ignition.json

{
  "ignition": {
    "config": {},
    "timeouts": {},
    "version": "2.1.0"
  },
  "networkd": {},
  "passwd": {
    "users": [
      {
        "name": "core",
        "sshAuthorizedKeys": [
          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrOJ0dRoMpSrSb9pQhd6bzFzoMpCKsBU2z1NlwEgR1zB5kQoE27fJ9csrncLod2lp5MhUWxGi8ar2HtNTjcGZUGV5vtt7DyR5F2nEgdhJF7MbJaSdThzjUPKQUW6xoQuo09+8KsHnjGwTsjV/hepg+WzkKOfrk2EuxDqhSxvM8X2meSyxPFN6yrAU8yc0WTbZ/IoLhgXuGfkQ8TK301XclFF3BWQSLKST1qZFkJEDfwV+H3E+TI4ec7ljj2uz+rgqLhPv5ia/Nv3GLDKFaSuWmaIpr/zn+U2eWv89BpvXp1AmIGJGbukgbRiGrHR4Sft7hKqx0fug/KXacck1gbczJ blake@Blakes-MacBook-Pro.local"
        ]
      }
    ]
  },
  "storage": {
    "files": [
      {
        "filesystem": "root",
        "group": {},
        "path": "/var/lib/iptables/rules-save",
        "user": {},
        "contents": {
          "source": "data:,*filter%0A%3AINPUT%20DROP%20%5B0%3A0%5D%0A%3AFORWARD%20DROP%20%5B0%3A0%5D%0A%3AOUTPUT%20ACCEPT%20%5B0%3A0%5D%0A%0A%23%20Create%20chain%20for%20sshguard%0A-N%20sshguard%0A%0A%23%20Block%20sshguard%20ips%0A-A%20INPUT%20-j%20sshguard%0A%0A%23%20Accept%20all%20loopback%20(local)%20traffic%3A%0A-A%20INPUT%20-i%20lo%20-j%20ACCEPT%0A%0A%23%20Keep%20existing%20connections%20(like%20our%20SSH%20session)%20alive%3A%0A-A%20INPUT%20-m%20conntrack%20--ctstate%20RELATED%2CESTABLISHED%20-j%20ACCEPT%0A%0A%23%20SSH%0A-A%20INPUT%20-p%20tcp%20-m%20tcp%20--dport%2022%20-j%20ACCEPT%0A%0A%23%20Accept%20pings%3A%0A-A%20INPUT%20-p%20icmp%20-m%20icmp%20--icmp-type%200%20-j%20ACCEPT%0A-A%20INPUT%20-p%20icmp%20-m%20icmp%20--icmp-type%203%20-j%20ACCEPT%0A-A%20INPUT%20-p%20icmp%20-m%20icmp%20--icmp-type%2011%20-j%20ACCEPT%0ACOMMIT%0A",
          "verification": {}
        }
      }
    ]
  },
  "systemd": {
    "units": [
      {
        "enable": true,
        "name": "iptables-restore.service"
      },
      {
        "contents": "[Unit]\nDescription=sshguard\nAfter=network-online.target iptables-restore.service docker.service\nRequires=network-online.target docker.service\n\n[Service]\nTimeoutStartSec=0\nExecStartPre=-/usr/bin/docker kill %n\nExecStartPre=-/usr/bin/docker rm %n\nExecStartPre=/usr/bin/docker pull pablocouto/coreos-sshguard\n\nExecStart=/bin/sh -c 'journalctl --no-pager -f -n0 -q -t sshd | /usr/bin/docker run -i --name=%n -v /dev/log:/dev/log --net=host --cap-add=NET_ADMIN --cap-add=NET_RAW pablocouto/coreos-sshguard \u003e/dev/null'\n\nExecStop=/usr/bin/docker stop %n\nExecStop=/usr/bin/docker rm %n\n\n[Install]\nWantedBy=multi-user.target\n",
        "enable": true,
        "name": "sshguard.service"
      }
    ]
  }
}