feat: Created post-install script

2026-07-10 21:28:32 +01:00
parent 242e8aa359
commit d4167d5d60
10 changed files with 183 additions and 10 deletions
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Post-install bootstrap - uploaded and executed once by OpenTofu immediately
+# after server creation (see modules/<host>/main.tf). Idempotent-ish: safe to
+# re-run by hand, but only ever runs automatically on first create.
+set -euo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+DEPLOY_USER="${deploy_user}"
+
+apt-get update -y
+apt-get upgrade -y
+
+# --- Docker Engine + Compose plugin ---
+if ! command -v docker >/dev/null 2>&1; then
+  apt-get install -y ca-certificates curl gnupg
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+  . /etc/os-release
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $VERSION_CODENAME stable" \
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -y
+  apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+fi
+
+# --- Non-root sudo user, given the same key root was provisioned with ---
+if ! id -u "$DEPLOY_USER" >/dev/null 2>&1; then
+  useradd --create-home --shell /bin/bash "$DEPLOY_USER"
+  usermod -aG sudo,docker "$DEPLOY_USER"
+  mkdir -p "/home/$DEPLOY_USER/.ssh"
+  cp /root/.ssh/authorized_keys "/home/$DEPLOY_USER/.ssh/authorized_keys"
+  chown -R "$DEPLOY_USER:$DEPLOY_USER" "/home/$DEPLOY_USER/.ssh"
+  chmod 700 "/home/$DEPLOY_USER/.ssh"
+  chmod 600 "/home/$DEPLOY_USER/.ssh/authorized_keys"
+  echo "$DEPLOY_USER ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/90-$DEPLOY_USER"
+  chmod 440 "/etc/sudoers.d/90-$DEPLOY_USER"
+fi
+
+# --- SSH hardening: key-only auth everywhere. Root keeps key-only login as a
+# fallback rather than being fully locked out, in case $DEPLOY_USER setup above
+# ever fails silently on a future image. ---
+sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+systemctl reload ssh 2>/dev/null || systemctl reload sshd
+
+# --- Unattended security upgrades ---
+apt-get install -y unattended-upgrades
+dpkg-reconfigure -f noninteractive unattended-upgrades
+systemctl enable --now unattended-upgrades