From 06df079bfba8546395b7d29b893f8877443e2071 Mon Sep 17 00:00:00 2001
From: Damien <sepales.pret0h@icloud.com>
Date: Wed, 10 Jun 2026 10:08:06 +0200
Subject: [PATCH] Add lock_passwd false to Alpine user config

---
 cloud-init/user-data-alpine.yml.tftpl | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cloud-init/user-data-alpine.yml.tftpl b/cloud-init/user-data-alpine.yml.tftpl
index 10763c6..c805380 100644
--- a/cloud-init/user-data-alpine.yml.tftpl
+++ b/cloud-init/user-data-alpine.yml.tftpl
@@ -8,10 +8,19 @@ preserve_hostname: false
 # 2. User creation
 # On Alpine, the privilege escalation group is "wheel" (not "sudo").
 # Keep the default shell (ash/busybox) to stay lightweight.
+#
+# IMPORTANT: lock_passwd MUST be false on Alpine.
+# cloud-init's default (lock_passwd: true) sets shadow to "!", which Alpine's
+# OpenSSH (compiled without PAM) interprets as "account locked" and refuses
+# pubkey auth with "User ... not allowed because account is locked".
+# Setting lock_passwd: false lets cloud-init use "*" instead: no password
+# login possible, but pubkey works.
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: wheel
+    shell: /bin/ash
+    lock_passwd: false
     ssh_authorized_keys:
       - ${ssh_key}