CoreOS cloud-config for DigitalOcean with iptables firewall

cloud-config.yml

#cloud-config

coreos:
  etcd2:
    # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3
    # specify the initial size of your cluster with ?size=X
    discovery: https://discovery.etcd.io/<token>
    # multi-region and multi-cloud deployments need to use $public_ipv4
    advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
    initial-advertise-peer-urls: http://$private_ipv4:2380
    # listen on both the official ports and the legacy ports
    # legacy ports can be omitted if your application doesn't depend on them
    listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
    listen-peer-urls: http://$private_ipv4:2380
  fleet:
    public-ip: $private_ipv4   # used for fleetctl ssh command
  units:
    - name: etcd2.service
      command: start
    - name: fleet.service
      command: start
    - name: iptables-restore.service
      enable: true
      command: start
write_files:
  - path: /var/lib/iptables/rules-save
    permissions: 0644
    owner: 'root:root'
    content: |
      *filter
      :INPUT DROP [0:0]
      :FORWARD DROP [0:0]
      :OUTPUT ACCEPT [0:0]
      -A INPUT -i lo -j ACCEPT
      -A INPUT -i eth1 -j ACCEPT
      -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
      -A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 4001 -j ACCEPT
      -A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 2379 -j ACCEPT
      -A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 2380 -j ACCEPT
      -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
      -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
      -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
      COMMIT
      # the last line of the file needs to be a blank line or a comment

@nmdias $private_ipv4 is a substituted variable that DigitalOcean replaces on their own. It's not and should not be defined by the user, but rather is replaced with the droplet's Private IPv4 address by DigitalOcean's infrastructure that creates the droplets