Cloud-Init.txt

# CLOUD-INIT - Cloud Instance Initialization Reference - by Richard Rembert

# Cloud-init is the industry standard multi-distribution method for cross-platform cloud instance initialization
# Handles early initialization of cloud instances including networking, storage, SSH keys, packages, and arbitrary scripts

# INSTALLATION AND SETUP

# Cloud-init is pre-installed on most cloud images
# Check if cloud-init is installed
which cloud-init
cloud-init --version

# Install cloud-init (if needed)
# Ubuntu/Debian
sudo apt update
sudo apt install cloud-init

# CentOS/RHEL/Rocky Linux
sudo yum install cloud-init
# or
sudo dnf install cloud-init

# Enable cloud-init services
sudo systemctl enable cloud-init-local
sudo systemctl enable cloud-init
sudo systemctl enable cloud-config
sudo systemctl enable cloud-final

# Check service status
sudo systemctl status cloud-init

# Verify installation
cloud-init status
cloud-init --help


# CLOUD-INIT BASICS AND CONCEPTS

# Key Concepts:
# - User Data: Configuration passed to cloud-init at instance launch
# - Cloud Config: YAML-formatted configuration for cloud-init
# - Modules: Individual components that perform specific tasks
# - Stages: Different phases of cloud-init execution
# - Data Sources: Sources of configuration data (metadata service, user data, etc.)

# Execution Stages:
# 1. Generator: Early boot, before networking
# 2. Local: Early boot, with basic networking
# 3. Network: After networking is configured
# 4. Config: User configuration stage
# 5. Final: Late boot, system is mostly ready

# File Locations:
# /var/lib/cloud/          - Cloud-init working directory
# /var/log/cloud-init.log  - Main log file
# /var/log/cloud-init-output.log - Output from user scripts
# /etc/cloud/cloud.cfg     - Main configuration file
# /etc/cloud/cloud.cfg.d/  - Additional configuration files

# Data Sources (in order of preference):
# - NoCloud: Local data source (ISO, filesystem)
# - ConfigDrive: OpenStack config drive
# - OpenStack: OpenStack metadata service
# - Ec2: Amazon EC2 metadata service
# - Azure: Microsoft Azure metadata service
# - GCE: Google Compute Engine metadata service


# BASIC CLOUD-CONFIG STRUCTURE

# Basic cloud-config YAML format
#cloud-config

# System identification
hostname: web-server-01
fqdn: web-server-01.example.com
manage_etc_hosts: true

# Timezone and locale
timezone: UTC
locale: en_US.UTF-8

# Package management
package_update: true
package_upgrade: true
packages:
  - curl
  - wget
  - git
  - vim

# Simple user creation
users:
  - name: ubuntu
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... user@example.com

# Basic file creation
write_files:
  - path: /etc/motd
    content: |
      Welcome to the server!
      Configured by cloud-init
    owner: root:root
    permissions: '0644'

# Simple commands
runcmd:
  - echo "Cloud-init setup complete" | tee /var/log/setup.log
  - systemctl enable nginx
  - systemctl start nginx

# Final message
final_message: "Cloud-init setup completed at $TIMESTAMP"


# USER MANAGEMENT

# Creating users with various configurations
users:
  # Standard user with sudo access
  - name: ubuntu
    gecos: Ubuntu User
    sudo: ALL=(ALL) NOPASSWD:ALL
    groups: users, admin, docker
    shell: /bin/bash
    lock_passwd: false
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... user@laptop
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@desktop
    ssh_import_id:
      - gh:username  # Import from GitHub
      - lp:username  # Import from Launchpad

  # Service user (system account)
  - name: webapp
    system: true
    shell: /bin/false
    home: /opt/webapp
    create_home: true
    no_user_group: false

  # User with password (hashed)
  - name: developer
    passwd: $6$rounds=4096$salt$hash...  # Use: mkpasswd --method=SHA-512
    lock_passwd: false
    shell: /bin/bash
    groups: developers, docker
    sudo: ["ALL=(ALL) NOPASSWD: /usr/bin/docker", "/usr/bin/systemctl"]

  # Disable default user
  - name: root
    lock_passwd: true

# SSH configuration
ssh_pwauth: false          # Disable password authentication
disable_root: true         # Disable root login
ssh_deletekeys: true       # Delete existing SSH host keys
ssh_genkeytypes: ['rsa', 'dsa', 'ecdsa', 'ed25519']

# SSH key management
ssh_keys:
  rsa_private: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEA...
    -----END RSA PRIVATE KEY-----
  rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC...
  
  ed25519_private: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    b3BlbnNzaC1rZXktdjEAAAAABG5vbmU...
    -----END OPENSSH PRIVATE KEY-----
  ed25519_public: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...

# Global SSH authorized keys
ssh_authorized_keys:
  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... admin@example.com
  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... backup@example.com


# PACKAGE MANAGEMENT

# Basic package operations
package_update: true              # Update package cache
package_upgrade: true             # Upgrade all packages
package_reboot_if_required: true  # Reboot if kernel updated

# Install packages
packages:
  # System utilities
  - curl
  - wget
  - git
  - vim
  - htop
  - tree
  - unzip
  - jq
  
  # Development tools
  - build-essential
  - python3
  - python3-pip
  - nodejs
  - npm
  
  # System administration
  - ufw
  - fail2ban
  - logrotate
  - rsync
  
  # Monitoring tools
  - htop
  - iotop
  - netstat-persistent
  - lsof

# Advanced package repository management
apt:
  preserve_sources_list: false
  sources:
    # Docker repository
    docker:
      source: "deb [arch=amd64] https://download.docker.com/linux/ubuntu $RELEASE stable"
      keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
      filename: docker.list
    
    # Node.js repository
    nodejs:
      source: "deb https://deb.nodesource.com/node_18.x $RELEASE main"
      keyid: 68576280
      filename: nodejs.list
    
    # Kubernetes repository
    kubernetes:
      source: "deb https://apt.kubernetes.io/ kubernetes-xenial main"
      keyid: BA07F4FB
      filename: kubernetes.list
    
    # Custom repository with GPG key
    custom:
      source: "deb https://packages.example.com/ubuntu $RELEASE main"
      key: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        mQENBFJu...
        -----END PGP PUBLIC KEY BLOCK-----

# Snap package management
snap:
  commands:
    - snap install docker
    - snap install kubectl --classic
    - snap install helm --classic
    - snap install code --classic

# YUM/DNF configuration (CentOS/RHEL)
yum_repos:
  epel:
    name: Extra Packages for Enterprise Linux 8
    baseurl: https://download.fedoraproject.org/pub/epel/8/Everything/$basearch
    enabled: true
    gpgcheck: true
    gpgkey: https://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8

# Python package management
pip:
  - ansible
  - docker-compose
  - awscli
  - azure-cli
  - requests
  - pyyaml

# Ruby gems
gem:
  - bundler
  - rails

# Node.js packages
npm:
  - pm2
  - nodemon
  - "@angular/cli"
  - create-react-app


# FILE AND DIRECTORY MANAGEMENT

# Write files to the filesystem
write_files:
  # Simple text file
  - path: /etc/motd
    content: |
      ================================================
      Welcome to {{ ansible_hostname }}
      Environment: Production
      Managed by: Cloud-Init
      Last Updated: $(date)
      ================================================
    owner: root:root
    permissions: '0644'

  # Configuration file with variables
  - path: /etc/nginx/sites-available/default
    content: |
      server {
          listen 80 default_server;
          listen [::]:80 default_server;
          
          root /var/www/html;
          index index.html index.htm index.nginx-debian.html;
          
          server_name _;
          
          location / {
              try_files $uri $uri/ =404;
          }
          
          location /health {
              access_log off;
              return 200 "healthy\n";
              add_header Content-Type text/plain;
          }
          
          # Security headers
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header X-Content-Type-Options "nosniff" always;
      }
    owner: root:root
    permissions: '0644'

  # Environment configuration
  - path: /etc/environment
    content: |
      PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      EDITOR="vim"
      LANG="en_US.UTF-8"
      LC_ALL="en_US.UTF-8"
    append: true

  # Shell script
  - path: /usr/local/bin/health-check.sh
    content: |
      #!/bin/bash
      # Health check script
      
      set -e
      
      # Check if services are running
      check_service() {
          local service=$1
          if systemctl is-active --quiet $service; then
              echo "✓ $service: OK"
          else
              echo "✗ $service: FAILED"
              return 1
          fi
      }
      
      # Check disk space
      check_disk() {
          local usage=$(df / | awk 'NR==2 {print $5}' | sed 's/%//')
          if [ $usage -gt 90 ]; then
              echo "✗ Disk: CRITICAL - ${usage}% used"
              return 1
          elif [ $usage -gt 80 ]; then
              echo "⚠ Disk: WARNING - ${usage}% used"
          else
              echo "✓ Disk: OK - ${usage}% used"
          fi
      }
      
      # Run checks
      echo "Health Check Report - $(date)"
      echo "================================"
      
      check_service nginx
      check_service ssh
      check_disk
      
      echo "Health check completed"
    owner: root:root
    permissions: '0755'

  # JSON configuration file
  - path: /opt/app/config.json
    content: |
      {
        "database": {
          "host": "localhost",
          "port": 5432,
          "name": "myapp",
          "ssl": true
        },
        "redis": {
          "host": "localhost",
          "port": 6379,
          "db": 0
        },
        "logging": {
          "level": "info",
          "format": "json",
          "file": "/var/log/app.log"
        },
        "features": {
          "authentication": true,
          "monitoring": true,
          "debug": false
        }
      }
    owner: app:app
    permissions: '0640'

  # Systemd service file
  - path: /etc/systemd/system/webapp.service
    content: |
      [Unit]
      Description=Web Application
      Documentation=https://docs.example.com
      After=network.target postgresql.service redis.service
      Wants=network.target
      Requires=postgresql.service

      [Service]
      Type=simple
      User=webapp
      Group=webapp
      WorkingDirectory=/opt/webapp
      Environment=NODE_ENV=production
      Environment=PORT=3000
      ExecStart=/opt/webapp/bin/start.sh
      ExecReload=/bin/kill -HUP $MAINPID
      ExecStop=/bin/kill -TERM $MAINPID
      Restart=always
      RestartSec=10
      StandardOutput=journal
      StandardError=journal
      SyslogIdentifier=webapp
      KillMode=mixed
      TimeoutStopSec=30

      # Security settings
      NoNewPrivileges=true
      PrivateTmp=true
      ProtectSystem=strict
      ProtectHome=true
      ReadWritePaths=/opt/webapp/data /var/log

      [Install]
      WantedBy=multi-user.target
    owner: root:root
    permissions: '0644'

  # Binary content (base64 encoded)
  - path: /etc/ssl/certs/ca-certificate.crt
    content: !!binary |
      LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNhakNDQWZPZ0F3SUJBZ0lKQUt...
    owner: root:root
    permissions: '0644'
    encoding: b64

# Directory creation (via runcmd)
runcmd:
  # Create application directories
  - mkdir -p /opt/app/{data,logs,config,tmp}
  - mkdir -p /var/lib/app
  - mkdir -p /etc/app/conf.d
  
  # Set proper ownership and permissions
  - chown -R app:app /opt/app
  - chmod 755 /opt/app
  - chmod 750 /opt/app/data
  - chmod 755 /opt/app/logs
  - chmod 700 /opt/app/config


# STORAGE AND FILESYSTEM CONFIGURATION

# Disk partitioning and setup
disk_setup:
  # Setup additional disk
  /dev/nvme1n1:
    table_type: gpt
    layout:
      - [50, 83]   # 50% for partition 1, type 83 (Linux)
      - [50, 83]   # 50% for partition 2, type 83 (Linux)
    overwrite: false

  # Use entire disk
  /dev/sdb:
    table_type: mbr
    layout: true
    overwrite: false

# Filesystem creation
fs_setup:
  - label: app-data
    filesystem: ext4
    device: /dev/nvme1n1p1
    partition: auto
    
  - label: app-logs
    filesystem: ext4
    device: /dev/nvme1n1p2
    partition: auto
    
  - label: backup
    filesystem: xfs
    device: /dev/sdb1
    partition: auto

# Mount configuration
mounts:
  - ["/dev/nvme1n1p1", "/opt/app/data", "ext4", "defaults,nofail", "0", "2"]
  - ["/dev/nvme1n1p2", "/var/log/app", "ext4", "defaults,nofail", "0", "2"]
  - ["/dev/sdb1", "/backup", "xfs", "defaults,nofail", "0", "2"]
  - ["tmpfs", "/tmp", "tmpfs", "defaults,nodev,nosuid,size=2G", "0", "0"]

# Swap configuration
swap:
  filename: /swapfile
  size: 2G
  maxsize: 4G

# LVM configuration (if needed)
runcmd:
  # LVM setup commands
  - pvcreate /dev/nvme2n1
  - vgcreate data-vg /dev/nvme2n1
  - lvcreate -L 50G -n app-lv data-vg
  - lvcreate -L 30G -n logs-lv data-vg
  - mkfs.ext4 /dev/data-vg/app-lv
  - mkfs.ext4 /dev/data-vg/logs-lv
  - mkdir -p /opt/app /opt/logs
  - mount /dev/data-vg/app-lv /opt/app
  - mount /dev/data-vg/logs-lv /opt/logs
  
  # Add to fstab
  - echo "/dev/data-vg/app-lv /opt/app ext4 defaults 0 2" >> /etc/fstab
  - echo "/dev/data-vg/logs-lv /opt/logs ext4 defaults 0 2" >> /etc/fstab


# NETWORK CONFIGURATION

# Basic hostname and domain setup
hostname: web-server-01
fqdn: web-server-01.example.com
prefer_fqdn_over_hostname: true
manage_etc_hosts: true

# DNS resolver configuration
manage_resolv_conf: true
resolv_conf:
  nameservers:
    - 8.8.8.8
    - 8.8.4.4
    - 1.1.1.1
  searchdomains:
    - example.com
    - internal.example.com
  domain: example.com
  options:
    rotate: true
    timeout: 1

# Static network configuration (Netplan for Ubuntu)
write_files:
  - path: /etc/netplan/01-static.yaml
    content: |
      network:
        version: 2
        renderer: networkd
        ethernets:
          eth0:
            dhcp4: false
            addresses:
              - 192.168.1.100/24
            gateway4: 192.168.1.1
            nameservers:
              addresses:
                - 8.8.8.8
                - 8.8.4.4
              search:
                - example.com
          eth1:
            dhcp4: true
    permissions: '0644'

# Network configuration for older systems
write_files:
  - path: /etc/network/interfaces
    content: |
      # Network configuration
      auto lo
      iface lo inet loopback
      
      auto eth0
      iface eth0 inet static
          address 192.168.1.100
          netmask 255.255.255.0
          gateway 192.168.1.1
          dns-nameservers 8.8.8.8 8.8.4.4
          dns-search example.com
    permissions: '0644'

# Custom hosts entries
write_files:
  - path: /etc/hosts
    content: |
      127.0.0.1 localhost
      ::1 localhost ip6-localhost ip6-loopback
      
      # Infrastructure hosts
      192.168.1.10 database.internal db.internal
      192.168.1.20 cache.internal redis.internal
      192.168.1.30 api.internal
      192.168.1.40 monitor.internal
    append: true

# Apply network configuration
runcmd:
  - netplan apply  # For Ubuntu with Netplan
  # - systemctl restart networking  # For Debian/Ubuntu with interfaces
  # - systemctl restart network  # For CentOS/RHEL


# SYSTEM CONFIGURATION

# Timezone and locale settings
timezone: UTC
locale: en_US.UTF-8
locale_configfile: /etc/default/locale

# NTP time synchronization
ntp:
  enabled: true
  ntp_client: chrony
  servers:
    - 0.pool.ntp.org
    - 1.pool.ntp.org
    - 2.pool.ntp.org
    - 3.pool.ntp.org
  pools:
    - 0.ubuntu.pool.ntp.org
    - 1.ubuntu.pool.ntp.org

# Kernel modules
write_files:
  - path: /etc/modules-load.d/custom.conf
    content: |
      # Custom kernel modules
      overlay
      br_netfilter
      ip_vs
      ip_vs_rr
      ip_vs_wrr
      ip_vs_sh
    owner: root:root
    permissions: '0644'

# System limits configuration
write_files:
  - path: /etc/security/limits.conf
    content: |
      # Custom system limits
      * soft nofile 65536
      * hard nofile 65536
      * soft nproc 32768
      * hard nproc 32768
      
      # Application specific limits
      webapp soft nofile 100000
      webapp hard nofile 100000
      webapp soft nproc 50000
      webapp hard nproc 50000
    append: true

# Sysctl kernel parameters
write_files:
  - path: /etc/sysctl.d/99-custom.conf
    content: |
      # Network optimization
      net.core.rmem_max = 134217728
      net.core.wmem_max = 134217728
      net.ipv4.tcp_rmem = 4096 65536 134217728
      net.ipv4.tcp_wmem = 4096 65536 134217728
      net.core.netdev_max_backlog = 5000
      
      # Security settings
      net.ipv4.conf.all.send_redirects = 0
      net.ipv4.conf.default.send_redirects = 0
      net.ipv4.conf.all.accept_redirects = 0
      net.ipv4.conf.default.accept_redirects = 0
      net.ipv4.conf.all.accept_source_route = 0
      net.ipv4.conf.default.accept_source_route = 0
      net.ipv4.icmp_echo_ignore_broadcasts = 1
      net.ipv4.icmp_ignore_bogus_error_responses = 1
      
      # Performance tuning
      vm.swappiness = 10
      vm.dirty_ratio = 15
      vm.dirty_background_ratio = 5
      vm.vfs_cache_pressure = 50
      
      # File system
      fs.file-max = 2097152
      fs.inotify.max_user_watches = 524288
    owner: root:root
    permissions: '0644'

# System services configuration
services:
  enabled:
    - nginx
    - ssh
    - fail2ban
    - ufw
    - chrony
  disabled:
    - snapd
    - apport

# Bootloader configuration (if needed)
bootcmd:
  - echo 'Cloud-init starting...' > /var/log/cloud-init-start.log
  - mount -a
  - swapon -a

# Apply system configuration
runcmd:
  # Load kernel modules
  - modprobe overlay
  - modprobe br_netfilter
  
  # Apply sysctl settings
  - sysctl -p /etc/sysctl.d/99-custom.conf
  
  # Reload systemd
  - systemctl daemon-reload


# SECURITY CONFIGURATION

# SSH hardening
write_files:
  - path: /etc/ssh/sshd_config.d/99-custom.conf
    content: |
      # Custom SSH security configuration
      Port 2222
      Protocol 2
      
      # Authentication
      PermitRootLogin no
      PasswordAuthentication no
      PubkeyAuthentication yes
      AuthorizedKeysFile .ssh/authorized_keys
      PermitEmptyPasswords no
      ChallengeResponseAuthentication no
      UsePAM yes
      
      # Security settings
      MaxAuthTries 3
      MaxSessions 4
      MaxStartups 10:30:60
      LoginGraceTime 30
      ClientAliveInterval 300
      ClientAliveCountMax 2
      
      # Logging
      SyslogFacility AUTH
      LogLevel VERBOSE
      
      # User restrictions
      AllowUsers ubuntu webapp
      DenyUsers root
      
      # Protocol settings
      X11Forwarding no
      AllowTcpForwarding no
      AllowAgentForwarding no
      PermitTunnel no
      
      # Modern cryptography
      Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
      MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
      KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
    owner: root:root
    permissions: '0644'

# Firewall configuration
write_files:
  - path: /etc/ufw/applications.d/custom
    content: |
      [Nginx Full]
      title=Web Server (Nginx, HTTP + HTTPS)
      description=Small, but very powerful and efficient web server
      ports=80,443/tcp
      
      [SSH Custom]
      title=Secure shell server (custom port)
      description=OpenSSH server on custom port
      ports=2222/tcp
      
      [Web Application]
      title=Custom web application
      description=Node.js/Python web application
      ports=3000/tcp
    owner: root:root
    permissions: '0644'

# Fail2ban configuration
write_files:
  - path: /etc/fail2ban/jail.local
    content: |
      [DEFAULT]
      # Ban settings
      bantime = 1h
      findtime = 10m
      maxretry = 5
      backend = systemd
      
      # Email notifications (optional)
      destemail = admin@example.com
      sendername = Fail2Ban
      sender = fail2ban@example.com
      action = %(action_mw)s
      
      # SSH protection
      [sshd]
      enabled = true
      port = 2222
      logpath = %(sshd_log)s
      backend = %(sshd_backend)s
      maxretry = 3
      
      # Nginx protection
      [nginx-http-auth]
      enabled = true
      filter = nginx-http-auth
      logpath = /var/log/nginx/error.log
      maxretry = 5
      
      [nginx-limit-req]
      enabled = true
      filter = nginx-limit-req
      logpath = /var/log/nginx/error.log
      maxretry = 10
      
      [nginx-botsearch]
      enabled = true
      filter = nginx-botsearch
      logpath = /var/log/nginx/access.log
      maxretry = 2
    owner: root:root
    permissions: '0644'

# System security hardening
runcmd:
  # Configure UFW firewall
  - ufw --force reset
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow 2222/tcp          # SSH
  - ufw allow 80/tcp            # HTTP
  - ufw allow 443/tcp           # HTTPS
  - ufw logging on
  - ufw --force enable
  
  # Restart SSH with new configuration
  - systemctl restart ssh
  
  # Start and enable security services
  - systemctl enable fail2ban
  - systemctl start fail2ban
  
  # Set secure file permissions
  - chmod 700 /home/*/
  - chmod 600 /home/*/.ssh/authorized_keys
  - chmod 700 /home/*/.ssh/
  
  # Remove unnecessary packages
  - apt-get autoremove -y
  - apt-get autoclean


# APPLICATION DEPLOYMENT

# Docker installation and configuration
write_files:
  - path: /etc/docker/daemon.json
    content: |
      {
        "log-driver": "json-file",
        "log-opts": {
          "max-size": "10m",
          "max-file": "3"
        },
        "storage-driver": "overlay2",
        "live-restore": true,
        "userland-proxy": false,
        "experimental": false,
        "metrics-addr": "127.0.0.1:9323",
        "log-level": "info",
        "default-ulimits": {
          "nofile": {
            "Hard": 64000,
            "Name": "nofile",
            "Soft": 64000
          }
        }
      }
    owner: root:root
    permissions: '0644'

# Application configuration
write_files:
  - path: /opt/webapp/start.sh
    content: |
      #!/bin/bash
      set -e
      
      # Environment setup
      export NODE_ENV=production
      export PORT=3000
      export LOG_LEVEL=info
      
      # Wait for dependencies
      echo "Waiting for database connection..."
      until nc -z database.internal 5432; do
        echo "Database not ready, waiting..."
        sleep 2
      done
      
      echo "Waiting for Redis connection..."
      until nc -z cache.internal 6379; do
        echo "Redis not ready, waiting..."
        sleep 2
      done
      
      # Start application
      echo "Starting application..."
      cd /opt/webapp
      npm start
    owner: webapp:webapp
    permissions: '0755'

  - path: /opt/webapp/package.json
    content: |
      {
        "name": "myapp",
        "version": "1.0.0",
        "description": "My Web Application",
        "main": "server.js",
        "scripts": {
          "start": "node server.js",
          "dev": "nodemon server.js",
          "test": "jest",
          "lint": "eslint .",
          "build": "webpack --mode production"
        },
        "dependencies": {
          "express": "^4.18.0",
          "pg": "^8.8.0",
          "redis": "^4.3.0",
          "bcryptjs": "^2.4.3",
          "jsonwebtoken": "^8.5.1"
        },
        "engines": {
          "node": ">=18.0.0"
        }
      }
    owner: webapp:webapp
    permissions: '0644'

# Database setup
write_files:
  - path: /opt/scripts/setup-database.sh
    content: |
      #!/bin/bash
      set -e
      
      echo "Setting up PostgreSQL database..."
      
      # Install PostgreSQL
      apt-get update
      apt-get install -y postgresql postgresql-contrib
      
      # Configure PostgreSQL
      sudo -u postgres createuser --superuser webapp || true
      sudo -u postgres createdb myapp || true
      
      
      # Set up database schema
      sudo -u postgres psql -d myapp -c "
        CREATE TABLE IF NOT EXISTS users (
          id SERIAL PRIMARY KEY,
          username VARCHAR(50) UNIQUE NOT NULL,
          email VARCHAR(100) UNIQUE NOT NULL,
          password_hash VARCHAR(255) NOT NULL,
          created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
          updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
        );
        
        CREATE TABLE IF NOT EXISTS sessions (
          id SERIAL PRIMARY KEY,
          user_id INTEGER REFERENCES users(id),
          token VARCHAR(255) UNIQUE NOT NULL,
          created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
          expires_at TIMESTAMP NOT NULL
        );
        
        CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
        CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
        CREATE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
      "
      
      # Configure PostgreSQL for network access
      PG_VERSION=$(ls /etc/postgresql/)
      sed -i "s/#listen_addresses = 'localhost'/listen_addresses = '*'/" /etc/postgresql/$PG_VERSION/main/postgresql.conf
      echo "host all all 0.0.0.0/0 md5" >> /etc/postgresql/$PG_VERSION/main/pg_hba.conf
      
      # Restart PostgreSQL
      systemctl restart postgresql
      systemctl enable postgresql
      
      echo "Database setup completed"
    owner: root:root
    permissions: '0755'

# Application deployment commands
runcmd:
  # Setup application environment
  - mkdir -p /opt/webapp/{data,logs,tmp}
  - chown -R webapp:webapp /opt/webapp
  
  # Install Docker
  - systemctl enable docker
  - systemctl start docker
  - usermod -aG docker webapp
  
  # Setup database
  - /opt/scripts/setup-database.sh
  
  # Install application dependencies
  - cd /opt/webapp && npm install --production
  
  # Start application service
  - systemctl daemon-reload
  - systemctl enable webapp
  - systemctl start webapp


# MONITORING AND LOGGING

# Log rotation configuration
write_files:
  - path: /etc/logrotate.d/webapp
    content: |
      /opt/webapp/logs/*.log {
        daily
        missingok
        rotate 30
        compress
        delaycompress
        notifempty
        create 0644 webapp webapp
        postrotate
          /bin/kill -USR1 $(cat /var/run/webapp.pid 2>/dev/null) 2>/dev/null || true
        endscript
      }
      
      /var/log/nginx/*.log {
        daily
        missingok
        rotate 30
        compress
        delaycompress
        notifempty
        create 0644 www-data www-data
        prerotate
          if [ -f /var/run/nginx.pid ]; then
            /bin/kill -USR1 $(cat /var/run/nginx.pid)
          fi
        endscript
      }
    owner: root:root
    permissions: '0644'

# System monitoring script
write_files:
  - path: /usr/local/bin/system-monitor.sh
    content: |
      #!/bin/bash
      
      # System monitoring and alerting script
      LOGFILE="/var/log/system-monitor.log"
      DATE=$(date '+%Y-%m-%d %H:%M:%S')
      ALERT_EMAIL="admin@example.com"
      
      # Function to log with timestamp
      log() {
          echo "[$DATE] $1" | tee -a $LOGFILE
      }
      
      # Function to send alert
      send_alert() {
          local subject="$1"
          local message="$2"
          echo "$message" | mail -s "$subject" $ALERT_EMAIL 2>/dev/null || true
      }
      
      # Check disk usage
      check_disk() {
          log "Checking disk usage..."
          while read line; do
              usage=$(echo $line | awk '{print $(NF-1)}' | sed 's/%//')
              partition=$(echo $line | awk '{print $NF}')
              
              if [ $usage -gt 90 ]; then
                  log "CRITICAL: Disk usage on $partition is ${usage}%"
                  send_alert "CRITICAL: Disk Space Alert" "Disk usage on $partition is ${usage}%"
              elif [ $usage -gt 80 ]; then
                  log "WARNING: Disk usage on $partition is ${usage}%"
              fi
          done < <(df -h | grep -vE '^Filesystem|tmpfs|cdrom')
      }
      
      # Check memory usage
      check_memory() {
          log "Checking memory usage..."
          mem_usage=$(free | grep Mem | awk '{printf("%.0f", $3/$2 * 100)}')
          if [ $mem_usage -gt 90 ]; then
              log "CRITICAL: Memory usage is ${mem_usage}%"
              send_alert "CRITICAL: Memory Alert" "Memory usage is ${mem_usage}%"
          elif [ $mem_usage -gt 80 ]; then
              log "WARNING: Memory usage is ${mem_usage}%"
          fi
      }
      
      # Check load average
      check_load() {
          log "Checking system load..."
          load_avg=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | sed 's/,//')
          cpu_cores=$(nproc)
          load_threshold=$(echo "$cpu_cores * 2" | bc -l)
          
          if (( $(echo "$load_avg > $load_threshold" | bc -l) )); then
              log "WARNING: High load average: $load_avg (threshold: $load_threshold)"
              send_alert "WARNING: High Load" "Load average is $load_avg (threshold: $load_threshold)"
          fi
      }
      
      # Check critical services
      check_services() {
          log "Checking services..."
          services=("nginx" "ssh" "webapp" "postgresql" "docker")
          for service in "${services[@]}"; do
              if systemctl is-enabled $service >/dev/null 2>&1; then
                  if ! systemctl is-active --quiet $service; then
                      log "CRITICAL: Service $service is not running"
                      send_alert "CRITICAL: Service Alert" "Service $service is not running"
                  fi
              fi
          done
      }
      
      # Check network connectivity
      check_network() {
          log "Checking network connectivity..."
          if ! ping -c 1 8.8.8.8 >/dev/null 2>&1; then
              log "CRITICAL: No internet connectivity"
              send_alert "CRITICAL: Network Alert" "No internet connectivity detected"
          fi
      }
      
      # Main execution
      log "Starting system monitoring check"
      check_disk
      check_memory
      check_load
      check_services
      check_network
      log "System monitoring check completed"
    owner: root:root
    permissions: '0755'

# Cron jobs for automated tasks
write_files:
  - path: /etc/cron.d/system-maintenance
    content: |
      # System monitoring every 5 minutes
      */5 * * * * root /usr/local/bin/system-monitor.sh
      
      # Daily log cleanup
      0 2 * * * root find /var/log -name "*.log" -mtime +30 -delete
      
      # Weekly system update check
      0 3 * * 0 root apt list --upgradable 2>/dev/null | grep -v "Listing..." | wc -l > /tmp/updates-available
      
      # Daily database backup
      0 1 * * * postgres pg_dumpall | gzip > /backup/database-$(date +\%Y\%m\%d).sql.gz
      
      # Monthly log archive
      0 0 1 * * root tar -czf /backup/logs-$(date +\%Y\%m).tar.gz /var/log/*.log && > /var/log/*.log
    owner: root:root
    permissions: '0644'

# Rsyslog configuration for centralized logging
write_files:
  - path: /etc/rsyslog.d/50-webapp.conf
    content: |
      # Application logging
      if $programname == 'webapp' then /var/log/webapp.log
      & stop
      
      # Security logging
      auth,authpriv.*                 /var/log/auth.log
      
      # Mail logging
      mail.*                          /var/log/mail.log
      
      # Emergency logging
      *.emerg                         :omusrmsg:*
      
      # Remote logging (optional)
      # *.* @@log-server.example.com:514
    owner: root:root
    permissions: '0644'

# Restart rsyslog to apply configuration
runcmd:
  - systemctl restart rsyslog


# CLOUD PROVIDER SPECIFIC CONFIGURATIONS

# AWS EC2 specific setup
write_files:
  - path: /opt/scripts/aws-setup.sh
    content: |
      #!/bin/bash
      
      # AWS-specific initialization
      echo "Configuring AWS-specific settings..."
      
      # Install AWS CLI and CloudWatch agent
      apt-get update
      apt-get install -y awscli amazon-cloudwatch-agent
      
      # Get instance metadata
      INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
      REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/region)
      AZ=$(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone)
      
      # Configure AWS CLI
      aws configure set region $REGION
      aws configure set output json
      
      # Configure CloudWatch agent
      cat << EOF > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
      {
        "agent": {
          "metrics_collection_interval": 60,
          "run_as_user": "cwagent"
        },
        "metrics": {
          "namespace": "CWAgent",
          "metrics_collected": {
            "cpu": {
              "measurement": ["cpu_usage_idle", "cpu_usage_iowait", "cpu_usage_user", "cpu_usage_system"],
              "metrics_collection_interval": 60
            },
            "disk": {
              "measurement": ["used_percent"],
              "metrics_collection_interval": 60,
              "resources": ["*"]
            },
            "mem": {
              "measurement": ["mem_used_percent"],
              "metrics_collection_interval": 60
            }
          }
        },
        "logs": {
          "logs_collected": {
            "files": {
              "collect_list": [
                {
                  "file_path": "/var/log/webapp.log",
                  "log_group_name": "/aws/ec2/webapp",
                  "log_stream_name": "{instance_id}"
                },
                {
                  "file_path": "/var/log/nginx/access.log",
                  "log_group_name": "/aws/ec2/nginx",
                  "log_stream_name": "{instance_id}/access"
                }
              ]
            }
          }
        }
      }
      EOF
      
      # Start CloudWatch agent
      /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
        -a fetch-config -m ec2 -s \
        -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
      
      # Get secrets from AWS Secrets Manager (if configured)
      if aws secretsmanager describe-secret --secret-id "prod/myapp/db" >/dev/null 2>&1; then
          DB_SECRET=$(aws secretsmanager get-secret-value --secret-id "prod/myapp/db" --query SecretString --output text)
          echo "DATABASE_URL=$DB_SECRET" >> /opt/webapp/.env
      fi
      
      # Tag instance
      aws ec2 create-tags --resources $INSTANCE_ID --tags Key=Name,Value="WebServer-$INSTANCE_ID"
      
      echo "AWS setup completed"
    owner: root:root
    permissions: '0755'

# Azure VM specific setup
write_files:
  - path: /opt/scripts/azure-setup.sh
    content: |
      #!/bin/bash
      
      # Azure-specific initialization
      echo "Configuring Azure-specific settings..."
      
      # Install Azure CLI
      curl -sL https://aka.ms/InstallAzureCLIDeb | bash
      
      # Get Azure metadata
      METADATA=$(curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01")
      SUBSCRIPTION_ID=$(echo $METADATA | jq -r '.compute.subscriptionId')
      RESOURCE_GROUP=$(echo $METADATA | jq -r '.compute.resourceGroupName')
      VM_NAME=$(echo $METADATA | jq -r '.compute.name')
      LOCATION=$(echo $METADATA | jq -r '.compute.location')
      
      # Configure Azure CLI with managed identity
      az login --identity
      
      # Get secrets from Azure Key Vault (if configured)
      if az keyvault secret show --vault-name myapp-keyvault --name db-password >/dev/null 2>&1; then
          DB_PASSWORD=$(az keyvault secret show --vault-name myapp-keyvault --name db-password --query value -o tsv)
          echo "DB_PASSWORD=$DB_PASSWORD" >> /opt/webapp/.env
      fi
      
      # Configure application with Azure settings
      echo "AZURE_SUBSCRIPTION_ID=$SUBSCRIPTION_ID" >> /opt/webapp/.env
      echo "AZURE_RESOURCE_GROUP=$RESOURCE_GROUP" >> /opt/webapp/.env
      echo "AZURE_VM_NAME=$VM_NAME" >> /opt/webapp/.env
      echo "AZURE_LOCATION=$LOCATION" >> /opt/webapp/.env
      
      echo "Azure setup completed"
    owner: root:root
    permissions: '0755'

# Google Cloud Platform specific setup
write_files:
  - path: /opt/scripts/gcp-setup.sh
    content: |
      #!/bin/bash
      
      # GCP-specific initialization
      echo "Configuring GCP-specific settings..."
      
      # Install Google Cloud SDK
      echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
      curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
      apt-get update
      apt-get install -y google-cloud-sdk google-cloud-ops-agent
      
      # Get GCP metadata
      PROJECT_ID=$(curl -s "http://metadata.google.internal/computeMetadata/v1/project/project-id" -H "Metadata-Flavor: Google")
      INSTANCE_NAME=$(curl -s "http://metadata.google.internal/computeMetadata/v1/instance/name" -H "Metadata-Flavor: Google")
      ZONE=$(curl -s "http://metadata.google.internal/computeMetadata/v1/instance/zone" -H "Metadata-Flavor: Google" | cut -d/ -f4)
      
      # Configure gcloud
      gcloud config set project $PROJECT_ID
      
      # Get secrets from Secret Manager (if configured)
      if gcloud secrets describe db-password >/dev/null 2>&1; then
          DB_PASSWORD=$(gcloud secrets versions access latest --secret="db-password")
          echo "DB_PASSWORD=$DB_PASSWORD" >> /opt/webapp/.env
      fi
      
      # Configure application with GCP settings
      echo "GCP_PROJECT_ID=$PROJECT_ID" >> /opt/webapp/.env
      echo "GCP_INSTANCE_NAME=$INSTANCE_NAME" >> /opt/webapp/.env
      echo "GCP_ZONE=$ZONE" >> /opt/webapp/.env
      
      # Configure Cloud Ops Agent
      cat << EOF > /etc/google-cloud-ops-agent/config.yaml
      logging:
        receivers:
          webapp_logs:
            type: files
            include_paths:
              - /var/log/webapp.log
        processors:
          webapp_processor:
            type: parse_json
            field: message
        exporters:
          google:
            type: google_cloud_logging
        service:
          pipelines:
            default_pipeline:
              receivers: [webapp_logs]
              processors: [webapp_processor]
              exporters: [google]
      
      metrics:
        receivers:
          hostmetrics:
            type: hostmetrics
            collection_interval: 60s
        exporters:
          google:
            type: google_cloud_monitoring
        service:
          pipelines:
            default_pipeline:
              receivers: [hostmetrics]
              exporters: [google]
      EOF
      
      systemctl restart google-cloud-ops-agent
      
      echo "GCP setup completed"
    owner: root:root
    permissions: '0755'

# Run cloud-specific setup based on detected environment
runcmd:
  # Detect cloud provider and run appropriate setup
  - |
    if curl -s --max-time 3 http://169.254.169.254/latest/meta-data/ >/dev/null 2>&1; then
        echo "AWS detected"
        /opt/scripts/aws-setup.sh
    elif curl -s --max-time 3 -H "Metadata:true" "http://169.254.169.254/metadata/instance" >/dev/null 2>&1; then
        echo "Azure detected"
        /opt/scripts/azure-setup.sh
    elif curl -s --max-time 3 -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/" >/dev/null 2>&1; then
        echo "GCP detected"
        /opt/scripts/gcp-setup.sh
    else
        echo "No major cloud provider detected, using generic setup"
    fi


# KUBERNETES AND CONTAINER ORCHESTRATION

# Kubernetes node setup
write_files:
  - path: /opt/scripts/kubernetes-setup.sh
    content: |
      #!/bin/bash
      set -e
      
      echo "Setting up Kubernetes node..."
      
      # Disable swap
      swapoff -a
      sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
      
      # Load required kernel modules
      cat << EOF > /etc/modules-load.d/k8s.conf
      br_netfilter
      overlay
      EOF
      
      modprobe br_netfilter
      modprobe overlay
      
      # Configure sysctl for Kubernetes
      cat << EOF > /etc/sysctl.d/k8s.conf
      net.bridge.bridge-nf-call-ip6tables = 1
      net.bridge.bridge-nf-call-iptables = 1
      net.ipv4.ip_forward = 1
      EOF
      
      sysctl --system
      
      # Install containerd
      apt-get update
      apt-get install -y ca-certificates curl gnupg lsb-release
      
      # Add Docker repository for containerd
      mkdir -p /etc/apt/keyrings
      curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
      echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
      
      apt-get update
      apt-get install -y containerd.io
      
      # Configure containerd
      mkdir -p /etc/containerd
      containerd config default > /etc/containerd/config.toml
      sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
      
      systemctl restart containerd
      systemctl enable containerd
      
      # Add Kubernetes repository
      curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
      echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | tee /etc/apt/sources.list.d/kubernetes.list
      
      # Install Kubernetes components
      apt-get update
      apt-get install -y kubelet kubeadm kubectl
      apt-mark hold kubelet kubeadm kubectl
      
      # Configure kubelet
      echo 'KUBELET_EXTRA_ARGS="--cgroup-driver=systemd"' > /etc/default/kubelet
      
      systemctl enable kubelet
      systemctl start kubelet
      
      echo "Kubernetes node setup completed"
    owner: root:root
    permissions: '0755'

# Docker Swarm setup
write_files:
  - path: /opt/scripts/docker-swarm-setup.sh
    content: |
      #!/bin/bash
      set -e
      
      echo "Setting up Docker Swarm node..."
      
      # Configure Docker daemon for Swarm
      cat << EOF > /etc/docker/daemon.json
      {
        "log-driver": "json-file",
        "log-opts": {
          "max-size": "10m",
          "max-file": "3"
        },
        "live-restore": false,
        "experimental": false,
        "metrics-addr": "0.0.0.0:9323"
      }
      EOF
      
      systemctl restart docker
      
      # Wait for Docker to be ready
      until docker info >/dev/null 2>&1; do
        echo "Waiting for Docker to be ready..."
        sleep 2
      done
      
      # Check if this should be a manager or worker node
      MANAGER_IP="${SWARM_MANAGER_IP:-10.0.1.10}"
      NODE_TYPE="${SWARM_NODE_TYPE:-worker}"
      
      if [ "$NODE_TYPE" = "manager" ]; then
          echo "Initializing Docker Swarm as manager..."
          docker swarm init --advertise-addr $(hostname -I | awk '{print $1}')
      else
          echo "Joining Docker Swarm as worker..."
          # Get join token from manager
          until docker -H $MANAGER_IP:2376 info >/dev/null 2>&1; do
              echo "Waiting for Swarm manager to be ready..."
              sleep 10
          done
          
          JOIN_TOKEN=$(docker -H $MANAGER_IP:2376 swarm join-token worker -q)
          docker swarm join --token $JOIN_TOKEN $MANAGER_IP:2377
      fi
      
      echo "Docker Swarm setup completed"
    owner: root:root
    permissions: '0755'


# DEVELOPMENT AND TESTING ENVIRONMENTS

# Development environment setup
write_files:
  - path: /opt/scripts/dev-environment-setup.sh
    content: |
      #!/bin/bash
      set -e
      
      echo "Setting up development environment..."
      
      # Install development tools
      apt-get update
      apt-get install -y \
          build-essential \
          cmake \
          git \
          vim \
          code \
          htop \
          tree \
          jq \
          curl \
          wget
      
      # Install multiple Node.js versions via nvm
      sudo -u developer bash -c '
      curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
      source ~/.bashrc
      nvm install 16
      nvm install 18
      nvm use 18
      nvm alias default 18
      '
      
      # Install Python development tools
      pip3 install --user \
          virtualenv \
          pipenv \
          black \
          flake8 \
          pytest \
          jupyter
      
      # Install Go
      GO_VERSION="1.19.5"
      wget -O /tmp/go.tar.gz "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
      rm -rf /usr/local/go
      tar -C /usr/local -xzf /tmp/go.tar.gz
      echo 'export PATH=$PATH:/usr/local/go/bin' >> /home/developer/.bashrc
      
      # Install Docker development tools
      pip3 install docker-compose
      npm install -g @devcontainers/cli
      
      # Setup development directories
      sudo -u developer mkdir -p /home/developer/{projects,workspace,scripts,tools}
      
      # Configure Git globally
      sudo -u developer git config --global init.defaultBranch main
      sudo -u developer git config --global pull.rebase false
      sudo -u developer git config --global --add safe.directory '*'
      
      # Install VS Code extensions (if code is available)
      if command -v code >/dev/null; then
          sudo -u developer code --install-extension ms-vscode.vscode-typescript-next
          sudo -u developer code --install-extension ms-python.python
          sudo -u developer code --install-extension golang.go
          sudo -u developer code --install-extension ms-vscode.docker
          sudo -u developer code --install-extension ms-kubernetes-tools.vscode-kubernetes-tools
      fi
      
      echo "Development environment setup completed"
    owner: root:root
    permissions: '0755'

# Testing environment configuration
write_files:
  - path: /opt/scripts/testing-setup.sh
    content: |
      #!/bin/bash
      set -e
      
      echo "Setting up testing environment..."
      
      # Install testing frameworks
      npm install -g \
          jest \
          cypress \
          @playwright/test \
          newman \
          artillery
      
      # Install Python testing tools
      pip3 install \
          pytest \
          selenium \
          requests \
          beautifulsoup4 \
          locust
      
      # Install browser testing tools
      apt-get update
      apt-get install -y \
          chromium-browser \
          firefox \
          xvfb \
          apache2-utils
      
      # Install Chrome and ChromeDriver for Selenium
      wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | apt-key add -
      echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list
      apt-get update
      apt-get install -y google-chrome-stable
      
      # Install ChromeDriver
      CHROMEDRIVER_VERSION=$(curl -sS chromedriver.storage.googleapis.com/LATEST_RELEASE)
      wget -O /tmp/chromedriver.zip "http://chromedriver.storage.googleapis.com/$CHROMEDRIVER_VERSION/chromedriver_linux64.zip"
      unzip /tmp/chromedriver.zip chromedriver -d /usr/local/bin/
      chmod +x /usr/local/bin/chromedriver
      
      # Create testing workspace
      mkdir -p /opt/testing/{reports,artifacts,screenshots,data}
      chown -R ubuntu:ubuntu /opt/testing
      
      echo "Testing environment setup completed"
    owner: root:root
    permissions: '0755'


# TROUBLESHOOTING AND DEBUGGING

# Cloud-init status and debugging commands
write_files:
  - path: /usr/local/bin/cloud-init-debug.sh
    content: |
      #!/bin/bash
      
      echo "Cloud-init Debugging Information"
      echo "================================"
      echo
      
      # Basic status
      echo "Cloud-init Status:"
      cloud-init status --long
      echo
      
      # Check if cloud-init completed successfully
      echo "Cloud-init Result:"
      if cloud-init status | grep -q "done"; then
          echo "✓ Cloud-init completed successfully"
      else
          echo "✗ Cloud-init did not complete successfully"
      fi
      echo
      
      # Show timing information
      echo "Cloud-init Timing:"
      cloud-init analyze show --format=json | jq -r '.[] | "\(.name): \(.duration)s"' 2>/dev/null || cloud-init analyze show
      echo
      
      # Check for errors in logs
      echo "Recent Errors in Cloud-init Logs:"
      grep -i error /var/log/cloud-init.log | tail -10 || echo "No errors found"
      echo
      
      # Show user data
      echo "User Data:"
      cloud-init query userdata | head -20
      echo "..."
      echo
      
      # Show final message
      echo "Final Message:"
      cloud-init query final-message 2>/dev/null || echo "No final message"
      echo
      
      # Show cloud-init version
      echo "Cloud-init Version:"
      cloud-init --version
      echo
      
      # Show datasource
      echo "Datasource:"
      cloud-init query datasource
    owner: root:root
    permissions: '0755'

# Common troubleshooting commands
troubleshooting_commands = <<-EOT
# Cloud-init Troubleshooting Commands

## Check Status
cloud-init status                    # Current status
cloud-init status --long            # Detailed status with timing
cloud-init status --wait            # Wait for completion

## View Logs
tail -f /var/log/cloud-init.log      # Main log file
tail -f /var/log/cloud-init-output.log  # Command output
journalctl -u cloud-init             # Systemd journal

## Query Information
cloud-init query --all              # All available data
cloud-init query userdata           # User data
cloud-init query vendordata         # Vendor data
cloud-init query merged             # Merged configuration
cloud-init query datasource         # Active datasource

## Debug and Validate
cloud-init devel schema --config-file config.yml  # Validate YAML
cloud-init analyze show             # Show timing analysis
cloud-init collect-logs             # Collect debug information

## Clean and Re-run (for testing)
sudo cloud-init clean               # Clean state
sudo cloud-init clean --logs        # Also remove logs
sudo cloud-init init                # Re-run init phase
sudo cloud-init modules --mode=config  # Re-run config phase

## Check Services
systemctl status cloud-init-local   # Local phase service
systemctl status cloud-init         # Network phase service
systemctl status cloud-config       # Config phase service
systemctl status cloud-final        # Final phase service
EOT

# Common issues and solutions
common_issues = <<-EOT
# Common Cloud-init Issues and Solutions

## 1. Cloud-init not running
# Check if services are enabled
systemctl is-enabled cloud-init-local cloud-init cloud-config cloud-final

# Enable services if needed
sudo systemctl enable cloud-init-local cloud-init cloud-config cloud-final

## 2. User data not processed
# Check if user data is available
curl -s http://169.254.169.254/latest/user-data

# Verify YAML syntax
cloud-init devel schema --config-file user-data.yml

# Common issues:
# - Missing #cloud-config header
# - Invalid YAML syntax (check indentation)
# - Wrong MIME type in multi-part user data

## 3. Package installation failures
# Check package manager logs
tail /var/log/apt/history.log       # Ubuntu/Debian
tail /var/log/yum.log               # CentOS/RHEL

# Manually update package cache
sudo apt-get update                 # Ubuntu/Debian
sudo yum check-update               # CentOS/RHEL

# Check internet connectivity
ping -c 3 8.8.8.8
curl -I https://archive.ubuntu.com

## 4. File permissions issues
# Check file ownership and permissions
ls -la /path/to/file

# Common issues:
# - Wrong user/group specified
# - Invalid permission format (use '0644' not '644')
# - Target directory doesn't exist
# - Parent directory permissions incorrect

## 5. Script execution failures
# Check script syntax
bash -n /path/to/script.sh

# Check script permissions
ls -la /path/to/script.sh

# View script output
grep -A 10 -B 5 "script_name" /var/log/cloud-init-output.log

## 6. SSH access issues
# Check SSH service status
systemctl status ssh

# Check SSH configuration
sudo sshd -T

# Check authorized keys
cat ~/.ssh/authorized_keys

# Check SSH logs
grep ssh /var/log/auth.log

## 7. Network configuration problems
# Check current network status
ip addr show
ip route show
systemctl status systemd-networkd   # Ubuntu with netplan

# Check DNS resolution
nslookup google.com
systemd-resolve --status

# Restart networking
sudo netplan apply                   # Ubuntu
sudo systemctl restart networking   # Debian

## 8. Timing and dependency issues
# Check cloud-init timing
cloud-init analyze show

# Check service dependencies
systemctl list-dependencies cloud-config

# Check boot timing
systemd-analyze blame
systemd-analyze critical-chain


# CLOUD-INIT BEST PRACTICES

best_practices = <<-EOT
# Cloud-init Best Practices

## 1. Configuration Management
# Keep cloud-config files organized and readable
# Use meaningful comments to explain configuration
# Version control your cloud-config files
# Test configurations in staging before production
# Validate YAML syntax before deployment

## 2. Security Best Practices
# Never include plain-text secrets in user data
# Use cloud provider secret managers (AWS Secrets Manager, Azure Key Vault, etc.)
# Disable root login and password authentication
# Use SSH key-based authentication only
# Configure firewall rules restrictively
# Keep packages updated with security patches
# Use separate service accounts for applications

## 3. Performance Optimization
# Minimize package installations in cloud-config
# Use pre-built images with common packages already installed
# Cache frequently downloaded content locally
# Use local package repository mirrors when possible
# Disable unnecessary cloud-init modules
# Use cloud-init caching for repeated deployments

## 4. Error Handling and Reliability
# Always validate input parameters
# Use proper error handling in shell scripts
# Set up comprehensive logging
# Include health checks for critical services
# Plan for rollback scenarios
# Use idempotent operations where possible

## 5. Testing and Validation
# Test cloud-config syntax: cloud-init devel schema --config-file config.yml
# Test in isolated environments first
# Use infrastructure testing tools (Terratest, Kitchen, etc.)
# Monitor cloud-init logs during deployment
# Verify all expected configuration changes
# Test instance replacement scenarios

## 6. Maintenance and Updates
# Regularly update base AMIs/images
# Keep cloud-init version current
# Monitor for deprecated features and migrate
# Clean up temporary files and logs
# Document all custom configurations
# Review and update security configurations

## 7. Portability and Flexibility
# Use cloud-agnostic configurations when possible
# Avoid hard-coding cloud-specific metadata
# Use environment variables for configuration values
# Test across different cloud providers
# Document cloud-specific requirements
# Use conditional logic for multi-cloud deployments
EOT


# ADVANCED CLOUD-INIT FEATURES

# Custom cloud-init modules
write_files:
  - path: /usr/lib/python3/dist-packages/cloudinit/config/cc_custom_app_setup.py
    content: |
      """
      Custom cloud-init module for application setup
      """
      
      from cloudinit import log as logging
      from cloudinit.settings import PER_INSTANCE
      import subprocess
      import os
      
      LOG = logging.getLogger(__name__)
      frequency = PER_INSTANCE
      
      def handle(name, cfg, cloud, log, args):
          """Handle custom application setup"""
          
          if 'custom_app_setup' not in cfg:
              log.debug("No custom_app_setup configuration found")
              return
          
          config = cfg['custom_app_setup']
          log.info("Processing custom application setup")
          
          # Download application
          if 'app_url' in config:
              app_url = config['app_url']
              app_path = config.get('app_path', '/opt/app')
              
              log.info("Downloading application from %s", app_url)
              
              # Create directory
              os.makedirs(app_path, exist_ok=True)
              
              # Download and extract
              cmd = ['wget', '-O', '/tmp/app.tar.gz', app_url]
              subprocess.run(cmd, check=True)
              
              cmd = ['tar', '-xzf', '/tmp/app.tar.gz', '-C', app_path, '--strip-components=1']
              subprocess.run(cmd, check=True)
              
              log.info("Application downloaded to %s", app_path)
          
          # Set permissions
          if 'app_user' in config and 'app_path' in config:
              app_user = config['app_user']
              app_path = config['app_path']
              
              cmd = ['chown', '-R', f"{app_user}:{app_user}", app_path]
              subprocess.run(cmd, check=True)
              
              log.info("Set ownership of %s to %s", app_path, app_user)
          
          # Run custom setup commands
          if 'setup_commands' in config:
              for cmd in config['setup_commands']:
                  log.info("Running setup command: %s", cmd)
                  subprocess.run(cmd, shell=True, check=True)
          
          log.info("Custom application setup completed")
    owner: root:root
    permissions: '0644'

# Enable custom module
write_files:
  - path: /etc/cloud/cloud.cfg.d/99-custom-modules.cfg
    content: |
      # Custom cloud-init modules
      cloud_config_modules:
        - custom_app_setup
        - ssh
        - users_groups
        - write_files
        - runcmd
    owner: root:root
    permissions: '0644'

# Multi-part MIME user data example
multipart_example = <<-EOT
# Multi-part MIME User Data Example

#!/bin/bash
# Script to create multi-part user data

cat << 'EOF' > multipart-userdata.txt
Content-Type: multipart/mixed; boundary="===============1234567890=="
MIME-Version: 1.0

--===============1234567890==
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"

#cloud-config
hostname: multipart-server
package_update: true
packages:
  - nginx
  - git

users:
  - name: ubuntu
    sudo: ALL=(ALL) NOPASSWD:ALL
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...

--===============1234567890==
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="setup.sh"

#!/bin/bash
set -e

echo "Running additional setup script"

# Custom application installation
cd /opt
git clone https://github.com/example/myapp.git
chown -R ubuntu:ubuntu myapp

# Configure nginx
systemctl enable nginx
systemctl start nginx

echo "Setup script completed"

--===============1234567890==
Content-Type: text/upstart-job; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="myservice.conf"

description "My Custom Service"
start on runlevel [2345]
stop on runlevel [06]
respawn
respawn limit 10 5

env USER="myapp"
env DAEMON="/opt/myapp/bin/start"

pre-start script
  test -x $DAEMON || { stop; exit 0; }
end script

exec start-stop-daemon --start --make-pidfile --pidfile /var/run/myservice.pid --chuid $USER --exec $DAEMON

--===============1234567890==--
EOF

# Use the multipart user data file with your cloud provider
EOT

# Cloud-init reporting and webhooks
write_files:
  - path: /etc/cloud/cloud.cfg.d/99-reporting.cfg
    content: |
      # Cloud-init reporting configuration
      reporting:
        webhook:
          type: webhook
          endpoint: https://monitoring.example.com/cloud-init-status
          consumer_key: "webhook-key"
          token_key: "webhook-token"
          token_secret: "webhook-secret"
          consumer_secret: "webhook-consumer-secret"
          timeout: 30
          retries: 3
      
      # Phone home configuration
      phone_home:
        url: https://monitoring.example.com/instance-ready
        post:
          - instance_id
          - hostname
          - fqdn
          - pub_key_rsa
          - pub_key_ed25519
        tries: 3
        timeout: 10
    owner: root:root
    permissions: '0644'


# TERRAFORM INTEGRATION

terraform_integration_example = <<-EOT
# Terraform Integration with Cloud-init

# Data source for cloud-init configuration
data "cloudinit_config" "server_config" {
  gzip          = true
  base64_encode = true

  # Main cloud-config
  part {
    content_type = "text/cloud-config"
    content = templatefile("${path.module}/templates/cloud-init.yml", {
      hostname        = "web-server-${count.index + 1}"
      environment     = var.environment
      project_name    = var.project_name
      ssh_public_keys = var.ssh_public_keys
      database_url    = var.database_url
      api_key         = var.api_key
      app_version     = var.app_version
    })
  }

  # Additional setup script
  part {
    content_type = "text/x-shellscript"
    content = templatefile("${path.module}/scripts/setup.sh", {
      environment     = var.environment
      monitoring_key  = var.monitoring_api_key
      backup_bucket   = var.backup_s3_bucket
    })
  }

  # Custom application configuration
  part {
    content_type = "text/x-shellscript"
    content = file("${path.module}/scripts/app-setup.sh")
  }
}

# AWS EC2 instance using cloud-init
resource "aws_instance" "web_server" {
  count                  = var.instance_count
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  vpc_security_group_ids = [aws_security_group.web.id]
  subnet_id              = aws_subnet.public[count.index % length(aws_subnet.public)].id
  key_name               = var.key_pair_name
  
  # Cloud-init user data
  user_data = data.cloudinit_config.server_config.rendered
  
  # Additional EBS volume for application data
  ebs_block_device {
    device_name = "/dev/sdf"
    volume_type = "gp3"
    volume_size = 50
    encrypted   = true
  }
  
  tags = {
    Name        = "web-server-${count.index + 1}"
    Environment = var.environment
    Project     = var.project_name
  }
  
  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      ami,
      user_data
    ]
  }
}

# Template file: templates/cloud-init.yml
#cloud-config
hostname: ${hostname}
fqdn: ${hostname}.${environment}.example.com

users:
  - name: ubuntu
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
%{ for key in ssh_public_keys ~}
      - ${key}
%{ endfor ~}

package_update: true
package_upgrade: true

write_files:
  - path: /opt/app/.env
    content: |
      NODE_ENV=${environment}
      DATABASE_URL=${database_url}
      API_KEY=${api_key}
      APP_VERSION=${app_version}
    owner: app:app
    permissions: '0600'

  - path: /etc/nginx/sites-available/default
    content: |
      server {
          listen 80;
          server_name ${hostname}.${environment}.example.com;
          
          location / {
              proxy_pass http://localhost:3000;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
          }
          
          location /health {
              access_log off;
              return 200 "healthy\n";
              add_header Content-Type text/plain;
          }
      }
    owner: root:root
    permissions: '0644'

runcmd:
  - systemctl enable nginx
  - systemctl start nginx
  - systemctl enable docker
  - systemctl start docker
  - usermod -aG docker ubuntu
  
  # Mount additional EBS volume
  - mkfs.ext4 /dev/nvme1n1
  - mkdir -p /opt/app/data
  - mount /dev/nvme1n1 /opt/app/data
  - echo '/dev/nvme1n1 /opt/app/data ext4 defaults,nofail 0 2' >> /etc/fstab
  - chown app:app /opt/app/data

final_message: "Server ${hostname} setup completed at $TIMESTAMP"
EOT


# COMMAND REFERENCE

command_reference = <<-EOT
# Cloud-init Command Reference

## Status and Information Commands
cloud-init status                         # Show current status
cloud-init status --long                  # Detailed status with timing
cloud-init status --wait                  # Wait for completion
cloud-init --version                      # Show version information

## Query Commands
cloud-init query --all                    # Show all available data
cloud-init query userdata                 # Show user data
cloud-init query vendordata               # Show vendor data
cloud-init query merged                   # Show merged configuration
cloud-init query network-config           # Show network configuration
cloud-init query datasource               # Show active datasource
cloud-init query final-message            # Show final message

## Development and Testing Commands
cloud-init devel schema --config-file config.yml    # Validate cloud-config syntax
cloud-init devel render --config-file config.yml    # Render Jinja2 templates
cloud-init devel net-convert                        # Convert network config formats
cloud-init devel make-mime --attach file1:text/cloud-config --attach file2:text/x-shellscript  # Create MIME

## Module Control Commands
cloud-init modules --mode=init            # Run init-stage modules
cloud-init modules --mode=config          # Run config-stage modules
cloud-init modules --mode=final           # Run final-stage modules
cloud-init single --name=module_name      # Run specific module

## Analysis and Debugging Commands
cloud-init analyze show                   # Show timing analysis
cloud-init analyze show --format=json     # Show timing in JSON format
cloud-init analyze dump                   # Dump all timing data
cloud-init collect-logs                   # Collect logs for debugging

## Cleanup Commands
cloud-init clean                          # Clean cloud-init state
cloud-init clean --logs                   # Clean state and remove logs
cloud-init clean --seed                   # Clean state and remove seed
cloud-init clean --reboot                 # Clean and reboot system

## Configuration Commands
cloud-init dhclient-hook                  # DHCP client integration
cloud-init features                       # Show available features

## Log File Locations
/var/log/cloud-init.log                   # Main cloud-init log
/var/log/cloud-init-output.log            # Output from scripts and commands
/var/log/syslog                          # System log (includes cloud-init messages)

## Configuration File Locations
/etc/cloud/cloud.cfg                      # Main configuration file
/etc/cloud/cloud.cfg.d/                   # Additional configuration directory
/var/lib/cloud/                           # Cloud-init working directory
/var/lib/cloud/instance/                  # Instance-specific data
/var/lib/cloud/data/                      # Cloud-init runtime data

## Service Management
systemctl status cloud-init-local         # Check local stage service
systemctl status cloud-init               # Check network stage service
systemctl status cloud-config             # Check config stage service
systemctl status cloud-final              # Check final stage service

## Useful Debugging Commands
journalctl -u cloud-init                  # View cloud-init journal logs
grep -r "ERROR\|WARN" /var/log/cloud-init* # Find errors and warnings
tail -f /var/log/cloud-init.log           # Follow cloud-init log in real-time
cloud-init analyze show | grep -E "(FAIL|ERROR)"  # Find failed modules
EOT


# COMPLETE EXAMPLES

# Production web server example
production_web_server = <<-EOT
#cloud-config

# Production Web Server Configuration
hostname: web-prod-01
fqdn: web-prod-01.example.com
manage_etc_hosts: true

# Time and locale
timezone: UTC
locale: en_US.UTF-8

# Package management
package_update: true
package_upgrade: true
package_reboot_if_required: false

packages:
  - nginx
  - certbot
  - python3-certbot-nginx
  - ufw
  - fail2ban
  - htop
  - curl
  - git
  - logrotate
  - unattended-upgrades
  - apt-listchanges

# User management
users:
  - name: webadmin
    gecos: Web Administrator
    sudo: ALL=(ALL) NOPASSWD:ALL
    groups: users, admin
    shell: /bin/bash
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... webadmin@company.com
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... backup-key

  - name: webapp
    system: true
    shell: /bin/false
    home: /opt/webapp
    create_home: true

# SSH security
ssh_pwauth: false
disable_root: true

write_files:
  # Nginx configuration
  - path: /etc/nginx/sites-available/webapp
    content: |
      upstream backend {
          server 127.0.0.1:3000 max_fails=3 fail_timeout=30s;
      }
      
      server {
          listen 80;
          server_name example.com www.example.com;
          return 301 https://$server_name$request_uri;
      }
      
      server {
          listen 443 ssl http2;
          server_name example.com www.example.com;
          
          # SSL configuration will be managed by certbot
          
          # Security headers
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header Referrer-Policy "no-referrer-when-downgrade" always;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          
          # Gzip compression
          gzip on;
          gzip_vary on;
          gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
          
          location / {
              proxy_pass http://backend;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_connect_timeout 30s;
              proxy_send_timeout 30s;
              proxy_read_timeout 30s;
          }
          
          location /health {
              access_log off;
              return 200 "healthy\n";
              add_header Content-Type text/plain;
          }
          
          location /static/ {
              alias /opt/webapp/static/;
              expires 1y;
              add_header Cache-Control "public, immutable";
          }
      }
    owner: root:root
    permissions: '0644'

  # Application systemd service
  - path: /etc/systemd/system/webapp.service
    content: |
      [Unit]
      Description=Web Application
      Documentation=https://docs.example.com
      After=network.target postgresql.service
      Wants=network.target
      
      [Service]
      Type=simple
      User=webapp
      Group=webapp
      WorkingDirectory=/opt/webapp
      Environment=NODE_ENV=production
      Environment=PORT=3000
      ExecStart=/opt/webapp/bin/start.sh
      ExecReload=/bin/kill -HUP $MAINPID
      Restart=always
      RestartSec=10
      StandardOutput=journal
      StandardError=journal
      SyslogIdentifier=webapp
      
      # Security settings
      NoNewPrivileges=true
      PrivateTmp=true
      ProtectSystem=strict
      ProtectHome=true
      ReadWritePaths=/opt/webapp/data /opt/webapp/logs
      
      [Install]
      WantedBy=multi-user.target
    owner: root:root
    permissions: '0644'

  # UFW application profile
  - path: /etc/ufw/applications.d/webapp
    content: |
      [Nginx Full]
      title=Web Server (Nginx, HTTP + HTTPS)
      description=Small, but very powerful and efficient web server
      ports=80,443/tcp
      
      [SSH]
      title=Secure shell server
      description=OpenSSH server
      ports=22/tcp
    owner: root:root
    permissions: '0644'

  # Fail2ban configuration
  - path: /etc/fail2ban/jail.local
    content: |
      [DEFAULT]
      bantime = 1h
      findtime = 10m
      maxretry = 5
      
      [sshd]
      enabled = true
      
      [nginx-http-auth]
      enabled = true
      filter = nginx-http-auth
      logpath = /var/log/nginx/error.log
      
      [nginx-limit-req]
      enabled = true
      filter = nginx-limit-req
      logpath = /var/log/nginx/error.log
      maxretry = 10
    owner: root:root
    permissions: '0644'

  # Automated security updates
  - path: /etc/apt/apt.conf.d/50unattended-upgrades
    content: |
      Unattended-Upgrade::Allowed-Origins {
          "${distro_id}:${distro_codename}-security";
          "${distro_id}ESMApps:${distro_codename}-apps-security";
          "${distro_id}ESM:${distro_codename}-infra-security";
      };
      
      Unattended-Upgrade::AutoFixInterruptedDpkg "true";
      Unattended-Upgrade::MinimalSteps "true";
      Unattended-Upgrade::Remove-Unused-Dependencies "true";
      Unattended-Upgrade::Automatic-Reboot "false";
      Unattended-Upgrade::Automatic-Reboot-Time "02:00";
    owner: root:root
    permissions: '0644'

  # Log rotation for application
  - path: /etc/logrotate.d/webapp
    content: |
      /opt/webapp/logs/*.log {
        daily
        missingok
        rotate 30
        compress
        delaycompress
        notifempty
        create 0644 webapp webapp
        postrotate
          /bin/systemctl reload webapp
        endscript
      }
    owner: root:root
    permissions: '0644'

# System configuration
runcmd:
  # Firewall setup
  - ufw --force reset
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow OpenSSH
  - ufw allow 'Nginx Full'
  - ufw --force enable
  
  # Configure Nginx
  - rm -f /etc/nginx/sites-enabled/default
  - ln -s /etc/nginx/sites-available/webapp /etc/nginx/sites-enabled/
  - nginx -t
  - systemctl enable nginx
  - systemctl start nginx
  
  # SSL certificate
  - certbot --nginx -d example.com -d www.example.com --non-interactive --agree-tos --email admin@example.com
  
  # Enable services
  - systemctl enable fail2ban
  - systemctl start fail2ban
  - systemctl enable webapp
  - systemctl daemon-reload
  
  # Setup directories
  - mkdir -p /opt/webapp/{data,logs,tmp}
  - chown -R webapp:webapp /opt/webapp
  - chmod 755 /opt/webapp
  - chmod 750 /opt/webapp/data
  
  # System optimization
  - echo 'vm.swappiness = 10' >> /etc/sysctl.conf
  - echo 'net.core.rmem_max = 134217728' >> /etc/sysctl.conf
  - sysctl -p

final_message: "Production web server setup completed successfully at $TIMESTAMP"
power_state:
  mode: reboot
  message: "Rebooting to apply all configurations"
  condition: true
EOT

# Database server example
database_server_example = <<-EOT
#cloud-config

# PostgreSQL Database Server Configuration
hostname: db-server-01
fqdn: db-server-01.internal.example.com

# Package management
package_update: true
package_upgrade: true

packages:
  - postgresql
  - postgresql-contrib
  - postgresql-client
  - ufw
  - fail2ban
  - htop

# User management
users:
  - name: dbadmin
    sudo: ALL=(ALL) NOPASSWD:ALL
    groups: users, admin
    shell: /bin/bash
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... dbadmin@company.com

write_files:
  # PostgreSQL configuration
  - path: /etc/postgresql/14/main/postgresql.conf
    content: |
      # PostgreSQL configuration
      listen_addresses = '*'
      port = 5432
      max_connections = 100
      shared_buffers = 256MB
      effective_cache_size = 1GB
      maintenance_work_mem = 64MB
      checkpoint_completion_target = 0.9
      wal_buffers = 16MB
      default_statistics_target = 100
      random_page_cost = 1.1
      effective_io_concurrency = 200
      
      # Logging
      log_destination = 'stderr'
      logging_collector = on
      log_directory = 'log'
      log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
      log_statement = 'all'
      log_line_prefix = '%t [%p]: [%l-1] user=%u,db=%d,app=%a,client=%h '
      
      # Replication (if needed)
      wal_level = replica
      max_wal_senders = 3
      wal_keep_segments = 32
    owner: postgres:postgres
    permissions: '0644'

  # PostgreSQL authentication
  - path: /etc/postgresql/14/main/pg_hba.conf
    content: |
      # PostgreSQL Client Authentication Configuration
      
      # TYPE  DATABASE        USER            ADDRESS                 METHOD
      
      # "local" is for Unix domain socket connections only
      local   all             postgres                                peer
      local   all             all                                     peer
      
      # IPv4 local connections:
      host    all             all             127.0.0.1/32            md5
      
      # IPv6 local connections:
      host    all             all             ::1/128                 md5
      
      # Allow connections from application servers
      host    all             all             10.0.0.0/8              md5
      host    all             all             172.16.0.0/12           md5
      host    all             all             192.168.0.0/16          md5
    owner: postgres:postgres
    permissions: '0640'

  # Database backup script
  - path: /usr/local/bin/db-backup.sh
    content: |
      #!/bin/bash
      
      # Database backup script
      BACKUP_DIR="/var/backups/postgresql"
      DATE=$(date +%Y%m%d_%H%M%S)
      
      mkdir -p $BACKUP_DIR
      
      # Backup all databases
      sudo -u postgres pg_dumpall > $BACKUP_DIR/all_databases_$DATE.sql
      
      # Compress backup
      gzip $BACKUP_DIR/all_databases_$DATE.sql
      
      # Remove backups older than 7 days
      find $BACKUP_DIR -name "*.sql.gz" -mtime +7 -delete
      
      echo "Database backup completed: all_databases_$DATE.sql.gz"
    owner: root:root
    permissions: '0755'

# System configuration
runcmd:
  # Configure firewall
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow ssh
  - ufw allow 5432/tcp
  - ufw --force enable
  
  # Start PostgreSQL
  - systemctl enable postgresql
  - systemctl start postgresql
  
  # Create application database and user
  - sudo -u postgres createdb myapp
  - sudo -u postgres psql -c "CREATE USER myapp WITH PASSWORD 'secure_password';"
  - sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE myapp TO myapp;"
  
  # Setup backup cron job
  - echo "0 2 * * * root /usr/local/bin/db-backup.sh" >> /etc/crontab
  
  # Restart PostgreSQL with new configuration
  - systemctl restart postgresql

final_message: "Database server setup completed at $TIMESTAMP"
EOT


echo "Cloud-Init Reference Complete!"
echo "Cloud-init enables automated configuration of cloud instances across providers"
echo "Practice with simple configurations before moving to complex multi-service setups"
echo "Remember: Always validate YAML syntax and test configurations in staging first"
echo "Key principles: Security first, automate everything, monitor and log all changes"