Cloud-config for CoreOS IPXE deployment on Vultr. Provisioning etcd, fleet, private network and docker compatible firewall.

vultr-coreos-bootstrap.sh

#!/bin/bash
# Cloud-config for CoreOS IPXE deployment on Vultr
##################################################
# This cloud-config bootstraps CoreOS on /dev/vda and provisions:
# - private ip-address on eth1
# - basic firewall (docker compatible)
# - SSHd security hardening
##################################################
# Usage:
# 1. Fill in region, SSH Key and etcd token.
# Hint: generate a new token for each unique etcd cluster on https://discovery.etcd.io/new
# 2. Point the cloud-config-url parameter in your IPXE boot script to this file.
##################################################

REGION='vultr-fra'
SSH_KEY='ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC18geXIONNGR48On31uVczDNSI2G7CHLk6syqXfgPEQBkfro1mxy63FTGdc6ackMbYHLnw2lPpsnR3Je/+0O4impp+rKn8UGho873ITs5HUI18fUjavGuueiBj8eOg7ox5hINjrb84ZzjMULFMXY0SjM421kDzYxDBb95kYEQVTRjUSxwjxsBDv/1ZrCBnfXnGQKuz+lheR40PdkNHu4mDK5pgWaOAyh5cvyau2TC4M02MIJcMdFxViwhAsaulgQzHK4UIUjiEfeXx1UDsNWquexWRKZePtPdTfN5/YiCSMrYBW2TKJLJZ8ThzHiDty0VUNsPt/3JOdFClAfTiNbofNcmcaaf7TL2EovNKnJ01DHVnWjznE3bjPk30S2B8O4u+4cJObGai6ARLUZWjNI81cbGIQwjRJMcsUYDwvl+gl6KQ802yqV3uF1zmAE8qntneQWp13MfJnxWuN1n8eL8YKIuQYpvKTClzMCeVAeCviwxroEGVMEDs/fB+YevPWHi4EY5K5NgKDY0Hzrqqb3fduqXWcxlMy1hQ8/rVyT4XGpaVj3eABCdisiVh8QYdlCf6lNkIwnJOySJQq9Nxwqxb1bXtws/A2kK0v0bWxRMF2T18whJNIL6vh7wo0YYEtRrvSgYDnENNfJyhGYin/0+Fqrrrl2xQjqS+m0uP8GC+tw=='
# Don't edit below unless you know what you're doing
##################################################

V4_PRIVATE_IP=`curl -sS http://169.254.169.254/current/meta-data/local-ipv4`
V4_PUBLIC_IP=`curl -sS http://169.254.169.254/current/meta-data/public-ipv4`
INSTANCE_ID=`curl -sS http://169.254.169.254/current/meta-data/instance-id`

cat > "cloud-config.yaml" <<EOF
#cloud-config
hostname: $REGION-${INSTANCE_ID: -4}
ssh_authorized_keys:
  - $SSH_KEY
coreos:
  update:
    reboot-strategy: etcd-lock
  units:
    - name: vultr-meta.service
      command: start
      runtime: yes
      content: |
        [Unit]
        Description=Initialize Vultr private network

        [Service]
        Type=oneshot
        WorkingDirectory=/root
        ExecStart=/usr/bin/bash /root/vultr-privatenet.sh
    - name: iptables.service
      enable: false
    - name: iptables-restore.service
      enable: true
    - name: etcd.service
      command: start
    - name: fleet.service
      command: start
write_files:
    - path: /etc/environment
      permissions: 0644
      owner: "root:root"
      content: |
        COREOS_PRIVATE_IPV4=$V4_PRIVATE_IP
        COREOS_PUBLIC_IPV4=$V4_PUBLIC_IP
    - path: /etc/systemd/network/10-static-eth1.network
      permissions: 0644
      owner: "root:root"
      content: |
        [Match]
        Name=eth1
        [Link]
        MTUBytes=1450
        [Network]
        Address=$V4_PRIVATE_IP/16
    - path: /root/vultr-privatenet.sh
      permissions: 0755
      owner: "root:root"
      content: |
        #!/bin/bash        
        ip -4 addr add dev eth1 $V4_PRIVATE_IP/16
    - path: /var/lib/iptables/rules-save
      permissions: 0644
      owner: "root:root"
      content: |
        *filter
        :INPUT DROP [0:0]
        :FORWARD ACCEPT [0:0]
        :OUTPUT ACCEPT [0:0]
        -A INPUT -i lo -j ACCEPT
        -A INPUT -i eth1 -j ACCEPT
        -A INPUT -i docker0 -j ACCEPT
        -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A INPUT -m conntrack --ctstate NEW -m multiport -p tcp --dports 22,80,443,9345,9346 -j ACCEPT
        -A INPUT -m conntrack --ctstate NEW -m multiport -p udp --dports 500,4500 -j ACCEPT
        -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
        -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
        -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
        -A FORWARD -i docker0 -o eth1 -j ACCEPT
        -A FORWARD -i eth1 -o docker0 -j ACCEPT
        -A FORWARD -i eth0 -o docker0 -j ACCEPT
        -A FORWARD -i docker0 -o eth0 -j ACCEPT
        COMMIT
    - path: /etc/ssh/sshd_config
      permissions: 0600
      owner: "root:root"
      content: |
          # Use most defaults for sshd configuration.
          UsePrivilegeSeparation sandbox
          Subsystem sftp internal-sftp
   
          PermitRootLogin no
          AllowUsers core
          PasswordAuthentication no
          ChallengeResponseAuthentication no
    - path: /etc/motd.d/info.conf
      content: |
          ____________________________
          
          Private IP...: $V4_PRIVATE_IP
          Public IP....: $V4_PUBLIC_IP
          Region.......: $REGION
          ____________________________

EOF

sudo coreos-install -d /dev/vda -c cloud-config.yaml
sudo reboot