#cloud-config
# Minimal bootstrap: ensure python3 (for Ansible) and basic hardening.
# Everything else is handled by Ansible.

package_update: true
package_upgrade: true

packages:
  - python3
  - python3-libselinux
  - dnf-plugins-core

ssh_pwauth: false
disable_root: false

write_files:
  - path: /etc/ssh/sshd_config.d/10-watchtower.conf
    permissions: "0644"
    content: |
      PasswordAuthentication no
      PermitRootLogin prohibit-password
      PubkeyAuthentication yes
      KbdInteractiveAuthentication no

runcmd:
  - systemctl restart sshd
  - timedatectl set-timezone Europe/Berlin