terraform/files/cloud_init_global.tpl

#cloud-config
manage_etc_hosts: true
resolv_conf:
  nameservers:
    - 8.8.8.8
    - 1.1.1.1

preserve_hostname: false

users:
  - name: micqdf
    ssh_authorized_keys:
      - ${SSH_KEY_PUBLIC}

runcmd:
  - [ /run/current-system/sw/bin/sh, -lc, "set -eu; install -d -m 700 /var/lib/tailscale; rm -f /var/lib/tailscale/tailscaled.state" ]
  - [ /run/current-system/sw/bin/sh, -lc, "set -eu; for i in 1 2 3 4 5; do /run/current-system/sw/bin/tailscale up --reset --auth-key='${TS_AUTHKEY}' --hostname='$(hostname)' --advertise-tags='tag:k8s' && exit 0; sleep 15; done; /run/current-system/sw/bin/tailscale up --reset --auth-key='${TS_AUTHKEY}' --hostname='$(hostname)'" ]
terraform fmt 2025-04-17 22:24:54 +01:00			`#cloud-config`
Worflow: changes vars 2025-04-18 12:12:28 +01:00			`manage_etc_hosts: true`
			`resolv_conf:`
			`nameservers:`
			`- 8.8.8.8`
			`- 1.1.1.1`
terraform fmt 2025-04-18 10:51:00 +01:00
			`preserve_hostname: false`
update: rotate SSH access via cloud-init secret Inject SSH public key through Terraform/cloud-init from Gitea secret so access can be rotated without rebuilding the template image. 2026-02-28 12:36:20 +00:00
			`users:`
			`- name: micqdf`
			`ssh_authorized_keys:`
			`- ${SSH_KEY_PUBLIC}`
refactor: move tailscale join fully into cloud-init Remove guest-agent enrollment workflow, pass TS auth key through Terraform variables/secrets, and run tailscale up with tag:k8s during cloud-init bootstrap alongside SSH key injection. 2026-02-28 13:13:34 +00:00
			`runcmd:`
fix: make cloud-init tailscale bootstrap resilient Add retry loop for tailscale up during first boot and fallback without tag advertisement when tag auth is unavailable, so nodes still join tailnet. 2026-02-28 13:24:24 +00:00			`- [ /run/current-system/sw/bin/sh, -lc, "set -eu; install -d -m 700 /var/lib/tailscale; rm -f /var/lib/tailscale/tailscaled.state" ]`
			`- [ /run/current-system/sw/bin/sh, -lc, "set -eu; for i in 1 2 3 4 5; do /run/current-system/sw/bin/tailscale up --reset --auth-key='${TS_AUTHKEY}' --hostname='$(hostname)' --advertise-tags='tag:k8s' && exit 0; sleep 15; done; /run/current-system/sw/bin/tailscale up --reset --auth-key='${TS_AUTHKEY}' --hostname='$(hostname)'" ]`