cloud-config.yml

#cloud-config

write_files:
  - path: /var/lib/iptables/rules-save
    permissions: 0644
    owner: root:root
    content: |
      *filter
      :INPUT DROP [0:0]
      :FORWARD DROP [0:0]
      :OUTPUT ACCEPT [0:0]
      -A INPUT -i lo -j ACCEPT
      -A OUTPUT -o lo -j ACCEPT
      -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
      -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
      -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
      -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "[IPTABLES INPUT] : "
      -A INPUT -j DROP
      -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "[IPTABLES FORWARD] : "
      -A FORWARD -j DROP
      COMMIT

coreos:
  units:
    - name: static.network
      content: |
        [Match]
        Name=eth0

        [Network]
        Address=${ADRESS}
        Gateway=${GATEWAY}
        DNS=${DNS1}
        DNS=${DNS2}

    - name: timezone.service
      command: start
      content: |
        [Unit]
        Description=timezone

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/bin/ln -sf ../usr/share/zoneinfo/Japan /etc/localtime

    - name: iptables.service
      command: start
      content: |
        [Unit]
        Description=Packet Filtering Framework
        DefaultDependencies=no
        After=systemd-sysctl.service
        Before=sysinit.target

        [Service]
        Type=oneshot
        ExecStart=/usr/sbin/iptables-restore /var/lib/iptables/rules-save
        ExecReload=/usr/sbin/iptables-restore /var/lib/iptables/rules-save
        ExecStop=/usr/sbin/iptables --flush
        RemainAfterExit=yes

        [Install]
        WantedBy=multi-user.target

users:
  - name: core
    ssh-authorized-keys:
      - ssh-rsa ${PUBLIC_KEY}
    groups:
      - sudo
      - docker