Update user creation and Tailscale setup

Add Debian/Ubuntu/Rocky-specific user configuration
Improve Tailscale installation and bringup reliability

cloud-init/user-data-systemd.yml.tftpl

@@ -6,11 +6,24 @@ fqdn: ${hostname}
 preserve_hostname: false
 
 # 2. User creation
+#
+# Unlike Alpine, sshd on Debian/Ubuntu/Rocky is built with PAM, which accepts
+# pubkey auth even when the shadow entry is locked ("!"). So the Alpine
+# /etc/shadow workaround is NOT needed here.
+#
+# Groups:
+# - Debian/Ubuntu: sudo group grants admin rights
+# - Rocky/RHEL:    wheel group grants admin rights
+# We include both so the same template works for all supported distros; cloud-
+# init silently skips groups that don't exist on the target system.
+# (The "admin" group is intentionally NOT included: it was deprecated on
+# Ubuntu 12.04 and absent on RHEL-family distros.)
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
-    groups: sudo, admin
+    groups: [sudo, wheel]
     shell: /bin/bash
+    lock_passwd: true
     ssh_authorized_keys:
       - ${ssh_key}
 
@@ -23,10 +36,15 @@ packages:
   - qemu-guest-agent
   - curl
 
-# 5. Tailscale installation and configuration
+# 5. Services and Tailscale
+# Order matters: qemu-guest-agent FIRST so Terraform can read the VM IP
+# without waiting for the (potentially slow) Tailscale install.
 runcmd:
   # Enable and start qemu-guest-agent (systemd)
   - [ systemctl, enable, qemu-guest-agent, --now ]
-  # Install and configure Tailscale
+  # Install Tailscale (official installer detects the distro)
   - [ sh, -c, "curl -fsSL https://tailscale.com/install.sh | sh" ]
-  - [ tailscale, up, --authkey=${tailscale_auth_key}, --hostname=${vm_name} ]
+  # Bring the node up on the tailnet. Retry a few times to absorb the small
+  # delay between `systemctl start tailscaled` and the daemon's socket being
+  # ready to accept commands.
+  - [ sh, -c, "for i in 1 2 3 4 5; do tailscale up --authkey=${tailscale_auth_key} --hostname=${vm_name} && break; sleep 2; done" ]