hetzner-k3s 0.6.1 → 0.6.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile.lock +1 -1
- data/README.md +76 -26
- data/cluster_config.yaml.example +39 -0
- data/lib/hetzner/infra/client.rb +4 -4
- data/lib/hetzner/infra/firewall.rb +1 -2
- data/lib/hetzner/infra/load_balancer.rb +1 -1
- data/lib/hetzner/infra/server.rb +28 -24
- data/lib/hetzner/k3s/cluster.rb +71 -440
- data/lib/hetzner/k3s/configuration.rb +12 -13
- data/lib/hetzner/k3s/version.rb +1 -1
- data/lib/hetzner/kubernetes/client.rb +475 -0
- data/lib/hetzner/utils.rb +4 -7
- metadata +3 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 2bbaf7bd5387cc92f0725308a42f982df7b47596d5d1a3d50693cf3b6a741359
|
|
4
|
+
data.tar.gz: 0617b66a6ca8299c5c5ada69c586a532e915657c857c6f6821cd81d29c17a774
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a457da09e05ac40da2d0b40de65193f16ecd42ae926f6d59271ca9fedc77587faf2bb90b4c4a62e326e509076b0f44e84062fb6c72536e5e8c1ce4b716d56813
|
|
7
|
+
data.tar.gz: '0628cf98daa772f50251257b626ca148420d1a8853618652c9fd7dd6750694393d9902ea684c786029e0db3bcf8d01729aa217e9fc3c070067fbbe6afb395dd8'
|
data/Gemfile.lock
CHANGED
data/README.md
CHANGED
|
@@ -1,6 +1,20 @@
|
|
|
1
1
|
# Create production grade Kubernetes clusters in Hetzner Cloud in a couple of minutes or less
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
|
|
14
|
+
|
|
15
|
+
## What is this?
|
|
16
|
+
|
|
17
|
+
This is a CLI tool to quickly create and manage Kubernetes clusters in [Hetzner Cloud](https://www.hetzner.com/cloud) using the lightweight Kubernetes distribution [k3s](https://k3s.io/) from [Rancher](https://rancher.com/).
|
|
4
18
|
|
|
5
19
|
Hetzner Cloud is an awesome cloud provider which offers a truly great service with the best performance/cost ratio in the market. With Hetzner's Cloud Controller Manager and CSI driver you can provision load balancers and persistent volumes very easily.
|
|
6
20
|
|
|
@@ -8,7 +22,7 @@ k3s is my favorite Kubernetes distribution now because it uses much less memory
|
|
|
8
22
|
|
|
9
23
|
Using this tool, creating a highly available k3s cluster with 3 masters for the control plane and 3 worker nodes takes about **a couple of minutes** only. This includes
|
|
10
24
|
|
|
11
|
-
- creating the
|
|
25
|
+
- creating the infrastructure resources (servers, private network, firewall, load balancer for the API server for HA clusters)
|
|
12
26
|
- deploying k3s to the nodes
|
|
13
27
|
- installing the [Hetzner Cloud Controller Manager](https://github.com/hetznercloud/hcloud-cloud-controller-manager) to provision load balancers right away
|
|
14
28
|
- installing the [Hetzner CSI Driver](https://github.com/hetznercloud/csi-driver) to provision persistent volumes using Hetzner's block storage
|
|
@@ -18,30 +32,47 @@ See roadmap [here](https://github.com/vitobotta/hetzner-k3s/projects/1) for the
|
|
|
18
32
|
|
|
19
33
|
Also see this [wiki page](https://github.com/vitobotta/hetzner-k3s/wiki/Tutorial:---Setting-up-a-cluster) for a tutorial on how to set up a cluster with the most common setup to get you started.
|
|
20
34
|
|
|
21
|
-
|
|
35
|
+
___
|
|
36
|
+
## Who am I?
|
|
37
|
+
|
|
38
|
+
I'm a Senior Backend Engineer and DevOps based in Finland and working for event management platform [Brella](https://www.brella.io/).
|
|
39
|
+
|
|
40
|
+
I also write a [technical blog](https://vitobotta.com/) on programming, DevOps and related technologies.
|
|
41
|
+
|
|
42
|
+
___
|
|
43
|
+
## Prerequisites
|
|
22
44
|
|
|
23
45
|
All that is needed to use this tool is
|
|
24
46
|
|
|
25
47
|
- an Hetzner Cloud account
|
|
26
|
-
- an Hetzner Cloud token: for this you need to create a project from the cloud console, and then an API token with **both read and write permissions** (sidebar > Security > API Tokens); you will see the token only once, so
|
|
27
|
-
- a recent Ruby runtime installed (see [this page](https://www.ruby-lang.org/en/documentation/installation/) for instructions if you are not familiar with Ruby). I
|
|
48
|
+
- an Hetzner Cloud token: for this you need to create a project from the cloud console, and then an API token with **both read and write permissions** (sidebar > Security > API Tokens); you will see the token only once, so be sure to take note of it somewhere safe
|
|
49
|
+
- a recent Ruby runtime installed if you install the tool as Ruby gem (see [this page](https://www.ruby-lang.org/en/documentation/installation/) for instructions if you are not familiar with Ruby). I recommend you use the standalone binaries either downloaded directly or installed with Homebrew though, since it's easier and you don't have to set up Ruby.
|
|
50
|
+
|
|
51
|
+
___
|
|
52
|
+
## Getting Started - Installation
|
|
28
53
|
|
|
29
|
-
|
|
54
|
+
Before using the tool, be sure to have kubectl installed as it's required to install some software in the cluster to provision load balancers/persistent volumes and perform k3s upgrades.
|
|
30
55
|
|
|
31
|
-
|
|
56
|
+
### macOS
|
|
57
|
+
|
|
58
|
+
#### With Homebrew
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
brew install vitobotta/tap/hetzner_k3s
|
|
62
|
+
```
|
|
32
63
|
|
|
33
|
-
|
|
64
|
+
#### Binary installation (Intel)
|
|
34
65
|
|
|
35
66
|
```bash
|
|
36
|
-
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.
|
|
67
|
+
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.3/hetzner-k3s-mac-amd64
|
|
37
68
|
chmod +x hetzner-k3s-mac-x64
|
|
38
69
|
sudo mv hetzner-k3s-mac-x64 /usr/local/bin/hetzner-k3s
|
|
39
70
|
```
|
|
40
71
|
|
|
41
|
-
|
|
72
|
+
#### Binary installation (Apple Silicon/M1)
|
|
42
73
|
|
|
43
74
|
```bash
|
|
44
|
-
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.
|
|
75
|
+
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.3/hetzner-k3s-mac-arm64
|
|
45
76
|
chmod +x hetzner-k3s-mac-arm
|
|
46
77
|
sudo mv hetzner-k3s-mac-arm /usr/local/bin/hetzner-k3s
|
|
47
78
|
```
|
|
@@ -51,12 +82,14 @@ NOTE: currently the ARM version still requires [Rosetta](https://support.apple.c
|
|
|
51
82
|
### Linux
|
|
52
83
|
|
|
53
84
|
```bash
|
|
54
|
-
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.
|
|
55
|
-
chmod +x hetzner-k3s-linux-
|
|
56
|
-
sudo mv hetzner-k3s-linux-
|
|
85
|
+
wget https://github.com/vitobotta/hetzner-k3s/releases/download/v0.6.3/hetzner-k3s-linux-x86_64
|
|
86
|
+
chmod +x hetzner-k3s-linux-x86_64
|
|
87
|
+
sudo mv hetzner-k3s-linux-x86_64 /usr/local/bin/hetzner-k3s
|
|
57
88
|
```
|
|
58
89
|
|
|
59
|
-
###
|
|
90
|
+
### macOS, Linux, Windows
|
|
91
|
+
|
|
92
|
+
#### As Ruby gem executable
|
|
60
93
|
|
|
61
94
|
Once you have the Ruby runtime up and running (2.7.1 required), you just need to install the gem:
|
|
62
95
|
|
|
@@ -66,7 +99,7 @@ gem install hetzner-k3s
|
|
|
66
99
|
|
|
67
100
|
This will install the `hetzner-k3s` executable in your PATH.
|
|
68
101
|
|
|
69
|
-
|
|
102
|
+
#### With Docker
|
|
70
103
|
|
|
71
104
|
Alternatively, if you don't want to set up a Ruby runtime but have Docker installed, you can use a container. Run the following from inside the directory where you have the config file for the cluster (described in the next section):
|
|
72
105
|
|
|
@@ -74,13 +107,15 @@ Alternatively, if you don't want to set up a Ruby runtime but have Docker instal
|
|
|
74
107
|
docker run --rm -it \
|
|
75
108
|
-v ${PWD}:/cluster \
|
|
76
109
|
-v ${HOME}/.ssh:/tmp/.ssh \
|
|
77
|
-
vitobotta/hetzner-k3s:v0.6.
|
|
110
|
+
vitobotta/hetzner-k3s:v0.6.3 \
|
|
78
111
|
create-cluster \
|
|
79
112
|
--config-file /cluster/test.yaml
|
|
80
113
|
```
|
|
81
114
|
|
|
82
115
|
Replace `test.yaml` with the name of your config file.
|
|
83
116
|
|
|
117
|
+
___
|
|
118
|
+
|
|
84
119
|
## Creating a cluster
|
|
85
120
|
|
|
86
121
|
The tool requires a simple configuration file in order to create/upgrade/delete clusters, in the YAML format like in the example below:
|
|
@@ -103,10 +138,20 @@ schedule_workloads_on_masters: false
|
|
|
103
138
|
masters:
|
|
104
139
|
instance_type: cpx21
|
|
105
140
|
instance_count: 3
|
|
141
|
+
# labels:
|
|
142
|
+
# purpose: master
|
|
143
|
+
# size: cpx21
|
|
144
|
+
# taints:
|
|
145
|
+
# something: value1:NoSchedule
|
|
106
146
|
worker_node_pools:
|
|
107
147
|
- name: small
|
|
108
148
|
instance_type: cpx21
|
|
109
149
|
instance_count: 4
|
|
150
|
+
# labels:
|
|
151
|
+
# purpose: worker
|
|
152
|
+
# size: cpx21
|
|
153
|
+
# taints:
|
|
154
|
+
# something: GpuWorkloadsOnly:NoSchedule
|
|
110
155
|
- name: big
|
|
111
156
|
instance_type: cpx31
|
|
112
157
|
instance_count: 2
|
|
@@ -137,10 +182,9 @@ enable_encryption: true
|
|
|
137
182
|
# - arg1
|
|
138
183
|
# - ...
|
|
139
184
|
# existing_network: <specify if you want to use an existing network, otherwise one will be created for this cluster>
|
|
140
|
-
|
|
141
185
|
```
|
|
142
186
|
|
|
143
|
-
It should hopefully be self explanatory; you can run `hetzner-k3s releases` to see a list of the available releases
|
|
187
|
+
It should hopefully be self explanatory; you can run `hetzner-k3s releases` to see a list of the available k3s releases.
|
|
144
188
|
|
|
145
189
|
If you are using Docker, then set `kubeconfig_path` to `/cluster/kubeconfig` so that the kubeconfig is created in the same directory where your config file is. Also set the config file path to `/cluster/<filename>`.
|
|
146
190
|
|
|
@@ -149,7 +193,6 @@ If you don't want to specify the Hetzner token in the config file (for example i
|
|
|
149
193
|
**Important**: The tool assignes the label `cluster` to each server it creates, with the cluster name you specify in the config file, as the value. So please ensure you don't create unrelated servers in the same project having
|
|
150
194
|
the label `cluster=<cluster name>`, because otherwise they will be deleted if you delete the cluster. I recommend you create a separate Hetzner project for each cluster, see note at the end of this README for more details.
|
|
151
195
|
|
|
152
|
-
|
|
153
196
|
If you set `masters.instance_count` to 1 then the tool will create a non highly available control plane; for production clusters you may want to set it to a number greater than 1. This number must be odd to avoid split brain issues with etcd and the recommended number is 3.
|
|
154
197
|
|
|
155
198
|
You can specify any number of worker node pools for example to have mixed nodes with different specs for different workloads.
|
|
@@ -188,7 +231,7 @@ Finally, to create the cluster run:
|
|
|
188
231
|
hetzner-k3s create-cluster --config-file cluster_config.yaml
|
|
189
232
|
```
|
|
190
233
|
|
|
191
|
-
This will take a
|
|
234
|
+
This will take a few minutes depending on the number of masters and worker nodes.
|
|
192
235
|
|
|
193
236
|
If you are creating an HA cluster and see the following in the output you can safely ignore it - it happens when additional masters are joining the first one:
|
|
194
237
|
|
|
@@ -229,6 +272,7 @@ In a future relese I will add some automation for the cleanup.
|
|
|
229
272
|
|
|
230
273
|
It's easy to convert a non-HA with a single master cluster to HA with multiple masters. Just change the masters instance count and re-run the create command. This will create a load balancer for the API server and update the kubeconfig so that all the API requests go through the load balancer.
|
|
231
274
|
|
|
275
|
+
___
|
|
232
276
|
## Upgrading to a new version of k3s
|
|
233
277
|
|
|
234
278
|
If it's the first time you upgrade the cluster, all you need to do to upgrade it to a newer version of k3s is run the following command:
|
|
@@ -277,7 +321,7 @@ A final note about upgrades is that if for some reason the upgrade gets stuck af
|
|
|
277
321
|
```bash
|
|
278
322
|
kubectl label node <master1> <master2> <master2> plan.upgrade.cattle.io/k3s-server=upgraded
|
|
279
323
|
```
|
|
280
|
-
|
|
324
|
+
___
|
|
281
325
|
## Upgrading the OS on nodes
|
|
282
326
|
|
|
283
327
|
- consider adding a temporary node during the process if you don't have enough spare capacity in the cluster
|
|
@@ -287,6 +331,7 @@ kubectl label node <master1> <master2> <master2> plan.upgrade.cattle.io/k3s-serv
|
|
|
287
331
|
- uncordon
|
|
288
332
|
- proceed with the next node
|
|
289
333
|
|
|
334
|
+
___
|
|
290
335
|
## Deleting a cluster
|
|
291
336
|
|
|
292
337
|
To delete a cluster, running
|
|
@@ -297,7 +342,11 @@ hetzner-k3s delete-cluster --config-file cluster_config.yaml
|
|
|
297
342
|
|
|
298
343
|
This will delete all the resources in the Hetzner Cloud project for the cluster being deleted.
|
|
299
344
|
|
|
345
|
+
## Troubleshooting
|
|
346
|
+
|
|
347
|
+
See [this page](https://github.com/vitobotta/hetzner-k3s/wiki/Troubleshooting) for solutions to common issues.
|
|
300
348
|
|
|
349
|
+
___
|
|
301
350
|
## Additional info
|
|
302
351
|
|
|
303
352
|
### Load balancers
|
|
@@ -323,16 +372,15 @@ The annotation `load-balancer.hetzner.cloud/use-private-ip: "true"` ensures that
|
|
|
323
372
|
|
|
324
373
|
The other annotations should be self explanatory. You can find a list of the available annotations [here](https://pkg.go.dev/github.com/hetznercloud/hcloud-cloud-controller-manager/internal/annotation).
|
|
325
374
|
|
|
326
|
-
|
|
375
|
+
### Persistent volumes
|
|
327
376
|
|
|
328
377
|
Once the cluster is ready you can create persistent volumes out of the box with the default storage class `hcloud-volumes`, since the Hetzner CSI driver is installed automatically. This will use Hetzner's block storage (based on Ceph so it's replicated and highly available) for your persistent volumes. Note that the minimum size of a volume is 10Gi. If you specify a smaller size for a volume, the volume will be created with a capacity of 10Gi anyway.
|
|
329
378
|
|
|
330
|
-
|
|
331
|
-
## Keeping a project per cluster
|
|
379
|
+
### Keeping a project per cluster
|
|
332
380
|
|
|
333
381
|
I recommend that you create a separate Hetzner project for each cluster, because otherwise multiple clusters will attempt to create overlapping routes. I will make the pod cidr configurable in the future to avoid this, but I still recommend keeping clusters separated from each other. This way, if you want to delete a cluster with all the resources created for it, you can just delete the project.
|
|
334
382
|
|
|
335
|
-
|
|
383
|
+
___
|
|
336
384
|
## Contributing and support
|
|
337
385
|
|
|
338
386
|
Please create a PR if you want to propose any changes, or open an issue if you are having trouble with the tool - I will do my best to help if I can.
|
|
@@ -341,10 +389,12 @@ Contributors:
|
|
|
341
389
|
|
|
342
390
|
- [TitanFighter](https://github.com/TitanFighter) for [this awesome tutorial](https://github.com/vitobotta/hetzner-k3s/wiki/Tutorial:---Setting-up-a-cluster)
|
|
343
391
|
|
|
392
|
+
___
|
|
344
393
|
## License
|
|
345
394
|
|
|
346
395
|
The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
|
|
347
396
|
|
|
397
|
+
___
|
|
348
398
|
## Code of Conduct
|
|
349
399
|
|
|
350
400
|
Everyone interacting in the hetzner-k3s project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/vitobotta/hetzner-k3s/blob/main/CODE_OF_CONDUCT.md).
|
data/cluster_config.yaml.example
CHANGED
|
@@ -7,16 +7,55 @@ public_ssh_key_path: "~/.ssh/id_rsa.pub"
|
|
|
7
7
|
private_ssh_key_path: "~/.ssh/id_rsa"
|
|
8
8
|
ssh_allowed_networks:
|
|
9
9
|
- 0.0.0.0/0
|
|
10
|
+
api_allowed_networks:
|
|
11
|
+
- 0.0.0.0/0
|
|
10
12
|
verify_host_key: false
|
|
11
13
|
location: nbg1
|
|
12
14
|
schedule_workloads_on_masters: false
|
|
13
15
|
masters:
|
|
14
16
|
instance_type: cpx21
|
|
15
17
|
instance_count: 3
|
|
18
|
+
# labels:
|
|
19
|
+
# purpose: master
|
|
20
|
+
# size: cpx21
|
|
21
|
+
# taints:
|
|
22
|
+
# something: value1:NoSchedule
|
|
16
23
|
worker_node_pools:
|
|
17
24
|
- name: small
|
|
18
25
|
instance_type: cpx21
|
|
19
26
|
instance_count: 4
|
|
27
|
+
# labels:
|
|
28
|
+
# purpose: worker
|
|
29
|
+
# size: cpx21
|
|
30
|
+
# taints:
|
|
31
|
+
# something: GpuWorkloadsOnly:NoSchedule
|
|
20
32
|
- name: big
|
|
21
33
|
instance_type: cpx31
|
|
22
34
|
instance_count: 2
|
|
35
|
+
additional_packages:
|
|
36
|
+
- somepackage
|
|
37
|
+
post_create_commands:
|
|
38
|
+
- apt update
|
|
39
|
+
- apt upgrade -y
|
|
40
|
+
- apt autoremove -y
|
|
41
|
+
- shutdown -r now
|
|
42
|
+
enable_encryption: true
|
|
43
|
+
# kube_api_server_args:
|
|
44
|
+
# - arg1
|
|
45
|
+
# - ...
|
|
46
|
+
# kube_scheduler_args:
|
|
47
|
+
# - arg1
|
|
48
|
+
# - ...
|
|
49
|
+
# kube_controller_manager_args:
|
|
50
|
+
# - arg1
|
|
51
|
+
# - ...
|
|
52
|
+
# kube_cloud_controller_manager_args:
|
|
53
|
+
# - arg1
|
|
54
|
+
# - ...
|
|
55
|
+
# kubelet_args:
|
|
56
|
+
# - arg1
|
|
57
|
+
# - ...
|
|
58
|
+
# kube_proxy_args:
|
|
59
|
+
# - arg1
|
|
60
|
+
# - ...
|
|
61
|
+
# existing_network: <specify if you want to use an existing network, otherwise one will be created for this cluster>
|
data/lib/hetzner/infra/client.rb
CHANGED
|
@@ -6,10 +6,6 @@ module Hetzner
|
|
|
6
6
|
|
|
7
7
|
attr_reader :token
|
|
8
8
|
|
|
9
|
-
def initialize(token:)
|
|
10
|
-
@token = token
|
|
11
|
-
end
|
|
12
|
-
|
|
13
9
|
def get(path)
|
|
14
10
|
make_request do
|
|
15
11
|
JSON.parse HTTParty.get(BASE_URI + path, headers: headers).body
|
|
@@ -30,6 +26,10 @@ module Hetzner
|
|
|
30
26
|
|
|
31
27
|
private
|
|
32
28
|
|
|
29
|
+
def initialize(token:)
|
|
30
|
+
@token = token
|
|
31
|
+
end
|
|
32
|
+
|
|
33
33
|
def headers
|
|
34
34
|
{
|
|
35
35
|
'Authorization' => "Bearer #{@token}",
|
|
@@ -33,8 +33,7 @@ module Hetzner
|
|
|
33
33
|
puts 'Deleting firewall...'
|
|
34
34
|
|
|
35
35
|
servers.each do |server|
|
|
36
|
-
hetzner_client.post("/firewalls/#{firewall['id']}/actions/remove_from_resources",
|
|
37
|
-
remove_targets_config(server['id']))
|
|
36
|
+
hetzner_client.post("/firewalls/#{firewall['id']}/actions/remove_from_resources", remove_targets_config(server['id']))
|
|
38
37
|
end
|
|
39
38
|
|
|
40
39
|
hetzner_client.delete('/firewalls', firewall['id'])
|
|
@@ -33,8 +33,8 @@ module Hetzner
|
|
|
33
33
|
puts 'Deleting API load balancer...' unless high_availability
|
|
34
34
|
|
|
35
35
|
hetzner_client.post("/load_balancers/#{load_balancer['id']}/actions/remove_target", remove_targets_config)
|
|
36
|
-
|
|
37
36
|
hetzner_client.delete('/load_balancers', load_balancer['id'])
|
|
37
|
+
|
|
38
38
|
puts '...API load balancer deleted.' unless high_availability
|
|
39
39
|
elsif high_availability
|
|
40
40
|
puts 'API load balancer no longer exists, skipping.'
|
data/lib/hetzner/infra/server.rb
CHANGED
|
@@ -59,30 +59,6 @@ module Hetzner
|
|
|
59
59
|
end
|
|
60
60
|
|
|
61
61
|
def user_data
|
|
62
|
-
packages = %w[fail2ban wireguard]
|
|
63
|
-
packages += additional_packages if additional_packages
|
|
64
|
-
packages = "'#{packages.join("', '")}'"
|
|
65
|
-
|
|
66
|
-
post_create_commands = [
|
|
67
|
-
'crontab -l > /etc/cron_bkp',
|
|
68
|
-
'echo "@reboot echo true > /etc/ready" >> /etc/cron_bkp',
|
|
69
|
-
'crontab /etc/cron_bkp',
|
|
70
|
-
'sed -i \'s/[#]*PermitRootLogin yes/PermitRootLogin prohibit-password/g\' /etc/ssh/sshd_config',
|
|
71
|
-
'sed -i \'s/[#]*PasswordAuthentication yes/PasswordAuthentication no/g\' /etc/ssh/sshd_config',
|
|
72
|
-
'systemctl restart sshd',
|
|
73
|
-
'systemctl stop systemd-resolved',
|
|
74
|
-
'systemctl disable systemd-resolved',
|
|
75
|
-
'rm /etc/resolv.conf',
|
|
76
|
-
'echo \'nameserver 1.1.1.1\' > /etc/resolv.conf',
|
|
77
|
-
'echo \'nameserver 1.0.0.1\' >> /etc/resolv.conf'
|
|
78
|
-
]
|
|
79
|
-
|
|
80
|
-
post_create_commands += additional_post_create_commands if additional_post_create_commands
|
|
81
|
-
|
|
82
|
-
post_create_commands += ['shutdown -r now'] if post_create_commands.grep(/shutdown|reboot/).grep_v(/@reboot/).empty?
|
|
83
|
-
|
|
84
|
-
post_create_commands = " - #{post_create_commands.join("\n - ")}"
|
|
85
|
-
|
|
86
62
|
<<~YAML
|
|
87
63
|
#cloud-config
|
|
88
64
|
packages: [#{packages}]
|
|
@@ -125,5 +101,33 @@ module Hetzner
|
|
|
125
101
|
|
|
126
102
|
JSON.parse(response_body)['server']
|
|
127
103
|
end
|
|
104
|
+
|
|
105
|
+
def post_create_commands
|
|
106
|
+
commands = [
|
|
107
|
+
'crontab -l > /etc/cron_bkp',
|
|
108
|
+
'echo "@reboot echo true > /etc/ready" >> /etc/cron_bkp',
|
|
109
|
+
'crontab /etc/cron_bkp',
|
|
110
|
+
'sed -i \'s/[#]*PermitRootLogin yes/PermitRootLogin prohibit-password/g\' /etc/ssh/sshd_config',
|
|
111
|
+
'sed -i \'s/[#]*PasswordAuthentication yes/PasswordAuthentication no/g\' /etc/ssh/sshd_config',
|
|
112
|
+
'systemctl restart sshd',
|
|
113
|
+
'systemctl stop systemd-resolved',
|
|
114
|
+
'systemctl disable systemd-resolved',
|
|
115
|
+
'rm /etc/resolv.conf',
|
|
116
|
+
'echo \'nameserver 1.1.1.1\' > /etc/resolv.conf',
|
|
117
|
+
'echo \'nameserver 1.0.0.1\' >> /etc/resolv.conf'
|
|
118
|
+
]
|
|
119
|
+
|
|
120
|
+
commands += additional_post_create_commands if additional_post_create_commands
|
|
121
|
+
|
|
122
|
+
commands << 'shutdown -r now' if commands.grep(/shutdown|reboot/).grep_v(/@reboot/).empty?
|
|
123
|
+
|
|
124
|
+
" - #{commands.join("\n - ")}"
|
|
125
|
+
end
|
|
126
|
+
|
|
127
|
+
def packages
|
|
128
|
+
packages = %w[fail2ban wireguard]
|
|
129
|
+
packages += additional_packages if additional_packages
|
|
130
|
+
"'#{packages.join("', '")}'"
|
|
131
|
+
end
|
|
128
132
|
end
|
|
129
133
|
end
|