Cloud provider

Q:

Follow Figure 1103, “DIY using Bash by Terraform's user_data attribute ” and create a bash script which:

Q:

Follow Hetzner's Cloud-init introduction and assemble a corresponding Cloud-init script. Use the package_reboot_if_required: true directive in favor of an explicit reboot command.

Use the Hetzner WEB Gui for manual server creation. Copy-paste your Cloud-init script into the respective text field.

Q:

Re-use your Cloud-init script from Cloud-init for starters . This time follow Figure 1106, “Terraform triggering Cloud-init ” using Terraform for executing Cloud-init rather than Hetzner's WEB GUI.

Q:

We extend our exercise Cloud-init by Terraform :

Q:

Extending the previous exercise we address login and firewall related issues.

Q:

Extend Hardening your server generating both a bin/ssh wrapper and a corresponding gen/known_hosts file to be used by the wrapper script.

Avoiding ssh host key issues on login we require the creation of a known_hosts file among with each server being created:

157.180.78.16 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDd+x7b80BM97rTU4RCM/CP+K7u4QAqx8ulDdXm9JDv

We assume this file being generated at gen/known_hosts. A corresponding ssh bash script shall be generated at the same level in bin/ssh:

#!/bin/bash

GEN_DIR=$(dirname "$0")/../gen

ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" devops@157.180.78.16 "$@"

# end of script

This way invoking ./bin/ssh will instruct the ssh client to read gen/known_hosts and thus avoiding unknown host key issues. The "$@" allows for optional user provided parameters.

For generating this script we start from a corresponding tpl/ssh.sh template file:

#!/usr/bin/env bash

GEN_DIR=$(dirname "$0")/../gen

ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" ${devopsUsername}@${ip} "$@"

# end of script

We then let Terraform use this template replacing ${devopsUsername} and ${ip} by your deployment's actual values.

As shown in Figure 1129, “Parent module vs. sub module context ” point to your child module's local tpl path by using ${path.module}:

resource "local_file" "ssh_script" {
  content = templatefile("${path.module}/tpl/ssh.sh", {
    ...
}

Likewise create a bin/scp script to be used for file transfer purposes as well:

#!/usr/bin/env bash

GEN_DIR=$(dirname "$0")/../gen

if [ $# -lt 2 ]; then
   echo usage: .../bin/scp ... devops@157.180.78.16 ...
else
   scp -o UserKnownHostsFile="$GEN_DIR/known_hosts" $@
fi

# end of script

Since copying objects requires at least a source and a destination parameter this script checks for the presence of at least two extra user supplied values by means of if [ $# -lt 2 ].