I am a Software Engineer from India. I am currently building Daestro. I work in Rust, Javascript and Python. Zola 2025-09-05T00:00:00+00:00 https://vshukla.com/tags/cloud-init/atom.xml 2025-09-05T00:00:00+00:00 2025-09-05T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/cloud-init/

The cloud init script that I use to automatically configure my server with the essentials.

<p>Add this script to Cloud-init field while provisioning your VPS. Most cloud providers support this.</p> <p>This script will do following stuff:</p> <ul> <li>disable the root user</li> <li>disable password authentication for SSH</li> <li>update and upgrade ubuntu packages</li> <li>create a new user named “ubuntu” add given public SSH key as <code>authorized_key</code> for the user</li> <li>Install and setup: <ul> <li>Ufw: a firewall with open ports 22, 80 and 443</li> <li>fail2ban: to protect against brute-force login attempt</li> <li>unattended-upgrades: to upgrade ubuntu packages</li> <li>docker</li> </ul> </li> </ul> <pre class="giallo z-code"><code data-lang="yaml"><span class="giallo-l"><span class="z-comment">#cloud-config</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">disable_root</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">ssh_pwauth</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> false</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">package_update</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">package_upgrade</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">timezone</span><span class="z-punctuation z-separator">:</span><span class="z-string"> Etc/UTC</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">system_info</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> default_user</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> ssh_authorized_keys</span><span class="z-punctuation z-separator">:</span><span> []</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> lock_passwd</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">packages</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> unattended-upgrades</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">runcmd</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> echo $(date) &gt; /start</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> passwd -l root</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> sed -i &#39;s/^PasswordAuthentication yes/PasswordAuthentication no/&#39; /etc/ssh/sshd_config</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl restart sshd</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw default deny incoming</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw default allow outgoing</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 22/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 80/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 443/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw --force enable</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl enable fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl start fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> unattended-upgrade</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> curl -fsSL https://get.docker.com | sh</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> groupadd docker</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> usermod -aG docker ubuntu</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> echo $(date) &gt; /end</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">users</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-entity z-name z-tag"> name</span><span class="z-punctuation z-separator">:</span><span class="z-string"> ubuntu</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> lock_passwd</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> ssh_authorized_keys</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> YOUR_SSH_PUBLIC_KEY</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> sudo</span><span class="z-punctuation z-separator">:</span><span class="z-string"> ALL=(ALL) NOPASSWD:ALL</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> groups</span><span class="z-punctuation z-separator">:</span><span class="z-string"> sudo</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> shell</span><span class="z-punctuation z-separator">:</span><span class="z-string"> /bin/bash</span></span></code></pre>