#cloud-config
#
# Example: install and configure vpn-router during first boot, supplying an
# existing root CA instead of letting the package create one. See
# cloud-init.yaml.tpl for the variant that creates its own.
#
# Template variables are Terraform templatefile() placeholders. Adapt or drop
# them for whatever renders this file. With root_key empty the root stays
# offline: the router's issuing CAs wait for their certificates, signed with
# the root elsewhere and imported with vpn-router-ca ca import.

hostname: ${hostname}
fqdn: ${fqdn}
manage_etc_hosts: false

apt:
  sources:
    vpn-router:
      source: "deb [signed-by=/etc/apt/keyrings/vpn-router.asc] ${repo_url} ${ubuntu_codename} main"
      key: |
        ${indent(8, trimspace(repo_gpg_key))}

write_files:
  # The configuration file. Created here before the package is installed, so
  # postinst leaves it alone.
  - path: /etc/vpn-router/vpn-router.json
    permissions: '0600'
    owner: root:root
    content: |
      ${jsonencode(config)}

  - path: /etc/vpn-router/pki/root/cert.pem
    permissions: '0644'
    owner: root:root
    content: |
      ${indent(6, trimspace(root_cert))}
%{ if root_key != "" ~}
  - path: /etc/vpn-router/pki/root/key.pem
    permissions: '0600'
    owner: root:root
    content: |
      ${indent(6, trimspace(root_key))}
%{ endif ~}

package_update: true

packages:
  - vpn-router

# Nothing further is required: installing the package starts
# vpn-router-setup, which applies the configuration written above.