#cloud-config

users:
  - name: cloudservice
    uid: 2000

write_files:
  - path: /etc/otelcol-contrib/config.yaml
    permissions: "0644"
    owner: root
    content: |
      receivers:
        otlp:
          protocols:
            grpc:
              endpoint: localhost:4317
      exporters:
        googlecloud:
          log:
            default_log_name: opentelemetry.io/collector-exported-log
      processors:
        memory_limiter:
          check_interval: 1s
          limit_percentage: 65
          spike_limit_percentage: 20
        batch:
        resourcedetection:
          detectors: [gcp]
          timeout: 10s
        transform:
          # Several metrics labels are reserved on Google Cloud. We need to prefix them with `exported_` to prevent the exporter from failing.
          # See https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/googlecloudexporter/README.md#preventing-metric-label-collisions for example.
          metric_statements:
          - context: datapoint
            statements:
            - set(attributes["exported_location"], attributes["location"])
            - delete_key(attributes, "location")
            - set(attributes["exported_cluster"], attributes["cluster"])
            - delete_key(attributes, "cluster")
            - set(attributes["exported_namespace"], attributes["namespace"])
            - delete_key(attributes, "namespace")
            - set(attributes["exported_job"], attributes["job"])
            - delete_key(attributes, "job")
            - set(attributes["exported_instance"], attributes["instance"])
            - delete_key(attributes, "instance")
            - set(attributes["exported_project_id"], attributes["project_id"])
            - delete_key(attributes, "project_id")
            - set(attributes["exported_service_name"], attributes["service_name"])
            - delete_key(attributes, "service_name")
            - set(attributes["exported_service_namespace"], attributes["service_namespace"])
            - delete_key(attributes, "service_namespace")
            - set(attributes["exported_service_instance_id"], attributes["service_instance_id"])
            - delete_key(attributes, "service_instance_id")
            - set(attributes["exported_instrumentation_source"], attributes["instrumentation_source"])
            - delete_key(attributes, "instrumentation_source")
            - set(attributes["exported_instrumentation_version"], attributes["instrumentation_version"])
            - delete_key(attributes, "instrumentation_version")
      service:
        telemetry:
          logs:
            level: "debug"
        pipelines:
          traces:
            receivers: [otlp]
            processors: [memory_limiter, batch]
            exporters: [googlecloud]
          metrics:
            receivers: [otlp]
            processors: [memory_limiter, batch, transform]
            exporters: [googlecloud]
          logs:
            receivers: [otlp]
            processors: [memory_limiter, batch]
            exporters: [googlecloud]

  - path: /etc/systemd/system/otel-collector.service
    permissions: "0644"
    owner: root
    content: |
      [Unit]
      Description=Start an OpenTelemetry collector docker container

      [Service]
      TimeoutStartSec=0
      Restart=always
      ExecStartPre=/usr/bin/docker pull otel/opentelemetry-collector-contrib:0.90.1
      ExecStart=/usr/bin/docker run --rm -u 2000 --name=otel-collector --network host --volume /etc/otelcol-contrib/:/etc/otelcol-contrib/ otel/opentelemetry-collector-contrib:0.90.1
      ExecStop=/usr/bin/docker stop otel-collector
      ExecStopPost=/usr/bin/docker rm otel-collector

  - path: /etc/firezone-gateway/.env
    permissions: "0644"
    owner: root
    content: |
      %{ for env in container_environment ~}
      ${env.name}=${env.value}
      %{ endfor ~}

  - path: /etc/systemd/system/gateway.service
    permissions: "0644"
    owner: root
    content: |
      [Unit]
      Description=Start an Firezone Gateway container

      [Service]
      TimeoutStartSec=0
      Restart=always
      ExecStartPre=/usr/bin/docker pull ${container_image}
      ExecStart=/bin/sh -c 'docker run --rm --name=${container_name} --cap-add=NET_ADMIN --volume /etc/firezone --device="/dev/net/tun:/dev/net/tun" --env FIREZONE_NAME=$(hostname) --env FIREZONE_ID=$(echo $RANDOM$(hostname) | md5sum | head -c 20; echo;) --env-file="/etc/firezone-gateway/.env" ${container_image}'
      ExecStop=/usr/bin/docker stop gateway
      ExecStopPost=/usr/bin/docker rm gateway

  - path: /etc/iptables/rules.v6
    permissions: "0644"
    owner: root
    content: |
      *filter
      :INPUT DROP [0:0]
      :FORWARD DROP [0:0]
      :OUTPUT DROP [0:0]
      :DOCKER - [0:0]
      :DOCKER-ISOLATION-STAGE-1 - [0:0]
      :DOCKER-ISOLATION-STAGE-2 - [0:0]
      :DOCKER-USER - [0:0]
      -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A INPUT -i lo -j ACCEPT
      -A INPUT -p ipv6-icmp -j ACCEPT
      -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
      -A INPUT -p tcp -j ACCEPT
      -A INPUT -p udp -j ACCEPT
      -A FORWARD -j DOCKER-USER
      -A FORWARD -j DOCKER-ISOLATION-STAGE-1
      -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
      -A FORWARD -o docker0 -j DOCKER
      -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
      -A FORWARD -i docker0 -o docker0 -j ACCEPT
      -A FORWARD -p tcp -j ACCEPT
      -A FORWARD -p udp -j ACCEPT
      -A FORWARD -p ipv6-icmp -j ACCEPT
      -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
      -A OUTPUT -o lo -j ACCEPT
      -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
      -A DOCKER-ISOLATION-STAGE-1 -j RETURN
      -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
      -A DOCKER-ISOLATION-STAGE-2 -j RETURN
      -A DOCKER-USER -j RETURN
      COMMIT

runcmd:
  - sudo apt update -y
  - sudo apt install postgresql-client jq iperf3 -y
  - sudo apt install apt-transport-https ca-certificates curl software-properties-common -y
  - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
  - echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
  - sudo apt update -y
  - sudo apt install docker-ce docker-ce-cli containerd.io -y
  - sudo usermod -aG docker $(whoami)
  - sudo systemctl enable docker
  - sudo echo '{"ipv6":true,"fixed-cidr-v6":"fd00::/80"}' > /etc/docker/daemon.json
  - sudo systemctl start docker
  - sudo ip6tables-restore < /etc/iptables/rules.v6
  - sudo systemctl daemon-reload
  - sudo systemctl start otel-collector.service
  - sudo systemctl start gateway.service
