From f46348b614b6768b88c421768d915553b5f27e0e Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Wed, 1 Nov 2023 09:43:32 +0100
Subject: [PATCH] Added extra cloud-init for kubernetes hosts

---
 terraform/cloud-init-k8s.yaml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 terraform/cloud-init-k8s.yaml

diff --git a/terraform/cloud-init-k8s.yaml b/terraform/cloud-init-k8s.yaml
new file mode 100644
index 0000000..4c1d901
--- /dev/null
+++ b/terraform/cloud-init-k8s.yaml
@@ -0,0 +1,35 @@
+#cloud-config
+users:
+  - name: 2martensAdmin
+    groups: users, admin
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjYkz73HbsFtRAOfS5QB9xDbOajU9C4gpDp+OjQkLir 2martens@Jims-Air.fritz.box"
+packages:
+  - fail2ban
+  - ufw
+package_update: true
+package_upgrade: true
+runcmd:
+  - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
+  - systemctl enable fail2ban
+  - ufw allow OpenSSH
+  - ufw allow 16443 comment Kubernetes
+  - ufw allow 80 comment HTTP
+  - ufw allow 443 comment HTTPS
+  - ufw enable
+  - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
+  - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
+  - sed -i '$a AllowUsers 2martensAdmin' /etc/ssh/sshd_config
+  - curl https://packages.hetzner.com/hcloud/deb/hc-utils_0.0.4-1_all.deb -o /tmp/hc-utils_0.0.4-1_all.deb -s
+  - apt install /tmp/hc-utils_0.0.4-1_all.deb
+  - mkdir -p /var/snap/microk8s/common/
+  - curl https://repo.2martens.de/files/microk8s-config.yaml -o /var/snap/microk8s/common/.microk8s.yaml
+  - snap install microk8s --channel 1.28-strict/stable
+  - reboot
\ No newline at end of file