#cloud-config

ssh_deletekeys: true

disable_root: false

users:
- name: root
  ssh_authorized_keys:
  - {{ ssh_key }}

- name: jingrow
  ssh_authorized_keys:
  - {{ ssh_key }}

runcmd:
- mkdir /etc/ssh/auth_principals
- curl http://npm.jingrow.com:105/ca.pub > /etc/ssh/ca.pub && chmod 644 /etc/ssh/ca.pub
- su - jingrow -c "cd /home/jingrow/agent && env/bin/agent setup config --name {{ server.name }} --workers 2"
- su - jingrow -c "cd /home/jingrow/agent && env/bin/agent setup authentication --password {{ agent_password }}"
- su - jingrow -c "htpasswd -Bbc /home/jingrow/agent/nginx/monitoring.htpasswd jingrow {{ monitoring_password }}"
- supervisorctl restart all
{% if server.pagetype == 'Database Server' %}
- resize2fs $(findmnt /opt/volumes/mariadb --noheadings --output SOURCE)
- systemctl daemon-reload
- systemctl restart mariadb
- systemctl restart mysqld_exporter
- systemctl restart deadlock_logger
{% elif server.pagetype == 'Server' %}
- resize2fs $(findmnt /opt/volumes/benches --noheadings --output SOURCE)
{% endif %}
{% if server.provider == 'OCI' %}
- iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
- sed -i 's/^-A INPUT -j REJECT --reject-with icmp-host-prohibited$/#-A INPUT -j REJECT --reject-with icmp-host-prohibited/g' /etc/iptables/rules.v4
{% endif %}

write_files:
- path: /etc/systemd/system/statsd_exporter.service
  permissions: "0644"
  content: |
    {{ statsd_exporter_service | indent(4) }}

- path: /etc/filebeat/filebeat.yml
  content: |
    {{ filebeat_config | indent(4) }}

- path: /etc/ssh/auth_principals/jingrow
  defer: true
  content: |
    all-servers
    {{ server.name }}

- path: /etc/ssh/sshd_config
  append: true
  content: |
    TrustedUserCAKeys /etc/ssh/ca.pub
    AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

{% if server.pagetype == 'Database Server' %}
- path: /etc/mysql/conf.d/jingrow.cnf
  content: |
    {{ mariadb_config | indent(4) }}

- path: /etc/systemd/system/mariadb.service.d/memory.conf
  content: |
    {{ mariadb_systemd_config | indent(4) }}

- path: /etc/systemd/system/mysqld_exporter.service
  content: |
    {{ mariadb_exporter_config | indent(4) }}

- path: /root/.my.cnf
  content: |
    {{ mariadb_root_config | indent(4) }}

- path: /etc/systemd/system/deadlock_logger.service
  content: |
    {{ deadlock_logger_config | indent(4) }}
{% endif %}

swap:
  filename: /swap.default
  size: 1073741824

{% if server.pagetype == 'Server' %}
packages:
 - earlyoom
{% endif %}
