generate_cloud_config.sh (4637B)
1 #!/bin/bash 2 set -eou pipefail 3 4 read -rp "Enter your username: " USERNAME 5 [[ -z "${USERNAME:-}" ]] && { 6 echo "Error: Username required" >&2 7 exit 1 8 } 9 read -rp "Enter your SSH public key: " SSH_KEY 10 [[ -z "${SSH_KEY:-}" ]] && { 11 echo "Error: SSH key required" >&2 12 exit 1 13 } 14 echo 15 16 read -rp "Enter your hostname: " HOSTNAME 17 [[ -z "${HOSTNAME:-}" ]] && { 18 echo "Error: Hostname required" >&2 19 exit 1 20 } 21 read -rp "Enter your domain: " DOMAIN 22 echo 23 24 read -rp "Enter swap size in GB [2]: " SWAP_GB 25 SWAP_GB=${SWAP_GB:-2} 26 echo 27 28 read -rp "Enter your email address: " EMAIL_ADDRESS 29 read -rsp "Enter your email password: " EMAIL_PASSWORD 30 echo 31 echo 32 33 read -rsp "Enter Tailscale auth key: " TAILSCALE_AUTH_KEY 34 [[ -z "${TAILSCALE_AUTH_KEY:-}" ]] && { 35 echo "Error: Tailscale auth key required" >&2 36 exit 1 37 } 38 echo 39 echo 40 41 read -rp "Enter timezone [America/Los_Angeles]: " TIMEZONE 42 TIMEZONE=${TIMEZONE:-America/Los_Angeles} 43 echo 44 45 cat <<EOF 46 #cloud-config 47 48 users: 49 - name: $USERNAME 50 groups: users, admin, docker 51 sudo: ALL=(ALL) NOPASSWD:ALL 52 shell: /bin/bash 53 ssh_authorized_keys: 54 - $SSH_KEY 55 56 package_update: true 57 package_upgrade: true 58 packages: 59 - fail2ban 60 - ufw 61 - curl 62 - ca-certificates 63 - systemd-timesyncd 64 - unattended-upgrades 65 - apt-listchanges 66 - needrestart 67 - msmtp 68 - bsd-mailx 69 70 ssh_pwauth: false 71 72 write_files: 73 - path: /etc/ssh/sshd_config.d/ssh-hardening.conf 74 content: | 75 Port 2000 76 PermitRootLogin no 77 PasswordAuthentication no 78 KbdInteractiveAuthentication no 79 ChallengeResponseAuthentication no 80 UsePAM no 81 MaxAuthTries 3 82 AllowTcpForwarding no 83 X11Forwarding no 84 AllowAgentForwarding no 85 AuthorizedKeysFile .ssh/authorized_keys 86 AllowGroups users 87 88 - path: /etc/apt/apt.conf.d/50unattended-upgrades 89 content: | 90 Unattended-Upgrade::Allowed-Origins { 91 "\${distro_id}:\${distro_codename}-security"; 92 }; 93 94 Unattended-Upgrade::Package-Blacklist {}; 95 96 Unattended-Upgrade::Mail "$EMAIL_ADDRESS"; 97 Unattended-Upgrade::Sender "server-updates <$EMAIL_ADDRESS>"; 98 Unattended-Upgrade::MailReport "on-change"; 99 Unattended-Upgrade::MailOnlyOnError "false"; 100 101 Unattended-Upgrade::Automatic-Reboot "true"; 102 Unattended-Upgrade::Automatic-RebootTime "00:00"; 103 Unattended-Upgrade::Automatic-RebootWithUsers "false"; 104 105 - path: /etc/apt/apt.conf.d/20auto-upgrades 106 content: | 107 APT::Periodic::Update-Package-Lists "1"; 108 APT::Periodic::Unattended-Upgrade "1"; 109 APT::Periodic::AutocleanInterval "7"; 110 111 # WARNING: Email password stored in plaintext here (root-only, 0600). Use secrets manager in production. 112 - path: /root/.msmtprc 113 permissions: "0600" 114 owner: root:root 115 content: | 116 account default 117 host smtp.fastmail.com 118 port 465 119 from $EMAIL_ADDRESS 120 user $EMAIL_ADDRESS 121 password $EMAIL_PASSWORD 122 auth on 123 tls on 124 tls_starttls off 125 tls_certcheck on 126 logfile /var/log/msmtp/msmtp.log 127 128 - path: /etc/logrotate.d/msmtp 129 content: | 130 /var/log/msmtp/msmtp.log { 131 daily 132 rotate 7 133 compress 134 delaycompress 135 missingok 136 notifempty 137 create 0600 root root 138 } 139 140 - path: /etc/mailname 141 content: $DOMAIN 142 143 - path: /etc/hostname 144 content: $HOSTNAME 145 146 runcmd: 147 - hostnamectl set-hostname $HOSTNAME 148 149 - timedatectl set-timezone $TIMEZONE 150 - systemctl enable --now systemd-timesyncd 151 152 - | 153 printf "[sshd]\nenabled = true\nport = 22\nbanaction = iptables-multiport\nmaxretry = 3\nbantime = 3600\nfindtime = 600\n" > /etc/fail2ban/jail.local 154 - systemctl enable --now fail2ban 155 156 - ufw default deny incoming 157 - ufw default allow outgoing 158 - ufw allow in on tailscale0 159 - ufw --force enable 160 161 - systemctl restart sshd || systemctl restart ssh 162 163 - ln -sf /root/.msmtprc /etc/msmtprc 164 - grep -q "mta=/usr/bin/msmtp" /etc/mail.rc || echo "set mta=/usr/bin/msmtp" >> /etc/mail.rc 165 - echo "Automatic security updates enabled. Emails sent to $EMAIL_ADDRESS on changes. Reboots at 00:00 PT if needed." > /etc/motd.d/99-security-updates 166 - echo "Server first boot for $HOSTNAME" | mail -s "Server Setup Test" $EMAIL_ADDRESS 167 168 - | 169 fallocate -l ${SWAP_GB}G /swapfile 170 chmod 600 /swapfile 171 mkswap /swapfile 172 swapon /swapfile 173 echo "/swapfile none swap sw 0 0" >> /etc/fstab 174 175 - curl -fsSL https://get.docker.com | sh 176 - usermod -aG docker $USERNAME 177 178 - curl -fsSL https://tailscale.com/install.sh | sh 179 - tailscale up --authkey=$TAILSCALE_AUTH_KEY --hostname=$HOSTNAME 180 181 - curl -sSL https://dokploy.com/install.sh | sh 182 183 - reboot 184 EOF