^.*$/Port 2222/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)KbdInteractiveAuthentication/s/^.*$/KbdInteractiveAuthentication no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)ChallengeResponseAuthentication/s/^.*$/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 10/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
  15. Bouni created this gist May 21, 2025.
    36 changes: 36 additions & 0 deletions cloud-init
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,36 @@
    #cloud-config
    users:
    - name: user
    groups: users, admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    packages:
    - fail2ban
    - ufw
    - tree
    - git
    - curl
    - neovim
    - wget
    - docker
    - docker-compose-plugin
    package_update: true
    package_upgrade: true
    runcmd:
    - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
    - systemctl enable fail2ban
    - ufw allow 2222
    - ufw allow 443
    - ufw enable
    - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)Port/s/^.*$/Port 2222/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)KbdInteractiveAuthentication/s/^.*$/KbdInteractiveAuthentication no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)ChallengeResponseAuthentication/s/^.*$/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
    - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
    - sed -i '$a AllowUsers user' /etc/ssh/sshd_config
    - reboot