init

files/cloud_init.cfg.tftpl

@@ -0,0 +1,33 @@
+#cloud-config
+hostname: "${name}"
+manage_etc_hosts: true
+ssh_pwauth: ${ssh_pwauth}
+disable_root: false
+ssh_authorized_keys:
+%{ for key in admin_authorized_keys ~}
+  - "${key}"
+%{ endfor ~}
+%{ if insecure_password }
+chpasswd:
+  list: |
+    root:root
+  expire: False
+%{ endif }
+%{ if use_host_cert }
+ssh_keys:
+  ed25519_private: |
+    ${indent(4, private_key)}
+  ed25519_certificate: "${host_cert}"
+%{ endif}
+write_files:
+- path: /etc/default/locale
+  content: |
+    LC_ALL=en_US.UTF-8
+    LANG=en_US.UTF-8
+- path: /etc/locale.gen
+  content: |
+    en_US.UTF-8 UTF-8
+runcmd:
+- dhclient -r
+- dhclient
+- locale-gen

files/get_cert.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'
+
+CAHOST=root@hermes.dmz
+
+eval "$(jq -r '@sh "PUBKEY=\(.pubkey) HOST=\(.host)"')"
+
+# TODO: Can this be done more eye-pleasingly?
+CERT=$(ssh $CAHOST '/root/ca.sh host "'"$PUBKEY"'" "'"$HOST"'".dmz')
+
+jq -n --arg cert "$CERT" '{"cert":$cert}'

files/network_config.cfg

@@ -0,0 +1,7 @@
+version: 2
+ethernets:
+  ens3:
+    dhcp4: true
+    routes:
+    - to: 0.0.0.0/0
+      via: 192.168.30.1