sacloud startup script for Vault SSH CA

sacloud_startup_script_vault_ssh_ca.sh

#!/bin/bash

# @sacloud-name "enable vault ssh login and create debian user"
# @sacloud-once

# @sacloud-desc Vault SSH CAを使ったSSHログインを有効にします。
# @sacloud-desc https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-certificates
# @sacloud-desc debianユーザも作成されるのでdebianユーザでログインできるようになります
# @sacloud-require-archive distro-debian

export DEBIAN_FRONTEND=noninteractive

apt-get -y update
apt-get -y upgrade
apt-get -y install curl

curl -o /etc/ssh/trusted-user-ca-keys.pem -sL https://{your vault host}:8200/v1/ssh-client-signer/public_key
chmod 600 /etc/ssh/trusted-user-ca-keys.pem
echo "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem" | tee -a /etc/ssh/sshd_config

adduser --disabled-password --gecos "" debian
usermod -aG sudo debian
sed -i 's/^%sudo.*$/%sudo   ALL=(ALL) NOPASSWD:ALL/' /etc/sudoers

sh -c 'sleep 10; reboot' &
exit 0