infra/home/terraform/alpine-cloud-init.yml

#cloud-config

# Users
users:
  - name: graham
    groups: [wheel, adm]
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGthwaOgNUPMl1P3yXLBdKYXXvxUvlm4/BShLOm9hqRO
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLyVSEEAEbGZZqwPwEup0XrlTpu3x3iF9ExvvQPA4xN graham@mcintire.me
  - name: ansible
    uid: 10001
    groups: [wheel, adm]
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGthwaOgNUPMl1P3yXLBdKYXXvxUvlm4/BShLOm9hqRO
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLyVSEEAEbGZZqwPwEup0XrlTpu3x3iF9ExvvQPA4xN graham@mcintire.me

# Package management
package_update: true
package_upgrade: true
packages:
  - curl
  - wget
  - bash
  - sudo
  - python3
  - py3-pip
  - openrc
  - iptables

# Write files
write_files:
  # Caddy binary installation script
  - path: /usr/local/bin/install-caddy.sh
    permissions: '0755'
    content: |
      #!/bin/bash
      set -e
      echo "Installing Caddy..."

      # Download and install Caddy
      curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/setup.alpine.sh' | bash
      apk add caddy

      # Create caddy user and directories
      adduser -D -s /sbin/nologin caddy || true
      mkdir -p /etc/caddy /var/log/caddy /var/lib/caddy
      chown -R caddy:caddy /etc/caddy /var/log/caddy /var/lib/caddy
      chmod 755 /etc/caddy

  # Tailscale installation script
  - path: /usr/local/bin/install-tailscale.sh
    permissions: '0755'
    content: |
      #!/bin/bash
      set -e
      echo "Installing Tailscale..."

      # Download and install Tailscale
      curl -fsSL https://tailscale.com/install.sh | sh

      # Enable IP forwarding
      echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
      echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.conf
      sysctl -p

  # Caddy configuration file
  - path: /etc/caddy/Caddyfile
    permissions: '0644'
    owner: caddy:caddy
    content: |
      # Default catch-all for unconfigured domains
      :80 {
          respond "Service temporarily unavailable - Tailscale backend not configured" 503
      }

      # Example configuration for blog.w5isp.com
      # This will need to be updated once you have the actual Tailscale IPs
      blog.w5isp.com {
          # Replace with actual Tailscale IP when available
          # reverse_proxy 100.64.x.x:port
          respond "Backend not configured yet" 503
      }

      # Add more domains here as needed:
      example.w5isp.com {
          reverse_proxy 100.64.x.x:port
      }

  # Caddy OpenRC service file
  - path: /etc/init.d/caddy
    permissions: '0755'
    content: |
      #!/sbin/openrc-run

      name="Caddy web server"
      description="Fast, multi-platform web server with automatic HTTPS"

      command="/usr/bin/caddy"
      command_args="run --config /etc/caddy/Caddyfile --adapter caddyfile"
      command_user="caddy:caddy"
      command_background="yes"
      pidfile="/run/caddy.pid"

      start_stop_daemon_args="--stdout /var/log/caddy/access.log --stderr /var/log/caddy/error.log"

      depend() {
          need net
          after firewall
      }

  # Tailscale startup script
  - path: /usr/local/bin/tailscale-setup.sh
    permissions: '0755'
    content: |
      #!/bin/bash
      set -e

      # Wait for tailscaled to be ready
      sleep 5

      # Get auth key from environment or metadata
      AUTH_KEY="${TAILSCALE_AUTH_KEY}"
      if [ -z "$AUTH_KEY" ]; then
        echo "No Tailscale auth key found, skipping authentication"
        exit 0
      fi

      echo "Authenticating with Tailscale..."
      tailscale up --authkey="$AUTH_KEY" --accept-routes

      echo "Tailscale setup complete"
      tailscale status

  # Environment file for services
  - path: /etc/environment
    permissions: '0644'
    content: |
      PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Run commands during cloud-init
runcmd:
  # Update package cache
  - apk update

  # Install Caddy
  - /usr/local/bin/install-caddy.sh

  # Install Tailscale
  - /usr/local/bin/install-tailscale.sh

  # Configure firewall (basic Alpine firewall)
  - iptables -I INPUT -p tcp --dport 22 -j ACCEPT
  - iptables -I INPUT -p tcp --dport 80 -j ACCEPT
  - iptables -I INPUT -p tcp --dport 443 -j ACCEPT
  - iptables -I INPUT -i lo -j ACCEPT
  - iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  - rc-service iptables save

  # Enable and start services
  - rc-update add caddy default
  - rc-service caddy start

  # Start tailscaled
  - rc-service tailscale start
  - rc-update add tailscale default

  # Set up Tailscale (this will need the auth key passed via user-data or metadata)
  - sleep 10
  - /usr/local/bin/tailscale-setup.sh || true

# Final message
final_message: |
  Cloud-init setup complete!
  - Caddy web server installed and running
  - Tailscale VPN installed (needs auth key for setup)
  - Users: graham, ansible (both with sudo access)
  - Services managed via OpenRC

  To complete Tailscale setup, run:
  tailscale up --authkey=YOUR_AUTH_KEY --accept-routes