prime8dev

commit 2db510d6f99937a9dd42a9e753655dbd665e1e1d
parent deb7ab1ddf1f423b9149128294315a12efac3e18
Author: Damian Myrda <damian@prime8.dev>
Date:   Thu, 29 Jan 2026 17:39:23 -0600

feat: configure SSH on port 2222 with port 22 for GitLab

Diffstat:
M
cloud_config.yml
 | 
7
++++---

1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/cloud_config.yml b/cloud_config.yml
@@ -1,4 +1,3 @@
-#cloud-config
 users:
   - name: damian
     groups: users, admin
@@ -21,6 +20,7 @@ ssh_pwauth: false
 write_files:
   - path: /etc/ssh/sshd_config.d/ssh-hardening.conf
     content: |
+      Port 2222
       PermitRootLogin no
       PasswordAuthentication no
       KbdInteractiveAuthentication no
@@ -38,12 +38,13 @@ runcmd:
   - systemctl start systemd-timesyncd || true
 
   # Fail2ban
-  - printf "[sshd]\nenabled = true\nport = ssh\nbanaction = iptables-multiport\nmaxretry = 3\nbantime = 3600\nfindtime = 600\n" > /etc/fail2ban/jail.local
+  - printf "[sshd]\nenabled = true\nport = 2222\nbanaction = iptables-multiport\nmaxretry = 3\nbantime = 3600\nfindtime = 600\n" > /etc/fail2ban/jail.local
   - systemctl enable fail2ban
   - systemctl restart fail2ban || true
 
   # Firewall
-  - ufw allow 22/tcp # SSH
+  - ufw allow 2222/tcp # SSH (Admin)
+  - ufw allow 22/tcp # SSH (GitLab)
   - ufw allow 80/tcp # HTTP
   - ufw allow 443/tcp # HTTPS
   - ufw allow 3000/tcp # Dokploy UI