From 082c6290e16ca98a934d91193389d6572ce4db2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9ctor=20Molinero=20Fern=C3=A1ndez?=
 <hector@molinero.dev>
Date: Thu, 6 Feb 2020 20:02:31 +0100
Subject: [PATCH] Use single shell provisioner

---
 packer/build.pkr.hcl | 116 ++++++++++++++++++++-----------------------
 1 file changed, 54 insertions(+), 62 deletions(-)

diff --git a/packer/build.pkr.hcl b/packer/build.pkr.hcl
index 0b1b1db..9bff61f 100644
--- a/packer/build.pkr.hcl
+++ b/packer/build.pkr.hcl
@@ -9,73 +9,65 @@ build {
     destination = "/"
   }
 
-  provisioner "shell" {
-    inline = [
-      "chmod 644 /etc/apt/apt.conf.d/20auto-upgrades",
-      "chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades",
-      "chmod 644 /etc/fail2ban/jail.d/sshd.conf",
-      "chmod 644 /etc/ssh/sshd_config",
-      "chmod 644 /etc/unbound/unbound.conf",
-      "chmod 644 /etc/wireguard/client-sample.conf",
-      "chmod 644 /etc/wireguard/wg0-peers.conf",
-      "chmod 600 /etc/wireguard/wg0.conf"
-    ]
-  }
-
   provisioner "shell" {
     environment_vars = [
+      "DPKG_FORCE=confold",
       "DEBIAN_FRONTEND=noninteractive"
     ]
+    inline_shebang = "/bin/sh -eux"
     inline = [
-      "printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list",
-      "apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25",
-      "apt-get update",
-      "apt-get upgrade -yo DPkg::options::=--force-confold",
-      "apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound",
-      "apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard",
-      "apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id",
-      "apt-get autoremove -y"
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      "systemctl disable --now systemd-resolved.service",
-      "unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf",
-      "systemctl enable --now unbound.service unbound-resolvconf.service",
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      "systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service",
-      "systemctl enable --now wg-quick@wg0.service"
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      "ufw --force enable",
-      "ufw default deny incoming",
-      "ufw default allow outgoing",
-      "ufw allow from any to any port 22 proto tcp"
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      "groupadd -r ssh-user",
-      "usermod -aG ssh-user root",
-      "passwd -d root"
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      "rm -f /etc/ssh/ssh_host_*key*",
-      "rm -f /etc/wireguard/*-*key",
-      "rm -f /etc/wireguard/*-iface",
-      "rm -rf /var/lib/apt/lists/*"
+      <<EOF
+        chmod 644 /etc/apt/apt.conf.d/20auto-upgrades
+        chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades
+        chmod 644 /etc/fail2ban/jail.d/sshd.conf
+        chmod 644 /etc/ssh/sshd_config
+        chmod 644 /etc/unbound/unbound.conf
+        chmod 644 /etc/wireguard/client-sample.conf
+        chmod 644 /etc/wireguard/wg0-peers.conf
+        chmod 600 /etc/wireguard/wg0.conf
+      EOF
+      ,
+      <<EOF
+        printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list
+        apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25
+        apt-get update
+        apt-get upgrade -yo DPkg::options::=--force-confold
+        apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound
+        apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard
+        apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id
+        apt-get autoremove -y
+      EOF
+      ,
+      <<EOF
+        systemctl disable --now systemd-resolved.service
+        unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf
+        systemctl enable --now unbound.service unbound-resolvconf.service
+      EOF
+      ,
+      <<EOF
+        systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service
+        systemctl enable --now wg-quick@wg0.service
+      EOF
+      ,
+      <<EOF
+        ufw --force enable
+        ufw default deny incoming
+        ufw default allow outgoing
+        ufw allow from any to any port 22 proto tcp
+      EOF
+      ,
+      <<EOF
+        groupadd -r ssh-user
+        usermod -aG ssh-user root
+        passwd -d root
+      EOF
+      ,
+      <<EOF
+        rm -f /etc/ssh/ssh_host_*key*
+        rm -f /etc/wireguard/*-*key
+        rm -f /etc/wireguard/*-iface
+        rm -rf /var/lib/apt/lists/*
+      EOF
     ]
   }
 }