prime8dev

commit c278c25eb94032d9a81c40c5b2bea4862b42ff6f
parent 1d06ab0749a439e09877028235a84e8b512c1ea8
Author: Damian Myrda <damian@prime8.dev>
Date:   Mon, 16 Feb 2026 11:28:28 -0600

feat(cloud-config): enhance server setup script

- Add strict bash options with input validation
- Make swap size, timezone, and Tailscale configurable
- Simplify firewall rules to Tailscale-only access
- Remove fallback error suppression for stricter execution
- Change SSH back to port 22 with Tailscale security

Diffstat:
M
generate_cloud_config.sh
 | 
80
++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------

1 file changed, 55 insertions(+), 25 deletions(-)
diff --git a/generate_cloud_config.sh b/generate_cloud_config.sh
@@ -1,14 +1,45 @@
 #!/bin/bash
-set -e
+set -eou pipefail
+
+read -rp "Enter your username: " USERNAME
+[[ -z "${USERNAME:-}" ]] && {
+  echo "Error: Username required" >&2
+  exit 1
+}
+read -rp "Enter your SSH public key: " SSH_KEY
+[[ -z "${SSH_KEY:-}" ]] && {
+  echo "Error: SSH key required" >&2
+  exit 1
+}
+echo
+
+read -rp "Enter your hostname: " HOSTNAME
+[[ -z "${HOSTNAME:-}" ]] && {
+  echo "Error: Hostname required" >&2
+  exit 1
+}
+read -rp "Enter your domain: " DOMAIN
+echo
+
+read -rp "Enter swap size in GB [2]: " SWAP_GB
+SWAP_GB=${SWAP_GB:-2}
+echo
 
-read -p "Enter your name: " USERNAME
-read -p "Enter your SSH public key: " SSH_KEY
+read -rp "Enter your email address: " EMAIL_ADDRESS
+read -rsp "Enter your email password: " EMAIL_PASSWORD
 echo
-read -p "Enter your hostname: " HOSTNAME
-read -p "Enter your domain: " DOMAIN
 echo
-read -p "Enter your email address: " EMAIL_ADDRESS
-read -s -p "Enter your email password: " EMAIL_PASSWORD
+
+read -rsp "Enter Tailscale auth key: " TAILSCALE_AUTH_KEY
+[[ -z "${TAILSCALE_AUTH_KEY:-}" ]] && {
+  echo "Error: Tailscale auth key required" >&2
+  exit 1
+}
+echo
+echo
+
+read -rp "Enter timezone [America/Los_Angeles]: " TIMEZONE
+TIMEZONE=${TIMEZONE:-America/Los_Angeles}
 echo
 
 cat <<EOF
@@ -41,7 +72,7 @@ ssh_pwauth: false
 write_files:
   - path: /etc/ssh/sshd_config.d/ssh-hardening.conf
     content: |
-      Port 2222
+      Port 22
       PermitRootLogin no
       PasswordAuthentication no
       KbdInteractiveAuthentication no
@@ -112,40 +143,39 @@ write_files:
     content: $HOSTNAME
 
 runcmd:
-  - hostnamectl set-hostname $HOSTNAME || true
+  - hostnamectl set-hostname $HOSTNAME
 
-  - timedatectl set-timezone America/Los_Angeles || true
+  - timedatectl set-timezone $TIMEZONE
   - systemctl enable --now systemd-timesyncd
 
   - |
-    printf "[sshd]\nenabled = true\nport = 2222\nbanaction = iptables-multiport\nmaxretry = 3\nbantime = 3600\nfindtime = 600\n" > /etc/fail2ban/jail.local
+    printf "[sshd]\nenabled = true\nport = 22\nbanaction = iptables-multiport\nmaxretry = 3\nbantime = 3600\nfindtime = 600\n" > /etc/fail2ban/jail.local
   - systemctl enable --now fail2ban
 
   - ufw default deny incoming
   - ufw default allow outgoing
-  - ufw allow 2222/tcp comment "SSH hardened port"
-  - ufw allow 22/tcp comment "SSH GitLab"
-  - ufw allow 80/tcp comment "HTTP - Traefik"
-  - ufw allow 443/tcp comment "HTTPS - Traefik"
-  - ufw allow 3000/tcp comment "Dokploy UI - temporary, close after setup"
+  - ufw allow in on tailscale0
   - ufw --force enable
 
-  - systemctl restart sshd || systemctl restart ssh || true
+  - systemctl restart sshd || systemctl restart ssh
 
-  - ln -sf /root/.msmtprc /etc/msmtprc || true
+  - ln -sf /root/.msmtprc /etc/msmtprc
   - grep -q "mta=/usr/bin/msmtp" /etc/mail.rc || echo "set mta=/usr/bin/msmtp" >> /etc/mail.rc
   - echo "Automatic security updates enabled. Emails sent to $EMAIL_ADDRESS on changes. Reboots at 00:00 PT if needed." > /etc/motd.d/99-security-updates
-  - echo "Server first boot for $HOSTNAME" | mail -s "Server Setup Test" $EMAIL_ADDRESS || true
+  - echo "Server first boot for $HOSTNAME" | mail -s "Server Setup Test" $EMAIL_ADDRESS
 
   - |
-    fallocate -l 4G /swapfile || true
-    chmod 600 /swapfile || true
-    mkswap /swapfile || true
-    swapon /swapfile || true
-    echo "/swapfile none swap sw 0 0" >> /etc/fstab || true
+    fallocate -l ${SWAP_GB}G /swapfile
+    chmod 600 /swapfile
+    mkswap /swapfile
+    swapon /swapfile
+    echo "/swapfile none swap sw 0 0" >> /etc/fstab
 
   - curl -fsSL https://get.docker.com | sh
-  - usermod -aG docker $USERNAME || true
+  - usermod -aG docker $USERNAME
+
+  - curl -fsSL https://tailscale.com/install.sh | sh
+  - tailscale up --authkey=$TAILSCALE_AUTH_KEY --hostname=$HOSTNAME
 
   - curl -sSL https://dokploy.com/install.sh | sh