Use single shell provisioner
This commit is contained in:
parent
05724647e7
commit
082c6290e1
@ -9,73 +9,65 @@ build {
|
|||||||
destination = "/"
|
destination = "/"
|
||||||
}
|
}
|
||||||
|
|
||||||
provisioner "shell" {
|
|
||||||
inline = [
|
|
||||||
"chmod 644 /etc/apt/apt.conf.d/20auto-upgrades",
|
|
||||||
"chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades",
|
|
||||||
"chmod 644 /etc/fail2ban/jail.d/sshd.conf",
|
|
||||||
"chmod 644 /etc/ssh/sshd_config",
|
|
||||||
"chmod 644 /etc/unbound/unbound.conf",
|
|
||||||
"chmod 644 /etc/wireguard/client-sample.conf",
|
|
||||||
"chmod 644 /etc/wireguard/wg0-peers.conf",
|
|
||||||
"chmod 600 /etc/wireguard/wg0.conf"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
provisioner "shell" {
|
provisioner "shell" {
|
||||||
environment_vars = [
|
environment_vars = [
|
||||||
|
"DPKG_FORCE=confold",
|
||||||
"DEBIAN_FRONTEND=noninteractive"
|
"DEBIAN_FRONTEND=noninteractive"
|
||||||
]
|
]
|
||||||
|
inline_shebang = "/bin/sh -eux"
|
||||||
inline = [
|
inline = [
|
||||||
"printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list",
|
<<EOF
|
||||||
"apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25",
|
chmod 644 /etc/apt/apt.conf.d/20auto-upgrades
|
||||||
"apt-get update",
|
chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades
|
||||||
"apt-get upgrade -yo DPkg::options::=--force-confold",
|
chmod 644 /etc/fail2ban/jail.d/sshd.conf
|
||||||
"apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound",
|
chmod 644 /etc/ssh/sshd_config
|
||||||
"apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard",
|
chmod 644 /etc/unbound/unbound.conf
|
||||||
"apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id",
|
chmod 644 /etc/wireguard/client-sample.conf
|
||||||
"apt-get autoremove -y"
|
chmod 644 /etc/wireguard/wg0-peers.conf
|
||||||
]
|
chmod 600 /etc/wireguard/wg0.conf
|
||||||
}
|
EOF
|
||||||
|
,
|
||||||
provisioner "shell" {
|
<<EOF
|
||||||
inline = [
|
printf 'deb http://ppa.launchpad.net/wireguard/wireguard/ubuntu/ bionic main\n' > /etc/apt/sources.list.d/wireguard.list
|
||||||
"systemctl disable --now systemd-resolved.service",
|
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E1B39B6EF6DDB96564797591AE33835F504A1A25
|
||||||
"unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf",
|
apt-get update
|
||||||
"systemctl enable --now unbound.service unbound-resolvconf.service",
|
apt-get upgrade -yo DPkg::options::=--force-confold
|
||||||
]
|
apt-get install -yo DPkg::options::=--force-confold dns-root-data fail2ban ufw unattended-upgrades unbound
|
||||||
}
|
apt-get install -yo DPkg::options::=--force-confold linux-headers-$(uname -r) openresolv wireguard
|
||||||
|
apt-get install -yo DPkg::options::=--force-confold htop iperf3 qrencode nano ssh-import-id
|
||||||
provisioner "shell" {
|
apt-get autoremove -y
|
||||||
inline = [
|
EOF
|
||||||
"systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service",
|
,
|
||||||
"systemctl enable --now wg-quick@wg0.service"
|
<<EOF
|
||||||
]
|
systemctl disable --now systemd-resolved.service
|
||||||
}
|
unlink /etc/resolv.conf && printf 'nameserver 127.0.0.1\n' > /etc/resolv.conf
|
||||||
|
systemctl enable --now unbound.service unbound-resolvconf.service
|
||||||
provisioner "shell" {
|
EOF
|
||||||
inline = [
|
,
|
||||||
"ufw --force enable",
|
<<EOF
|
||||||
"ufw default deny incoming",
|
systemctl enable --now fail2ban.service ufw.service unattended-upgrades.service
|
||||||
"ufw default allow outgoing",
|
systemctl enable --now wg-quick@wg0.service
|
||||||
"ufw allow from any to any port 22 proto tcp"
|
EOF
|
||||||
]
|
,
|
||||||
}
|
<<EOF
|
||||||
|
ufw --force enable
|
||||||
provisioner "shell" {
|
ufw default deny incoming
|
||||||
inline = [
|
ufw default allow outgoing
|
||||||
"groupadd -r ssh-user",
|
ufw allow from any to any port 22 proto tcp
|
||||||
"usermod -aG ssh-user root",
|
EOF
|
||||||
"passwd -d root"
|
,
|
||||||
]
|
<<EOF
|
||||||
}
|
groupadd -r ssh-user
|
||||||
|
usermod -aG ssh-user root
|
||||||
provisioner "shell" {
|
passwd -d root
|
||||||
inline = [
|
EOF
|
||||||
"rm -f /etc/ssh/ssh_host_*key*",
|
,
|
||||||
"rm -f /etc/wireguard/*-*key",
|
<<EOF
|
||||||
"rm -f /etc/wireguard/*-iface",
|
rm -f /etc/ssh/ssh_host_*key*
|
||||||
"rm -rf /var/lib/apt/lists/*"
|
rm -f /etc/wireguard/*-*key
|
||||||
|
rm -f /etc/wireguard/*-iface
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
EOF
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user