mirror of
https://github.com/trailofbits/dropkit
synced 2026-06-21 14:11:54 +00:00
Riccardo Schirone
0efeea52bb
* Remove escaped chars in comments * Add Jinja2 template validation test and pre-commit hook Catch template syntax errors early with a unit test that parses and renders the default cloud-init template, and a pre-commit hook that validates all templates in dropkit/templates/ on change. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
114 lines
3.0 KiB
YAML
114 lines
3.0 KiB
YAML
#cloud-config
|
|
# Warning: This whole file will be evaluated by Jinja. Escape any special literals
|
|
|
|
# Update and upgrade system packages
|
|
package_update: true
|
|
package_upgrade: true
|
|
disable_root_opts: no-port-forwarding,no-agent-forwarding,no-X11-forwarding
|
|
|
|
apt:
|
|
sources:
|
|
docker:
|
|
keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
|
|
keyserver: https://download.docker.com/linux/ubuntu/gpg
|
|
source: deb [arch=amd64 signed-by=$KEY_FILE] https://download.docker.com/linux/ubuntu $RELEASE stable
|
|
|
|
# Install required packages
|
|
packages:
|
|
- ufw
|
|
- zsh
|
|
- git
|
|
- curl
|
|
- wget
|
|
- build-essential
|
|
- neovim
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- gnupg
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
|
|
users:
|
|
- name: {{ username }}
|
|
gecos: "{{ username }} user"
|
|
shell: /bin/bash
|
|
groups: sudo,admin,wheel,docker
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
ssh_authorized_keys:{% for key in ssh_keys %}
|
|
- {{ key }}
|
|
{% endfor %}
|
|
# Write custom zshrc file
|
|
write_files:
|
|
- path: /home/{{ username }}/.zshrc
|
|
owner: {{ username }}:{{ username }}
|
|
permissions: '0644'
|
|
defer: true
|
|
content: |
|
|
# Prompt: user@host:dir (green for normal, red after failed command)
|
|
{% raw %}PROMPT='%F{%(?.green.red)}%n@%m%f:%F{blue}%~%f$ '{% endraw %}
|
|
|
|
# History
|
|
HISTFILE=~/.zsh_history
|
|
HISTSIZE=10000
|
|
SAVEHIST=10000
|
|
setopt SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE
|
|
|
|
# Completion
|
|
autoload -Uz compinit && compinit
|
|
zstyle ':completion:*' menu select
|
|
|
|
# Key bindings
|
|
bindkey -e
|
|
|
|
export LANG=en_US.UTF-8
|
|
export LC_ALL=en_US.UTF-8
|
|
export EDITOR='nvim'
|
|
export LESS='-R'
|
|
export PATH="$PATH:/home/{{ username }}/.local/bin"
|
|
|
|
alias vim="nvim"
|
|
|
|
# Run commands after boot
|
|
runcmd:
|
|
# Configure UFW firewall
|
|
- ufw default deny incoming
|
|
- ufw default allow outgoing
|
|
- ufw allow OpenSSH
|
|
- ufw limit ssh
|
|
- ufw --force enable
|
|
|
|
{% if tailscale_enabled %}
|
|
# Install Tailscale via official script (daemon only, authentication handled by dropkit)
|
|
- curl -fsSL https://tailscale.com/install.sh | sh
|
|
{% endif %}
|
|
|
|
# Wait for user to be fully created
|
|
- |
|
|
timeout=30
|
|
count=0
|
|
while ! id {{ username }} >/dev/null 2>&1; do
|
|
if [ $count -ge $timeout ]; then
|
|
echo "Timeout waiting for user {{ username }} to be created"
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
count=$((count + 1))
|
|
done
|
|
echo "User {{ username }} is ready"
|
|
|
|
# Ensure home directory exists and has correct permissions
|
|
- mkdir -p /home/{{ username }}
|
|
- chown {{ username }}:{{ username }} /home/{{ username }}
|
|
|
|
# Configure git globally for the user
|
|
- su {{ username }} -c "git config --global user.name '{{ full_name }}'"
|
|
- su {{ username }} -c "git config --global user.email '{{ email }}'"
|
|
|
|
# Set Zsh as default shell and ensure ownership
|
|
- chsh -s /usr/bin/zsh {{ username }}
|
|
- chown -R {{ username }}:{{ username }} /home/{{ username }}
|
|
- reboot
|