74eeabb354
Some checks failed
PR Checks / tofu-checks (pull_request) Failing after 2s
1/1 projects applied successfully.
Reusable OpenTofu module for creating isolated tenant VMs with: - Public IP on vmbr1 (bridged, firewall=true) - Cloud-init: password auth, fail2ban, UFW hardening - Per-VM Proxmox firewall (IN: SSH+ICMP, OUT: allow, block SMTP) Includes test-tenant VM (185.47.204.227) for verification. Changes: - modules/tenant-vm/ — reusable module (VM + FW + cloud-init) - environments/production/tenant-vms.tf — tenant VM definitions - policies/security.rego — require firewall=true on vmbr1 - atlantis.yaml — trigger on module file changes - main.tf — updated host prerequisites comment Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
34 lines
537 B
Plaintext
34 lines
537 B
Plaintext
#cloud-config
|
|
|
|
hostname: ${hostname}
|
|
manage_etc_hosts: true
|
|
|
|
users:
|
|
- name: ${username}
|
|
lock_passwd: false
|
|
ssh_authorized_keys:
|
|
- ${ssh_key}
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
shell: /bin/bash
|
|
|
|
chpasswd:
|
|
expire: false
|
|
users:
|
|
- name: ${username}
|
|
password: ${password}
|
|
type: text
|
|
|
|
ssh_pwauth: true
|
|
|
|
package_update: true
|
|
packages:
|
|
- fail2ban
|
|
- ufw
|
|
|
|
runcmd:
|
|
- ufw default deny incoming
|
|
- ufw default allow outgoing
|
|
- ufw allow 22/tcp
|
|
- ufw --force enable
|
|
- systemctl enable --now fail2ban
|