Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
template version of this cloud-config: http://blog.mapstrata.com/coreos-install-to-a-vps/
#cloud-config
hostname: HOSTNAME
write_files:
- path: /etc/iptables.rules
permissions: 0644
content: |
*filter
:INPUT DROP [13:1170]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [142:13212]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport SSH -j ACCEPT
COMMIT
coreos:
etcd:
addr: $private_ipv4:4001
peer-addr: $private_ipv4:7001
units:
- name: etcd.service
command: start
- name: fleet.service
command: start
- name: static.network
content: |
[Match]
Name=DEVICE
[Network]
Address=ADDRESS
Gateway=GATEWAY
DNS=NS1
DNS=NS2
- name: iptables.service
command: start
content: |
[Unit]
Description=Packet Filtering Framework
DefaultDependencies=no
After=systemd-sysctl.service
Before=sysinit.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/iptables-restore /etc/iptables.rules
ExecReload=/usr/sbin/iptables-restore /etc/iptables.rules
ExecStop=/usr/sbin/iptables --flush
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
users:
- name: core
ssh-authorized-keys:
- PUBKEY
- groups:
- sudo
- docker
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment