forked from unitoo/configurations
66 lines
2.7 KiB
YAML
66 lines
2.7 KiB
YAML
|
#cloud-config
|
||
|
|
|
||
|
|
ssh_genkeytypes: [ecdsa, ed25519]
|
||
|
|
|
||
|
|
# upgrade system
|
||
|
|
package_update: true
|
||
|
|
package_upgrade: true
|
||
|
|
|
||
|
|
# various dependencies
|
||
|
|
packages:
|
||
|
|
- ca-certificates
|
||
|
|
- curl
|
||
|
|
- gnupg
|
||
|
|
- lsb-release
|
||
|
|
|
||
|
|
write_files:
|
||
|
|
- path: /etc/iptables/rules.v4
|
||
|
|
permissions: 0644
|
||
|
|
owner: root:root
|
||
|
|
content: |
|
||
|
|
*filter
|
||
|
|
:INPUT DROP [0:0]
|
||
|
|
:FORWARD DROP [0:0]
|
||
|
|
:OUTPUT ACCEPT [0:0]
|
||
|
|
-A INPUT -i lo -j ACCEPT
|
||
|
|
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||
|
|
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
||
|
|
-A OUTPUT -o lo -j ACCEPT
|
||
|
|
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||
|
|
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||
|
|
-A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable
|
||
|
|
COMMIT
|
||
|
|
- path: /etc/iptables/rules.v6
|
||
|
|
permissions: 0644
|
||
|
|
owner: root:root
|
||
|
|
content: |
|
||
|
|
*filter
|
||
|
|
:INPUT DROP [0:0]
|
||
|
|
:FORWARD DROP [0:0]
|
||
|
|
:OUTPUT ACCEPT [0:0]
|
||
|
|
-A INPUT -i tun0 -j ACCEPT
|
||
|
|
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||
|
|
-A OUTPUT -o tun0 -j ACCEPT
|
||
|
|
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||
|
|
-A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp6-port-unreachable
|
||
|
|
COMMIT
|
||
|
|
|
||
|
|
runcmd:
|
||
|
|
- [mkdir, -p, /usr/local/apt-keys]
|
||
|
|
- [gpg, --fetch-keys, https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt]
|
||
|
|
- 'gpg --export 569130E8CA20FBC4CB3FDE555898470A764B32C9 | tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null'
|
||
|
|
- "echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' | tee /etc/apt/sources.list.d/yggdrasil.list"
|
||
|
|
- [apt-get, update]
|
||
|
|
- [apt-get, install, -y, yggdrasil]
|
||
|
|
- [sed, -r, -i, 's/Peers:\s\[\]/Peers: [\n\ttls:\/\/[2001:470:1f13:e56::64]:39575\n\ttls:\/\/s2.i2pd.xyz:39575\n\ttls:\/\/51.255.223.60:54232\n\ttls:\/\/45.147.198.155:6010\n\ttls:\/\/ygg1.ezdomain.ru:11130\n\ttls:\/\/ygg.mkg20001.io:443\n ]/', /etc/yggdrasil.conf]
|
||
|
|
- [systemctl, enable, --now, yggdrasil]
|
||
|
|
|
||
|
|
- [mkdir, -p, /etc/apt/keyrings]
|
||
|
|
- "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg"
|
||
|
|
- 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null'
|
||
|
|
- [chmod, a+r, /etc/apt/keyrings/docker.gpg]
|
||
|
|
- [apt-get, update]
|
||
|
|
- 'apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin'
|