Update prod VM disk size to 80GB

Reviewed-on: #19

cloud-init/user-data-alpine.yml.tftpl

@@ -8,10 +8,19 @@ preserve_hostname: false
 # 2. User creation
 # On Alpine, the privilege escalation group is "wheel" (not "sudo").
 # Keep the default shell (ash/busybox) to stay lightweight.
+#
+# IMPORTANT: lock_passwd MUST be false on Alpine.
+# cloud-init's default (lock_passwd: true) sets shadow to "!", which Alpine's
+# OpenSSH (compiled without PAM) interprets as "account locked" and refuses
+# pubkey auth with "User ... not allowed because account is locked".
+# Setting lock_passwd: false lets cloud-init use "*" instead: no password
+# login possible, but pubkey works.
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: wheel
+    shell: /bin/ash
+    lock_passwd: false
     ssh_authorized_keys:
       - ${ssh_key}
 
@@ -49,6 +58,11 @@ runcmd:
   # Enable and start qemu-guest-agent via OpenRC
   - [ rc-update, add, qemu-guest-agent, default ]
   - [ rc-service, qemu-guest-agent, start ]
+  # Unlock the user account: cloud-init's lock_passwd: false is unreliable on
+  # Alpine (passwd -u refuses on passwordless accounts), so we force the shadow
+  # entry to "*" ourselves. "*" means: no password login possible, but pubkey
+  # auth works (unlike "!" which sshd treats as locked).
+  - [ sh, -c, "sed -i 's/^${username}:!:/${username}:*:/' /etc/shadow" ]
   # Enable and start Tailscale via OpenRC
   - [ rc-update, add, tailscale, default ]
   - [ rc-service, tailscale, start ]

cloud-init/user-data-systemd.yml.tftpl

@@ -6,11 +6,24 @@ fqdn: ${hostname}
 preserve_hostname: false
 
 # 2. User creation
+#
+# Unlike Alpine, sshd on Debian/Ubuntu/Rocky is built with PAM, which accepts
+# pubkey auth even when the shadow entry is locked ("!"). So the Alpine
+# /etc/shadow workaround is NOT needed here.
+#
+# Groups:
+# - Debian/Ubuntu: sudo group grants admin rights
+# - Rocky/RHEL:    wheel group grants admin rights
+# We include both so the same template works for all supported distros; cloud-
+# init silently skips groups that don't exist on the target system.
+# (The "admin" group is intentionally NOT included: it was deprecated on
+# Ubuntu 12.04 and absent on RHEL-family distros.)
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
-    groups: sudo, admin
+    groups: [sudo, wheel]
     shell: /bin/bash
+    lock_passwd: true
     ssh_authorized_keys:
       - ${ssh_key}
 
@@ -23,10 +36,15 @@ packages:
   - qemu-guest-agent
   - curl
 
-# 5. Tailscale installation and configuration
+# 5. Services and Tailscale
+# Order matters: qemu-guest-agent FIRST so Terraform can read the VM IP
+# without waiting for the (potentially slow) Tailscale install.
 runcmd:
   # Enable and start qemu-guest-agent (systemd)
   - [ systemctl, enable, qemu-guest-agent, --now ]
-  # Install and configure Tailscale
+  # Install Tailscale (official installer detects the distro)
   - [ sh, -c, "curl -fsSL https://tailscale.com/install.sh | sh" ]
-  - [ tailscale, up, --authkey=${tailscale_auth_key}, --hostname=${vm_name} ]
+  # Bring the node up on the tailnet. Retry a few times to absorb the small
+  # delay between `systemctl start tailscaled` and the daemon's socket being
+  # ready to accept commands.
+  - [ sh, -c, "for i in 1 2 3 4 5; do tailscale up --authkey=${tailscale_auth_key} --hostname=${vm_name} && break; sleep 2; done" ]

terraform/prod/terraform.tfvars

@@ -34,23 +34,23 @@ admin_ssh_public_key_path = "~/.ssh/keys/id_rsa.pub"
 default_vm_user = "damien"
 
 virtual_machines = {
-  "ipfabric" = {
-    os      = "ipfabric"
-    cores   = 4
-    memory  = 16384
-    disk_gb = 128
-    ip      = "192.168.1.161"
-    gateway = "192.168.1.254"
-    tags    = ["ipfabric"]
-  },
   "komodo" = {
     os      = "alpine"
     cores   = 16
     memory  = 32768
     disk_gb = 32
-    ip      = "192.168.1.162"
+    ip      = "192.168.1.161"
     gateway = "192.168.1.254"
     tags    = ["docker"]
+  },
+  "ipfabric" = {
+    os      = "ipfabric"
+    cores   = 16
+    memory  = 32768
+    disk_gb = 80
+    ip      = "192.168.1.162"
+    gateway = "192.168.1.254"
+    tags    = ["ipfabric"]
   }
 }