move common config files to etc/

6 files changed, 4 insertions, 56 deletions

diff --git a/digitalocean/server/main.tf b/digitalocean/server/main.tf
index 78298f4..37ed3f1 100644
--- a/digitalocean/server/main.tf
+++ b/digitalocean/server/main.tf
@@ -1,5 +1,5 @@
 locals {
-  sshd_config = templatefile("${path.module}/etc/sshd_config", {
+  sshd_config = templatefile("${path.module}/../../etc/sshd_config", {
     port  = var.ssh_port
     users = [var.user]
   })
@@ -13,7 +13,7 @@ resource "digitalocean_droplet" "this" {
   monitoring = true
   ipv6       = false
   vpc_uuid   = var.vpc_id
-  user_data = templatefile("${path.module}/etc/cloud-init.cfg", {
+  user_data = templatefile("${path.module}/../../etc/cloud-init.cfg", {
     user        = var.user
     ssh_keys    = var.ssh_keys
     sshd_config = local.sshd_config
diff --git a/digitalocean/server/etc/cloud-init.cfg b/etc/cloud-init.cfg
index 8ed371c..8ed371c 100644
--- a/digitalocean/server/etc/cloud-init.cfg
+++ b/etc/cloud-init.cfg
diff --git a/digitalocean/server/etc/sshd_config b/etc/sshd_config
index ae08408..ae08408 100644
--- a/digitalocean/server/etc/sshd_config
+++ b/etc/sshd_config
diff --git a/yandex/server/etc/cloud-init.cfg b/yandex/server/etc/cloud-init.cfg
deleted file mode 100644
index 8ed371c..0000000
--- a/yandex/server/etc/cloud-init.cfg
+++ /dev/null
@@ -1,13 +0,0 @@
-#cloud-config
-
-users:
-  - name: ${jsonencode(user)}
-    lock_passwd: false
-    hashed_passwd: '*'
-    sudo: ALL=(ALL) NOPASSWD:ALL
-    ssh_authorized_keys: ${jsonencode(ssh_keys)}
-    shell: /bin/bash
-
-write_files:
-  - path: /etc/ssh/sshd_config
-    content: ${jsonencode(sshd_config)}
diff --git a/yandex/server/etc/sshd_config b/yandex/server/etc/sshd_config
deleted file mode 100644
index ae08408..0000000
--- a/yandex/server/etc/sshd_config
+++ /dev/null
@@ -1,39 +0,0 @@
-Protocol 2
-Port ${port}
-
-# Drop idle sessions:
-ClientAliveCountMax 3
-ClientAliveInterval 15
-
-# Allow reverse tunnels:
-GatewayPorts yes
-
-# Miscellaneous:
-PrintMotd no
-
-# Hardening.
-# Source: https://infosec.mozilla.org/guidelines/openssh.html
-
-# Only Ed25519:
-HostKey /etc/ssh/ssh_host_ed25519_key
-
-# Only the first choices for ciphers:
-KexAlgorithms curve25519-sha256@libssh.org
-Ciphers chacha20-poly1305@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
-
-# No password login:
-PasswordAuthentication no
-AuthenticationMethods publickey
-# Whitelist users:
-PermitRootLogin no
-AllowGroups ${join(" ", users)}
-
-# Log things:
-Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
-
-# Whitelist accepted environment variables:
-AcceptEnv LANG LC_*
-
-# Why the fuck would I need X11 forwarding?
-X11Forwarding no
diff --git a/yandex/server/main.tf b/yandex/server/main.tf
index 12d31d9..b9d4650 100644
--- a/yandex/server/main.tf
+++ b/yandex/server/main.tf
@@ -1,5 +1,5 @@
 locals {
-  sshd_config = templatefile("${path.module}/etc/sshd_config", {
+  sshd_config = templatefile("${path.module}/../../etc/sshd_config", {
     port  = var.ssh_port
     users = [var.user]
   })
@@ -30,7 +30,7 @@ resource "yandex_compute_instance" "this" {
   }
 
   metadata = {
-    user-data = templatefile("${path.module}/etc/cloud-init.cfg", {
+    user-data = templatefile("${path.module}/../../etc/cloud-init.cfg", {
       user        = var.user
       ssh_keys    = var.ssh_keys
       sshd_config = local.sshd_config