#cloud-config
# Baseline cloud-init user-data baked into the VM template infra/terraform/ clones. Minimal on
# purpose — infra/ansible/site.yml does the real configuration (Docker, firewall, TLS, the app
# stack); this just gets a box far enough to be SSH-reachable and Ansible-manageable.

package_update: true
package_upgrade: true

users:
  - name: rootnode-deploy
    groups: [sudo]
    shell: /bin/bash
    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
    ssh_authorized_keys: []   # injected by Terraform's ssh_public_key variable at clone time

ssh_pwauth: false
disable_root: true

packages:
  - qemu-guest-agent
  - curl
  - ca-certificates

runcmd:
  - systemctl enable --now qemu-guest-agent

# See infra/proxmox/README.md for how to bake this into a reusable template (packer or manual
# virt-customize) before infra/terraform/ clones it.