feat: add Debian 13 golden image Packer pipeline and cloud-init bootstrap

2026-08-30 19:48:22 +03:00
1 parent b72b961968
commit 6123c3f6b4
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== [1/5] Configuring Debian Repositories for OpenZFS DKMS ==="
+# Enable contrib and non-free-firmware for zfs-dkms
+sed -i 's/Components: main/Components: main contrib non-free-firmware/g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+sed -i 's/main$/main contrib non-free-firmware/g' /etc/apt/sources.list 2>/dev/null || true
+
+apt-get update
+apt-get install -y --no-install-recommends linux-headers-amd64 zfsutils-linux zfs-dkms
+
+# Pre-compile DKMS modules during bake time so first boot has zero compilation delay
+systemctl enable zfs-import-cache zfs-import.target zfs.target || true
+
+echo "=== [2/5] Installing Docker CE from Official Debian Repository ==="
+for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
+  apt-get remove -y "$pkg" 2>/dev/null || true
+done
+
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+chmod a+r /etc/apt/keyrings/docker.asc
+
+echo \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
+  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+  tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+apt-get update
+apt-get install -y --no-install-recommends \
+  docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+mkdir -p /srv/docker
+cat << 'EOF_DOCKER' > /etc/docker/daemon.json
+{
+  "data-root": "/srv/docker",
+  "log-driver": "json-file",
+  "log-opts": {
+    "max-size": "20m",
+    "max-file": "3"
+  }
+}
+EOF_DOCKER
+systemctl enable docker.service containerd.service
+
+echo "=== [3/5] Installing and Configuring UFW + ufw-docker ==="
+apt-get install -y --no-install-recommends ufw iptables
+
+curl -fsSL https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker -o /usr/local/bin/ufw-docker
+chmod +x /usr/local/bin/ufw-docker
+
+# Pre-configure firewall baseline (keep port 22 open during build for Packer SSH session)
+ufw default deny incoming
+ufw default allow outgoing
+ufw default allow routed
+ufw allow 22/tcp comment 'SSH default for builder'
+ufw allow 2222/tcp comment 'SSH for Apex'
+ufw --force enable
+
+# Set up ufw-docker routing in after.rules (now that UFW is active)
+/usr/local/bin/ufw-docker install || true
+
+# Symlink into adam ~/.local/bin for engine compatibility
+mkdir -p /etc/skel/.local/bin
+ln -sf /usr/local/bin/ufw-docker /etc/skel/.local/bin/ufw-docker
+
+echo "=== [4/5] Hardening SSH Configuration ==="
+mkdir -p /etc/ssh/sshd_config.d
+cat << 'EOF_SSH' > /etc/ssh/sshd_config.d/99-apex.conf
+Port 2222
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no
+X11Forwarding no
+AllowUsers adam
+EOF_SSH
+
+echo "=== [5/5] Installing CrowdSec ==="
+# PackageCloud does not publish a dedicated 'trixie' suite yet; bookworm suite works seamlessly on Debian 13
+export os=debian
+export dist=bookworm
+if curl -fsSL https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash; then
+  apt-get update
+  apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables
+else
+  echo "PackageCloud script failed, falling back to Debian native repository..."
+  rm -f /etc/apt/sources.list.d/crowdsec*.list
+  apt-get update
+  apt-get install -y --no-install-recommends crowdsec crowdsec-firewall-bouncer-iptables || \
+  apt-get install -y --no-install-recommends crowdsec
+fi
+
+echo "=== Docker, ZFS & Security Stack Complete ==="