infra/home/terraform/debian13-caddy-cloud-init.yml

#cloud-config
# Cloud-init configuration for Debian 13 Vultr server with Caddy proxy and Tailscale

# Update and upgrade packages on first boot  
package_update: true
package_upgrade: true

# Configure hostname
hostname: caddy

# Configure timezone
timezone: America/Chicago

# Install packages
packages:
  # SSH server
  - openssh-server
  
  # Include all base packages
  - sudo
  - curl
  - wget
  - git
  - vim
  - tmux
  - htop
  - rsync
  - net-tools
  - dnsutils
  - build-essential
  - python3
  - python3-pip
  - apt-transport-https
  - ca-certificates
  - gnupg
  - lsb-release
  - software-properties-common
  - fail2ban
  - ufw
  
  # Caddy and web server tools
  - debian-keyring
  - debian-archive-keyring

# Create users with sudo access
users:
  - name: graham
    groups: sudo
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_import_id:
      - gh:gmcintire
    
  - name: andy
    groups: sudo
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_import_id:
      - gh:nsnw
    
  - name: ansible
    uid: 10001
    groups: sudo
    shell: /bin/bash
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFghGMnDdkfNC6JPEhMxrKhYDmNcXjHXp/y/mf3uLtzb graham@mbp14.local

# Configure SSH
ssh_pwauth: false
disable_root: false  # Allow root initially for Vultr SSH keys

# Write configuration files
write_files:
  - path: /etc/ssh/sshd_config.d/99-custom.conf
    content: |
      PermitRootLogin prohibit-password
      PasswordAuthentication no
      PubkeyAuthentication yes
      AuthorizedKeysFile .ssh/authorized_keys
      Banner /etc/issue.net
      
  - path: /etc/issue.net
    content: |
      ******************************************************************
      * Authorized access only. All activity is monitored.             *
      ******************************************************************
      
  - path: /etc/apt/sources.list.d/caddy-stable.list
    content: |
      deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
      
  - path: /etc/caddy/Caddyfile
    content: |
      # Global options
      {
          # Email for Let's Encrypt
          email admin@example.com
          
          # Enable the admin endpoint
          admin off
      }
      
      # Default site - return 404 for undefined hosts
      :80 {
          respond 404
      }
      
      # Example reverse proxy configuration
      # example.com {
      #     reverse_proxy localhost:8080
      # }
    permissions: '0644'
    owner: root:root
    
  - path: /etc/sysctl.d/99-tailscale.conf
    content: |
      # Tailscale UDP GRO fix
      net.ipv4.udp_rmem_min = 131072
      net.ipv4.udp_wmem_min = 131072
      net.core.rmem_default = 131072
      net.core.wmem_default = 131072
      net.core.netdev_max_backlog = 5000
      
  - path: /opt/scripts/install-tailscale.sh
    content: |
      #!/bin/bash
      # Install Tailscale
      curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
      curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list
      apt-get update
      apt-get install -y tailscale
      
      # Enable and start tailscaled
      systemctl enable tailscaled
      systemctl start tailscaled
      
      # If TAILSCALE_KEY is provided, authenticate
      if [ -n "$TAILSCALE_KEY" ]; then
          tailscale up --authkey="$TAILSCALE_KEY" --accept-routes --hostname=$(hostname)
      fi
    permissions: '0755'
    
  - path: /opt/scripts/setup-caddy.sh
    content: |
      #!/bin/bash
      # Ensure Caddy starts after network is ready
      mkdir -p /etc/systemd/system/caddy.service.d
      cat > /etc/systemd/system/caddy.service.d/override.conf <<EOF
      [Unit]
      After=network-online.target
      Wants=network-online.target
      
      [Service]
      # Restart on failure
      Restart=on-failure
      RestartSec=5s
      EOF
      
      systemctl daemon-reload
      systemctl enable caddy
      systemctl start caddy
    permissions: '0755'

# Configure firewall
ufw:
  enabled: true
  rules:
    - port: 22
      protocol: tcp
      rule: allow
      comment: SSH
    - port: 80
      protocol: tcp  
      rule: allow
      comment: HTTP
    - port: 443
      protocol: tcp
      rule: allow  
      comment: HTTPS
    - port: 41641
      protocol: udp
      rule: allow
      from_any: true
      comment: Tailscale

# Run commands on first boot
runcmd:
  # Ensure SSH is started and enabled
  - systemctl enable ssh
  - systemctl start ssh
  - systemctl reload ssh
  
  # Add Caddy GPG key and install
  - curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
  - apt-get update
  - apt-get install -y caddy
  
  # Apply sysctl settings
  - sysctl -p /etc/sysctl.d/99-tailscale.conf
  
  # Create Caddy directories
  - mkdir -p /etc/caddy/sites-enabled
  - chown -R caddy:caddy /etc/caddy
  
  # Install Tailscale
  - /opt/scripts/install-tailscale.sh
  
  # Setup Caddy service
  - /opt/scripts/setup-caddy.sh
  
  # Configure fail2ban for Caddy
  - |
    cat > /etc/fail2ban/jail.d/caddy.conf <<EOF
    [caddy-status]
    enabled = true
    filter = caddy-status
    logpath = /var/log/caddy/access.log
    maxretry = 5
    bantime = 600
    EOF
  
  # Enable services
  - systemctl enable fail2ban
  - systemctl start fail2ban

# Final message
final_message: "Debian 13 Caddy proxy setup complete! System ready after $UPTIME seconds"

# Power state - don't reboot automatically for proxy servers
power_state:
  delay: now
  mode: poweroff
  message: Initial configuration complete
  condition: false