50 lines
2.2 KiB
Plaintext
50 lines
2.2 KiB
Plaintext
#!/usr/bin/env bash
|
|
# Post-install bootstrap - uploaded and executed once by OpenTofu immediately
|
|
# after server creation (see modules/<host>/main.tf). Idempotent-ish: safe to
|
|
# re-run by hand, but only ever runs automatically on first create.
|
|
set -euo pipefail
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
DEPLOY_USER="${deploy_user}"
|
|
|
|
apt-get update -y
|
|
apt-get upgrade -y
|
|
|
|
# --- Docker Engine + Compose plugin ---
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
apt-get install -y ca-certificates curl gnupg
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
chmod a+r /etc/apt/keyrings/docker.asc
|
|
. /etc/os-release
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $VERSION_CODENAME stable" \
|
|
> /etc/apt/sources.list.d/docker.list
|
|
apt-get update -y
|
|
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
fi
|
|
|
|
# --- Non-root sudo user, given the same key root was provisioned with ---
|
|
if ! id -u "$DEPLOY_USER" >/dev/null 2>&1; then
|
|
useradd --create-home --shell /bin/bash "$DEPLOY_USER"
|
|
usermod -aG sudo,docker "$DEPLOY_USER"
|
|
mkdir -p "/home/$DEPLOY_USER/.ssh"
|
|
cp /root/.ssh/authorized_keys "/home/$DEPLOY_USER/.ssh/authorized_keys"
|
|
chown -R "$DEPLOY_USER:$DEPLOY_USER" "/home/$DEPLOY_USER/.ssh"
|
|
chmod 700 "/home/$DEPLOY_USER/.ssh"
|
|
chmod 600 "/home/$DEPLOY_USER/.ssh/authorized_keys"
|
|
echo "$DEPLOY_USER ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/90-$DEPLOY_USER"
|
|
chmod 440 "/etc/sudoers.d/90-$DEPLOY_USER"
|
|
fi
|
|
|
|
# --- SSH hardening: key-only auth everywhere. Root keeps key-only login as a
|
|
# fallback rather than being fully locked out, in case $DEPLOY_USER setup above
|
|
# ever fails silently on a future image. ---
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
|
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
systemctl reload ssh 2>/dev/null || systemctl reload sshd
|
|
|
|
# --- Unattended security upgrades ---
|
|
apt-get install -y unattended-upgrades
|
|
dpkg-reconfigure -f noninteractive unattended-upgrades
|
|
systemctl enable --now unattended-upgrades
|