136 lines
3.9 KiB
YAML
136 lines
3.9 KiB
YAML
# Ubuntu Server Autoinstall — Iron Legion G9 Headless Deploy
|
|
# Usage: Place as 'user-data' on nocloud USB alongside empty 'meta-data' file
|
|
# See README.md for USB creation instructions
|
|
|
|
version: 1
|
|
autoinstall:
|
|
# ── Identity ──
|
|
identity:
|
|
hostname: ubuntu
|
|
username: jarvis
|
|
password: "$6$iypA63f5vLDzTGQ2$eOrvsyhnM6c4istoy65GUConWL4St.rzy28wFt8QxUWk7F3fSx7mHytwnjHosvIj7JAMBPeC4jkUctAZJeKDx/"
|
|
ssh:
|
|
install-server: true
|
|
allow-pw: true
|
|
authorized-keys:
|
|
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPSBrRCROUHOiZX9IB3teEK89VFfghbdu7OF5NoJ1Y6g
|
|
|
|
# ── Storage ──
|
|
storage:
|
|
config:
|
|
- type: disk
|
|
id: disk0
|
|
ptable: gpt
|
|
wipe: superblock-recursive
|
|
path: /dev/nvme0n1
|
|
- type: partition
|
|
id: boot-part
|
|
number: 1
|
|
size: 1GB
|
|
device: disk0
|
|
flag: boot
|
|
grub_device: true
|
|
- type: format
|
|
id: boot-format
|
|
fstype: ext4
|
|
volume: boot-part
|
|
- type: mount
|
|
id: boot-mount
|
|
device: boot-format
|
|
path: /boot
|
|
- type: partition
|
|
id: root-part
|
|
number: 2
|
|
size: -1
|
|
device: disk0
|
|
- type: format
|
|
id: root-format
|
|
fstype: ext4
|
|
volume: root-part
|
|
- type: mount
|
|
id: root-mount
|
|
device: root-format
|
|
path: /
|
|
|
|
# ── Networking ──
|
|
network:
|
|
version: 2
|
|
ethernets:
|
|
en0:
|
|
match:
|
|
name: "en*"
|
|
dhcp4: true
|
|
dhcp6: true
|
|
|
|
# ── Packages ──
|
|
packages:
|
|
- openssh-server
|
|
- curl
|
|
- git
|
|
- ca-certificates
|
|
- gnupg
|
|
- net-tools
|
|
- iputils-ping
|
|
- htop
|
|
- ufw
|
|
- nfs-common
|
|
|
|
# ── First boot scripts ──
|
|
late-commands:
|
|
# Hostname from MAC address
|
|
- |
|
|
MAC=$(cat /sys/class/net/en*/address 2>/dev/null | head -1 | tr -d ':')
|
|
case "$MAC" in
|
|
e051d81c5d56) HOST="mk-33" ;;
|
|
e051d81c5c75) HOST="mk-34" ;;
|
|
e051d81c5dca) HOST="mk-39" ;;
|
|
e051d81c5d5c) HOST="mk-42" ;;
|
|
*) HOST="g9-$(echo $MAC | tail -c 5)" ;;
|
|
esac
|
|
hostnamectl set-hostname "$HOST"
|
|
echo "$HOST" > /etc/hostname
|
|
printf "127.0.1.1\t%s\n" "$HOST" >> /etc/hosts
|
|
|
|
# Disable cloud-init re-run
|
|
- |
|
|
mkdir -p /etc/cloud/cloud.cfg.d
|
|
echo "preserve_hostname: true" > /etc/cloud/cloud.cfg.d/99_preserve_hostname.cfg
|
|
touch /etc/cloud/cloud-init.disabled
|
|
|
|
# Install Docker
|
|
- |
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
|
chmod a+r /etc/apt/keyrings/docker.gpg
|
|
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list
|
|
apt-get update
|
|
apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
usermod -aG docker jarvis
|
|
|
|
# Install Tailscale
|
|
- |
|
|
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
|
|
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list
|
|
apt-get update
|
|
apt-get install -y tailscale
|
|
|
|
# Clone ansible-pull repo
|
|
- |
|
|
sudo -u jarvis bash -c 'mkdir -p ~/.ansible-repo && cd ~/.ansible-repo && git clone https://gitea.nb.bobbysh.me/Iron-Legion/ansible-pull-deploy.git . 2>/dev/null || true'
|
|
|
|
# SSH hardening (keep PW auth enabled for fleet standard)
|
|
- |
|
|
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
|
|
systemctl restart ssh
|
|
|
|
# Enable UFW basic rules
|
|
- |
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw allow 22/tcp
|
|
ufw --force enable
|
|
|
|
# Reboot to finalize
|
|
- reboot
|