#cloud-config
users:
  - name: username
    lock_passwd: false
    passwd: "{password_hash}"
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC..[rest of pubkey]
    groups: wheel
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD: ALL']
prefer_fqdn_over_hostname: true
packages:
  - bind-utils
  - plocate
  - unzip
  - tar
  - policycoreutils-python-utils
  - rsync
  - nfs-utils
  - vim
  - firewalld
  - curl
runcmd:
  - echo "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub" >> /etc/ssh/sshd_config
  - sed -i 's/^#*HostKey \/etc\/ssh\/ssh_host_ed25519_key/HostKey \/etc\/ssh\/ssh_host_ed25519_key/' /etc/ssh/sshd_config
  - sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
  - sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
  - sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
  - dnf upgrade -y && systemctl reboot