infra/home/cloud-init/debian-13-base.yaml

#cloud-config
# Minimal cloud-init configuration for Debian 13 base template

# Update and upgrade packages on first boot
package_update: true
package_upgrade: true

# Configure timezone
timezone: America/Chicago

# Install essential packages
packages:
  # System utilities
  - sudo
  - curl
  - wget
  - git
  - vim
  - nano
  - tmux
  - htop
  - iotop
  - rsync
  - net-tools
  - dnsutils
  - traceroute
  - mtr-tiny
  - tcpdump
  - nmap
  - netcat-openbsd
  
  # Development tools
  - build-essential
  - python3
  - python3-pip
  - python3-venv
  - jq
  - fzf
  - zsh
  
  # System monitoring
  - sysstat
  - smartmontools
  - lm-sensors
  
  # Time synchronization
  - chrony
  
  # Security
  - fail2ban
  - ufw
  
  # Container runtime (optional)
  - docker.io
  - docker-compose
  
  # Other useful tools
  - apt-transport-https
  - ca-certificates
  - gnupg
  - lsb-release
  - software-properties-common

# Create users with sudo access
users:
  - name: graham
    groups: sudo,docker
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_import_id:
      - gh:gmcintire
    
  - name: andy
    groups: sudo,docker
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_import_id:
      - gh:nsnw
    
  - name: ansible
    uid: 10001
    groups: sudo,docker
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5aTtW3lgF9PfV8sTIxZfbvo6dUBMq5C5zJrXy6mwdb5UK9xvqty5Vlh6F1FqYlZgvIyR7NqLbXnKqsvLVGdkTm9VEXGlNcbPJ3ilbhc3OJPX0k63CwokU6nSztXguE1v3KB7JjXiM0dj7ujuDzAGfPZNClR6u06NjIamzeWcQnsJV3P8rLxa7ppvFgBp0K1N1pMb3AUqXOutsOUjSvs5C4H+GMmKYCYNpPGbfKNDLfB9vYLPYv/ynF1lDDzBDL6gy0PnDX6lXC9jvfPWSKNu5lgIUc6p9J++I/ERGktbGPvEaLPeJjgIJPbVLwvnmCLDj2VBmvu2cVE+oXWjLJLF7y8T1cZA0d7aH1TWHcaFPNd3nsPbWGOA3PtMoNRLN/6b7mA7QAKCEBVcR1cZ8c5wQ7ilcLETrNBmJLPpBQa7tLvCx8Q8KPNmtZX6dMKR1o7yj5mXq7Slzo6RTdKLpDqODPVPmGboChMQWFEvGCKxVYLDuvS8iXHdkRE+C9xwqNis= ansible

# Configure SSH
ssh_pwauth: false
disable_root: true

# SSH configuration
write_files:
  - path: /etc/ssh/sshd_config.d/99-custom.conf
    content: |
      PermitRootLogin no
      PasswordAuthentication no
      ChallengeResponseAuthentication no
      UsePAM yes
      X11Forwarding yes
      PrintMotd no
      AcceptEnv LANG LC_*
      Banner /etc/issue.net
      
  - path: /etc/issue.net
    content: |
      ******************************************************************
      *                                                                *
      * This system is for authorized users only. All activity is     *
      * monitored and reported. Unauthorized access is prohibited.     *
      *                                                                *
      ******************************************************************
      
  - path: /etc/sudoers.d/90-cloud-init-users
    content: |
      # Created by cloud-init
      graham ALL=(ALL) NOPASSWD:ALL
      andy ALL=(ALL) NOPASSWD:ALL
      ansible ALL=(ALL) NOPASSWD:ALL
    permissions: '0440'
    
  - path: /etc/motd
    content: |
      Welcome to Debian 13 (Trixie)
      
      System Information:
      * Documentation:  https://www.debian.org/doc/
      * Support:        https://www.debian.org/support
      
  - path: /etc/chrony/sources.d/custom.sources
    content: |
      pool 0.us.pool.ntp.org iburst
      pool 1.us.pool.ntp.org iburst
      pool 2.us.pool.ntp.org iburst
      pool 3.us.pool.ntp.org iburst
      
  - path: /etc/sysctl.d/99-custom.conf
    content: |
      # IP forwarding for containers/k8s
      net.ipv4.ip_forward = 1
      net.ipv6.conf.all.forwarding = 1
      
      # Increase inotify limits for containers
      fs.inotify.max_user_watches = 524288
      fs.inotify.max_user_instances = 512
      
      # Network performance tuning
      net.core.rmem_max = 134217728
      net.core.wmem_max = 134217728
      net.ipv4.tcp_rmem = 4096 87380 134217728
      net.ipv4.tcp_wmem = 4096 65536 134217728
      
      # Security hardening
      net.ipv4.conf.all.rp_filter = 1
      net.ipv4.conf.default.rp_filter = 1
      net.ipv4.tcp_syncookies = 1
      net.ipv4.conf.all.accept_source_route = 0
      net.ipv6.conf.all.accept_source_route = 0
      
  - path: /etc/security/limits.d/99-custom.conf
    content: |
      # Increase limits for containers
      * soft nofile 65536
      * hard nofile 65536
      * soft nproc 32768
      * hard nproc 32768

# Configure firewall (ufw)
ufw:
  enabled: true
  rules:
    - port: 22
      protocol: tcp
      rule: allow
      comment: SSH
    - port: 80
      protocol: tcp
      rule: allow
      comment: HTTP
    - port: 443
      protocol: tcp
      rule: allow
      comment: HTTPS

# Run commands on first boot
runcmd:
  # Configure fail2ban
  - systemctl enable fail2ban
  - systemctl start fail2ban
  
  # Enable and configure Docker
  - systemctl enable docker
  - systemctl start docker
  - usermod -aG docker graham
  - usermod -aG docker andy
  - usermod -aG docker ansible
  
  # Apply sysctl settings
  - sysctl -p /etc/sysctl.d/99-custom.conf
  
  # Configure chrony
  - systemctl restart chrony
  
  # Secure shared memory
  - echo "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" >> /etc/fstab
  - mount -o remount /run/shm
  
  # Create common directories
  - mkdir -p /opt/scripts /opt/configs
  
  # Set proper permissions
  - chmod 644 /etc/issue.net
  - chmod 440 /etc/sudoers.d/90-cloud-init-users
  
  # Update locate database
  - updatedb

# Configure automatic updates
apt:
  preserve_sources_list: true
  conf: |
    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::AutocleanInterval "7";
    APT::Periodic::Unattended-Upgrade "1";

# Power state change timeout
power_state:
  delay: now
  mode: reboot
  message: Initial configuration complete, rebooting...
  timeout: 30
  condition: true