28 lines
601 B
YAML
28 lines
601 B
YAML
#cloud-config
|
|
# Minimal bootstrap: ensure python3 (for Ansible) and basic hardening.
|
|
# Everything else is handled by Ansible.
|
|
|
|
package_update: true
|
|
package_upgrade: true
|
|
|
|
packages:
|
|
- python3
|
|
- python3-libselinux
|
|
- dnf-plugins-core
|
|
|
|
ssh_pwauth: false
|
|
disable_root: false
|
|
|
|
write_files:
|
|
- path: /etc/ssh/sshd_config.d/10-watchtower.conf
|
|
permissions: "0644"
|
|
content: |
|
|
PasswordAuthentication no
|
|
PermitRootLogin prohibit-password
|
|
PubkeyAuthentication yes
|
|
KbdInteractiveAuthentication no
|
|
|
|
runcmd:
|
|
- systemctl restart sshd
|
|
- timedatectl set-timezone Europe/Berlin
|