ignition.yml

passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrOJ0dRoMpSrSb9pQhd6bzFzoMpCKsBU2z1NlwEgR1zB5kQoE27fJ9csrncLod2lp5MhUWxGi8ar2HtNTjcGZUGV5vtt7DyR5F2nEgdhJF7MbJaSdThzjUPKQUW6xoQuo09+8KsHnjGwTsjV/hepg+WzkKOfrk2EuxDqhSxvM8X2meSyxPFN6yrAU8yc0WTbZ/IoLhgXuGfkQ8TK301XclFF3BWQSLKST1qZFkJEDfwV+H3E+TI4ec7ljj2uz+rgqLhPv5ia/Nv3GLDKFaSuWmaIpr/zn+U2eWv89BpvXp1AmIGJGbukgbRiGrHR4Sft7hKqx0fug/KXacck1gbczJ blake@Blakes-MacBook-Pro.local
networkd:
  units:
    - name: 00-enp3s0.network
      contents: |
        [Match]
        Name=enp3s0

        [Network]
        DNS=192.168.2.2
        Address=192.168.2.2/24
        Gateway=192.168.2.1
systemd:
  units:
    - name: settimezone.service
      enable: true
      contents: |
        [Unit]
        Description=Set the time zone

        [Service]
        ExecStart=/usr/bin/timedatectl set-timezone America/Chicago
        RemainAfterExit=yes
        Type=oneshot
    # mount sd card
    - name: media-passwords.mount
      enable: true
      contents: |
        [Unit]
        Before=local-fs.target

        [Mount]
        What=/dev/sdb1
        Where=/media/passwords

        [Install]
        WantedBy=local-fs.target
    # enable the iptables restore service to load defined rules
    - name: iptables-restore.service
      enable: true
    # install docker compose if not installed
    - name: install-docker-compose.service
      enable: true
      contents: |
        [Unit]
        Description=Install docker-compose
        ConditionPathExists=!/opt/bin/docker-compose
        Wants=network-online.target
        After=network-online.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/bin/mkdir -p /opt/bin/
        ExecStart=/usr/bin/curl --create-dirs -o /opt/bin/docker-compose -sL https://github.com/docker/compose/releases/download/1.18.0/docker-compose-linux-x86_64
        ExecStart=/usr/bin/chmod +x /opt/bin/docker-compose

        [Install]
        WantedBy=multi-user.target
    # checkout configuration
    - name: config-blakeshome.service
      enable: true
      contents: |
        [Unit]
        Description=Download blakeshome config
        ConditionPathExists=!/srv/blakeshome/.git
        Wants=network-online.target
        After=network-online.target media-passwords.mount

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/bin/git clone git://github.com/blakeblackshear/blakeshome-config.git /srv/blakeshome

        [Install]
        WantedBy=multi-user.target
    # Decrypt the files with password on usb drive
    - name: decrypt-blakeshome.service
      enable: true
      contents: |
        [Unit]
        Description=Decrypt blakeshome config
        Wants=network-online.target
        After=network-online.target config-blakeshome.service media-passwords.mount

        [Service]
        EnvironmentFile=/media/passwords/PASSWORDS.env
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/srv/blakeshome/decrypt.sh

        [Install]
        WantedBy=multi-user.target
    # Run docker compose
    - name: blakeshome.service
      enable: true
      contents: |
        [Unit]
        Description=Blakeshome (docker machine)
        Wants=network-online.target
        After=network-online.target config-blakeshome.service decrypt-blakeshome.service install-docker-compose.service

        [Service]
        EnvironmentFile=/srv/blakeshome/DOCKER.env
        Type=oneshot
        RemainAfterExit=yes
        WorkingDirectory=/srv/blakeshome
        ExecStart=/opt/bin/docker-compose up -d
        ExecStop=/opt/bin/docker-compose down

        [Install]
        WantedBy=multi-user.target
    # Get blakeshome cert
    - name: cert-blakeshome.service
      enable: true
      contents: |
        [Unit]
        Description=Blakeshome (docker machine)
        Wants=network-online.target
        After=network-online.target blakeshome.service
        
        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d blakeshome.com
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d hass.blakeshome.com
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d unifi.blakeshome.com
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d nodered.blakeshome.com
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d portainer.blakeshome.com
        ExecStart=-/bin/docker exec acme.sh --issue --dns dns_cf -d pihole.blakeshome.com

        [Install]
        WantedBy=multi-user.target
    # install sshguard
    - name: sshguard.service
      enable: true
      contents: |
        [Unit]
        Description=sshguard
        After=network-online.target iptables-restore.service docker.service
        Requires=network-online.target docker.service

        [Service]
        TimeoutStartSec=0
        ExecStartPre=-/usr/bin/docker kill %n
        ExecStartPre=-/usr/bin/docker rm %n
        ExecStartPre=/usr/bin/docker pull pablocouto/coreos-sshguard

        ExecStart=/bin/sh -c 'journalctl --no-pager -f -n0 -q -t sshd | /usr/bin/docker run -i --name=%n -v /dev/log:/dev/log --net=host --cap-add=NET_ADMIN --cap-add=NET_RAW pablocouto/coreos-sshguard >/dev/null'

        ExecStop=/usr/bin/docker stop %n
        ExecStop=/usr/bin/docker rm %n

        [Install]
        WantedBy=multi-user.target

storage:
  files:
    # set the hostname
    - filesystem: root
      path: /etc/hostname
      mode: 420
      contents:
        inline: blakeshome1
    # set the iptables rules
    - filesystem: root
      path: /var/lib/iptables/rules-save
      contents:
        remote:
          url: https://raw.githubusercontent.com/blakeblackshear/blakeshome-config/master/iptables-rules-save
  
  directories:
    - filesystem: root
      path: /srv/blakeshome