Update cloudinit network config

.drone.yml

@@ -26,7 +26,10 @@ steps:
     sed -i -e "s/<<img-password>>/$${SSH_PASSWORD}/g" \
       packer/preseed/UbuntuServer20.04/user-data
   - |
-    yamllint -d "{extends: relaxed, rules: {line-length: disable}}" ansible packer/preseed/UbuntuServer20.04/user-data scripts
+    yamllint -d "{extends: relaxed, rules: {line-length: disable}}" \
+      ansible \
+      packer/preseed/UbuntuServer20.04/user-data \
+      scripts
   - |
     packer init -upgrade \
       ./packer

ansible/ansible.cfg

@@ -1,2 +1,3 @@
 [defaults]
+deprecation_warnings = False
 remote_tmp           = /tmp/.ansible-${USER}/tmp

ansible/playbook.yml

@@ -4,3 +4,4 @@
   become: true
   roles:
     - os
+    - firstboot

ansible/roles/firstboot/files/ansible_payload/playbook.yml

@@ -0,0 +1,10 @@
+---
+- hosts: 127.0.0.1
+  connection: local
+  gather_facts: false
+  # become: true
+  roles:
+    - vapp
+    - network
+    - users
+    - cleanup

ansible/roles/firstboot/files/ansible_payload/roles/cleanup/tasks/main.yml

@@ -0,0 +1,20 @@
+- name: Disable crontab job
+  ansible.builtin.cron:
+    name: firstboot
+    state: absent
+- name: Restore extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^NAutoVTs=', line: '#NAutoVTs=6'}
+  - { regexp: '^ReserveVT=', line: '#ReserveVT=6'}
+- name: Unmask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: yes
+    masked: no
+- name: Reboot host
+  ansible.builtin.shell:
+    cmd: /usr/sbin/reboot now

ansible/roles/firstboot/files/ansible_payload/roles/network/tasks/main.yml

@@ -0,0 +1,10 @@
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ ovfproperties['guestinfo.hostname'] }}"
+- name: Create netplan configuration file
+  ansible.builtin.template:
+    src: netplan.j2
+    dest: /etc/netplan/00-installer-config.yaml
+- name: Apply netplan configuration
+  ansible.builtin.shell:
+    cmd: /usr/sbin/netplan apply

ansible/roles/firstboot/files/ansible_payload/roles/network/templates/netplan.j2

@@ -0,0 +1,10 @@
+network:
+  version: 2
+  ethernets:
+    ens192:
+      addresses:
+      - {{ ovfproperties['guestinfo.ipaddress'] }}/{{ ovfproperties['guestinfo.prefixlength'] }}
+      gateway4: {{ ovfproperties['guestinfo.gateway'] }}
+      nameservers:
+        addresses:
+        - {{ ovfproperties['guestinfo.dnsserver'] }}

ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml

@@ -0,0 +1,25 @@
+- name: Set root password
+  ansible.builtin.user:
+    name: root
+    password: "{{ ovfproperties['guestinfo.rootpw'] | password_hash('sha512', 65534 | random(seed=ovfproperties['guestinfo.hostname']) | string) }}"
+    generate_ssh_key: yes
+    ssh_key_bits: 2048
+    ssh_key_file: .ssh/id_rsa
+- name: Save root SSH publickey
+  ansible.builtin.lineinfile:
+    path: /root/.ssh/authorized_keys
+    line: "{{ ovfproperties['guestinfo.rootsshkey'] }}"
+- name: Disable SSH password authentication
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regex: "{{ item.regex }}"
+    line: "{{ item.line }}"
+    state: "{{ item.state }}"
+  loop:
+  - { regex: '^#PasswordAuthentication', line: 'PasswordAuthentication no', state: present}
+  - { regex: '^PasswordAuthentication yes', line: 'PasswordAuthentication yes', state: absent}
+- name: Delete 'ubuntu' user
+  ansible.builtin.user:
+    name: ubuntu
+    state: absent
+    remove: yes

ansible/roles/firstboot/files/ansible_payload/roles/vapp/tasks/main.yml

@@ -0,0 +1,21 @@
+- name: Store current ovfEnvironment
+  ansible.builtin.shell:
+    cmd: /usr/bin/vmtoolsd --cmd "info-get guestinfo.ovfEnv"
+  register: ovfenv
+- name: Parse XML for vApp properties
+  community.general.xml:
+    xmlstring: "{{ ovfenv.stdout }}"
+    namespaces:
+      ns: http://schemas.dmtf.org/ovf/environment/1
+    xpath: /ns:Environment/ns:PropertySection/ns:Property
+    content: attribute
+  register: ovfenv
+- name: Assign vApp properties to dictionary
+  ansible.builtin.set_fact:
+    ovfproperties: >-
+      {{ ovfproperties | default({}) |
+      combine({((item.values() | list)[0].values() | list)[0]:
+      ((item.values() | list)[0].values() | list)[1]})
+      }}
+  loop: "{{ ovfenv.matches }}"
+  no_log: true

ansible/roles/firstboot/tasks/main.yml

@@ -0,0 +1,26 @@
+- name: Create destination folder
+  ansible.builtin.file:
+    path: /opt/firstboot
+    state: directory
+- name: Create firstboot script file
+  ansible.builtin.template:
+    src: firstboot.j2
+    dest: /opt/firstboot/firstboot.sh
+    owner: root
+    group: root
+    mode: o+x
+- name: Create @reboot crontab job
+  ansible.builtin.cron:
+    name: firstboot
+    special_time: reboot
+    job: "/opt/firstboot/firstboot.sh"
+- name: Copy payload folder
+  ansible.builtin.copy:
+    src: ansible_payload/
+    dest: /opt/firstboot/ansible/
+    owner: root
+    group: root
+    mode: '0644'
+- name: Install ansible-galaxy collection
+  ansible.builtin.shell:
+    cmd: ansible-galaxy collection install community.general

ansible/roles/firstboot/templates/firstboot.j2

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Apply firstboot configuration w/ ansible
+/usr/local/bin/ansible-playbook /opt/firstboot/ansible/playbook.yml | tee -a /var/log/firstboot.log > /dev/tty1

ansible/roles/os/tasks/ansible.yml

@@ -0,0 +1,6 @@
+- name: Install ansible (w/ dependencies)
+  ansible.builtin.pip:
+    name: "{{ item }}"
+    executable: pip3
+    state: latest
+  loop: "{{ pip_packages }}"

ansible/roles/os/tasks/cloud-init.yml

@@ -3,8 +3,6 @@
     name: cloud-init
     state: absent
     purge: yes
-    # autoclean: yes
-    # autoremove: yes
 - name: Delete cloud-init files
   ansible.builtin.file:
     path: "{{ item }}"

ansible/roles/os/tasks/logging.yml

@@ -0,0 +1,5 @@
+- name: Enable crontab logging
+  ansible.builtin.lineinfile:
+    path: /etc/rsyslog.d/50-default.conf
+    regexp: '^#cron\.\*.*'
+    line: "cron.*\t\t\t\t./var/log/cron.log"

ansible/roles/os/tasks/main.yml

@@ -1,11 +1,20 @@
+- name: Disable tty logins
+  import_tasks: tty.yml
+
 - name: Remove snapd
   import_tasks: snapd.yml
 
 - name: Remove cloud-init
   import_tasks: cloud-init.yml
 
-- name: Configure network
-  import_tasks: network.yml
+- name: Configure default logging
+  import_tasks: logging.yml
+
+- name: Configure services
+  import_tasks: services.yml
 
 - name: Install packages
   import_tasks: packages.yml
+
+- name: Install ansible
+  import_tasks: ansible.yml

ansible/roles/os/tasks/packages.yml

@@ -4,3 +4,12 @@
     state: latest
     update_cache: yes
   loop: "{{ packages }}"
+- name: Upgrade all packages
+  ansible.builtin.apt:
+    name: "*"
+    state: latest
+    update_cache: yes
+- name: Cleanup
+  ansible.builtin.apt:
+    autoremove: yes
+    purge: yes

ansible/roles/os/tasks/services.yml

@@ -1,5 +1,5 @@
 - name: Disable & mask networkd-wait-online
   ansible.builtin.systemd:
     name: systemd-networkd-wait-online
-    enable: no
+    enabled: no
     masked: yes

ansible/roles/os/tasks/snapd.yml

@@ -3,6 +3,14 @@
     name: snapd
     state: absent
     purge: yes
+- name: Delete leftover files
+  ansible.builtin.file:
+    path: /root/snap
+    state: absent
+- name: Hold snapd package
+  ansible.builtin.dpkg_selections:
+    name: snapd
+    selection: hold
 - name: Reload systemd unit configurations
   ansible.builtin.systemd:
     daemon_reload: yes

ansible/roles/os/tasks/tty.yml

@@ -0,0 +1,13 @@
+- name: Disable extra tty
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/logind.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+  - { regexp: '^#NAutoVTs=', line: 'NAutoVTs=1'}
+  - { regexp: '^#ReserveVT=', line: 'ReserveVT=11'}
+- name: Mask getty@tty1 service
+  ansible.builtin.systemd:
+    name: getty@tty1
+    enabled: no
+    masked: yes

ansible/roles/os/vars/main.yml

@@ -0,0 +1,11 @@
+packages:
+  - jq
+  # (python3-*) Dependency for installation of Ansible
+  - python3-pip
+  - python3-setuptools
+  - python3-wheel
+
+pip_packages:
+  - pip
+  - ansible-core
+  - lxml

ansible/vars/main.yml

@@ -1,2 +0,0 @@
-packages:
-  - ansible

packer/iso.auto.pkrvars.hcl

@@ -0,0 +1,4 @@
+iso_url      = "sn.itch.fyi/Repository/iso/Canonical/Ubuntu%20Server%2020.04/ubuntu-20.04.4-live-server-amd64.iso"
+iso_checksum = "sha256:28CCDB56450E643BAD03BB7BCF7507CE3D8D90E8BF09E38F6BD9AC298A98EAAD"
+// iso_url      = "sn.itch.fyi/Repository/iso/Canonical/Ubuntu%20Server%2020.04/ubuntu-20.04.2-live-server-amd64.iso"
+// iso_checksum = "sha256:D1F2BF834BBE9BB43FAF16F9BE992A6F3935E65BE0EDECE1DEE2AA6EB1767423"

packer/preseed/UbuntuServer20.04/user-data

@@ -1,9 +1,6 @@
 #cloud-config
 autoinstall:
   version: 1
-  # early-commands:
-  #   # Block inbound SSH to stop Packer trying to connect during initial install
-  #   - iptables -A INPUT -p tcp --dport 22 -j DROP
   locale: en_US
   keyboard:
     layout: en
@@ -14,18 +11,18 @@ autoinstall:
       ethernets:
         ens192:
           dhcp4: true
+          dhcp-identifier: mac
   storage:
     layout:
-      name: lvm
+      name: direct
   identity:
     hostname: packer-template
     username: ubuntu
+    # password: $6$ZThRyfmSMh9499ar$KSZus58U/l58Efci0tiJEqDKFCpoy.rv25JjGRv5.iL33AQLTY2aljumkGiDAiX6LsjzVsGTgH85Tx4S.aTfx0
     password: $6$rounds=4096$ZKfzRoaQOtc$M.fhOsI0gbLnJcCONXz/YkPfSoefP4i2/PQgzi2xHEi2x9CUhush.3VmYKL0XVr5JhoYvnLfFwqwR/1YYEqZy/
   ssh:
     install-server: yes
     allow-pw: true
-#    authorized-keys:
-#      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi9eAu6KBaShdcL4pxi6/sJp+IS6nCKexcjQdwFLxg+EoiT2MTAnMsjnfi570het+VV+iOigcZLuRwEcAPh6rSQOtpikmpV6WFjzToWq9aUxDrxWsp/iEPHp+sbjrlsdnGvLGY9XhmPs9s5I8xFQbwF6ilhMIQm+RxtGJJuPUWaF+uXo+3CB91A6bK/rjs97iAjrPZRs0vo5hJGqrIGFi3WP9hf8hF9oWz2BiLRYBib3il6lsAl4Ca0sI//gNM0Ztj4gB7qv1+uPz157bk0IZoN285/72l/rUZVSPIwO+QFZFK07FsyVrpAgMlHk65BiSAO4DtolZEArfXRE1g1DH/ mail@example.com
   user-data:
     disable_root: false
   late-commands:

packer/ubuntuserver20.04.pkr.hcl

@@ -11,6 +11,7 @@ source "vsphere-iso" "ubuntuserver" {
 
   vm_name                 = "${var.vm_guestos}-${var.vm_name}"
   datacenter              = var.vsphere_datacenter
+  cluster                 = var.vsphere_cluster
   host                    = var.vsphere_host
   folder                  = var.vsphere_folder
   datastore               = var.vsphere_datastore
@@ -51,8 +52,8 @@ source "vsphere-iso" "ubuntuserver" {
     "packer/preseed/UbuntuServer20.04/meta-data"
   ]
   cd_label                = "cidata"
-  iso_checksum            = "sha256:D1F2BF834BBE9BB43FAF16F9BE992A6F3935E65BE0EDECE1DEE2AA6EB1767423"
-  iso_url                 = "https://${var.repo_username}:${var.repo_password}@sn.itch.fyi/Repository/iso/Canonical/Ubuntu%20Server%2020.04/ubuntu-20.04.2-live-server-amd64.iso"
+  iso_url                 = local.iso_authenticatedurl
+  iso_checksum            = var.iso_checksum
 
   shutdown_command        = "echo '${var.ssh_password}' | sudo -S shutdown -P now"
   shutdown_timeout        = "5m"
@@ -65,9 +66,13 @@ source "vsphere-iso" "ubuntuserver" {
 }
 
 build {
-  sources = ["source.vsphere-iso.ubuntuserver"]
+  sources = [
+    "source.vsphere-iso.ubuntuserver"
+  ]
 
   provisioner "ansible" {
+    only             = ["vsphere-iso.ubuntuserver"]
+
     playbook_file    = "ansible/playbook.yml"
     user             = "ubuntu"
     ansible_env_vars = [
@@ -80,6 +85,7 @@ build {
   }
 
   post-processor "shell-local" {
+    only   = ["vsphere-iso.ubuntuserver"]
     inline = [
       "pwsh -command \"& scripts/Update-OvfConfiguration.ps1 \\",
       " -OVFFile '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
@@ -88,7 +94,7 @@ build {
       " -ManifestFileName '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.mf'",
       "ovftool --acceptAllEulas --allowExtraConfig --overwrite \\",
       " '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
-      " /output/UbuntuServer20.04.ova"
+      " /output/Ubuntu-Server-20.04.ova"
     ]
   }
 }

packer/variables.pkr.hcl

@@ -1,9 +1,12 @@
 variable "vcenter_server" {}
 variable "vsphere_username" {}
-variable "vsphere_password" {}
+variable "vsphere_password" {
+    sensitive = true
+}
 
 variable "vsphere_host" {}
 variable "vsphere_datacenter" {}
+variable "vsphere_cluster" {}
 
 variable "vsphere_templatefolder" {}
 variable "vsphere_folder" {}
@@ -12,7 +15,17 @@ variable "vsphere_network" {}
 
 variable "vm_name" {}
 variable "vm_guestos" {}
-variable "ssh_password" {}
+variable "ssh_password" {
+    sensitive = true
+}
 
+variable "iso_url" {}
+variable "iso_checksum" {}
 variable "repo_username" {}
-variable "repo_password" {}
+variable "repo_password" {
+    sensitive = true
+}
+local "iso_authenticatedurl" {
+    expression = "https://${var.repo_username}:${var.repo_password}@${var.iso_url}"
+    sensitive  = true
+}

packer/vsphere.auto.pkrvars.hcl

@@ -1,8 +1,9 @@
 vcenter_server         = "bv11-vc.bessems.lan"
 vsphere_username       = "administrator@vsphere.local"
 vsphere_datacenter     = "DeSchakel"
+vsphere_cluster        = "Cluster.Legacy"
 vsphere_host           = "bv11-esx.bessems.lan"
-vsphere_datastore      = "Datastore01.SSD"
+vsphere_datastore      = "ESX00.SSD01"
 vsphere_folder         = "/Packer"
 vsphere_templatefolder = "/Templates"
 vsphere_network        = "LAN"

scripts/Remove-Resources.ps1

@@ -0,0 +1,51 @@
+[CmdletBinding()]
+Param(
+    [Parameter(Mandatory)]
+    [string]$VMName,
+    [Parameter(Mandatory)]
+    [string]$VSphereFQDN,
+    [Parameter(Mandatory)]
+    [string]$VSphereUsername,
+    [Parameter(Mandatory)]
+    [string]$VSpherePassword
+)
+
+$PowerCliConfigurationSplat = @{
+    Scope                    = 'User'
+    ParticipateInCEIP        = $False
+    Confirm                  = $False
+    InvalidCertificateAction = 'Ignore'
+}
+Set-PowerCLIConfiguration @PowerCliConfigurationSplat | Out-Null
+
+$ConnectVIServerSplat = @{
+    Server        = $VSphereFQDN
+    User          = "$VSphereUsername"
+    Password      = "$VSpherePassword"
+    WarningAction = 'SilentlyContinue'
+}
+Connect-VIServer @ConnectVIServerSplat | Out-Null
+
+$GetVMSplat = @{
+    Name        = "*$($VMName)*"
+    ErrorAction = 'SilentlyContinue'
+}
+If ([boolean](Get-VM @GetVMSplat)) {
+    $RemoveVMSplat = @{
+        VM                       = Get-VM @GetVMSplat
+        DeletePermanently        = $True
+        Confirm                  = $False
+        ErrorAction              = 'SilentlyContinue'
+    }
+    Remove-VM @RemoveVMSplat
+}
+
+Disconnect-VIServer * -Confirm:$False
+
+$RemoveItemSplat = @{
+    Path    = "/scratch/*"
+    Recurse = $True
+    Force   = $True
+    Confirm = $False
+}
+Remove-Item @RemoveItemSplat

scripts/Update-OvfConfiguration.yml

@@ -1,30 +1,26 @@
 DeploymentConfigurations:
-- Id: ubuntu-small
-  Label: 'Ubuntu Server 20.04 [SMALL]'
-  Description: |
-    Ubuntu Server 20.04
-    1 vCPU/2GB RAM
+- Id: small
+  Label: 'Ubuntu Server 20.04 [SMALL: 1 vCPU/2GB RAM]'
+  Description: Ubuntu Server 20.04.x
   Size:
     CPU: 1
     Memory: 2048
-- Id: ubuntu-large
-  Label: 'Ubuntu Server 20.04 [LARGE]'
-  Description: |
-    Ubuntu Server 20.04
-    4 vCPU/8GB RAM
+- Id: large
+  Label: 'Ubuntu Server 20.04 [LARGE: 4 vCPU/8GB RAM]'
+  Description: Ubuntu Server 20.04.x
   Size:
     CPU: 4
     Memory: 8192
 DynamicDisks: []
 PropertyCategories:
-- Name: 0) Deployment information
-  ProductProperties:
-  - Key: deployment.type
-    Type: string
-    Value:
-    - ubuntu-small
-    - ubuntu-large
-    UserConfigurable: false
+# - Name: 0) Deployment information
+#   ProductProperties:
+#   - Key: deployment.type
+#     Type: string
+#     Value:
+#     - small
+#     - large
+#     UserConfigurable: false
 - Name: 1) Operating System
   ProductProperties:
   - Key: guestinfo.hostname
@@ -38,7 +34,14 @@ PropertyCategories:
     Type: password(7..)
     Label: Local root password*
     Description: ''
-    DefaultValue: password
+    DefaultValue: ''
+    Configurations: '*'
+    UserConfigurable: true
+  - Key: guestinfo.rootsshkey
+    Type: password(1..)
+    Label: Local root SSH public key*
+    Description: This line should start with 'ssh-rsa AAAAB3N'
+    DefaultValue: ''
     Configurations: '*'
     UserConfigurable: true
   - Key: guestinfo.ntpserver