精通 Netcup Server Control Panel (SCP)：Cloud-Init 零接触部署、边缘状态防火墙、CoW 快照与 REST API 自动化

#cloud-config
hostname: nc-prod-node01
fqdn: nc-prod-node01.example.com
manage_etc_hosts: true
timezone: UTC

package_update: true
package_upgrade: true
packages:
  - qemu-guest-agent
  - ufw
  - fail2ban
  - curl
  - jq
  - htop
  - iotop
  - unattended-upgrades

users:
  - name: opsadmin
    groups: [sudo, adm, systemd-journal]
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIReplaceWithYourActualEd25519PublicKey opsadmin@secops

ssh_pwauth: false
disable_root: true

write_files:
  - path: /etc/ssh/sshd_config.d/99-netcup-hardening.conf
    permissions: '0600'
    content: |
      PermitRootLogin no
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      X11Forwarding no
      MaxAuthTries 3
      AllowUsers opsadmin
  - path: /etc/sysctl.d/99-netcup-bbr.conf
    permissions: '0644'
    content: |
      net.core.default_qdisc = fq
      net.ipv4.tcp_congestion_control = bbr
      net.ipv4.tcp_fastopen = 3
      net.ipv6.conf.all.forwarding = 1

runcmd:
  - sysctl --system
  - systemctl enable --now qemu-guest-agent
  - systemctl enable --now fstrim.timer
  - systemctl restart ssh || systemctl restart sshd
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow 22/tcp comment 'SSH Admin'
  - ufw allow 80/tcp comment 'HTTP Ingress'
  - ufw allow 443/tcp comment 'HTTPS Ingress'
  - ufw allow 443/udp comment 'HTTP3 QUIC'
  - ufw --force enable
  - systemctl enable --now fail2ban

# Netcup 静态 IPv4 (/22) + 经由链路本地网关 fe80::1 静态路由的 /64 IPv6 配置
network:
  version: 2
  ethernets:
    eth0:
      match:
        macaddress: "aa:bb:cc:dd:ee:ff" # 填写 SCP -> Network 选项卡中显示的虚拟网卡 MAC 地址
      set-name: eth0
      dhcp4: false
      dhcp6: false
      accept-ra: false
      addresses:
        - 152.53.xxx.xxx/22             # 替换为 SCP 中分配给您的主 IPv4 地址与 CIDR 掩码长度
        - 2a0a:4cc0:xxxx:xxxx::1/64     # 您名下 /64 IPv6 子网中的第 1 个主用地址
        - 2a0a:4cc0:xxxx:xxxx::2/64     # 可选：绑定同一 /64 段内的第 2 个 IPv6 地址用于发信或出站代理
      nameservers:
        addresses:
          - 46.38.225.230               # Netcup 官方 Anycast DNS 节点 1
          - 46.38.252.230               # Netcup 官方 Anycast DNS 节点 2
          - 2a03:4000:0:1::e1e6         # Netcup 官方 IPv6 DNS 节点
      routes:
        - to: default
          via: 152.53.xxx.1             # 填写 SCP -> Network 中显示的 IPv4 默认网关
        - to: "::/0"
          via: "fe80::1"                # Netcup 全机房通用的标准 IPv6 链路本地网关
          on-link: true

#!/usr/bin/env bash
# 部署路径: /etc/qemu/fsfreeze-hook.d/10-postgresql-checkpoint.sh
# 权限要求: chmod 0755 /etc/qemu/fsfreeze-hook.d/10-postgresql-checkpoint.sh

set -euo pipefail

case "$1" in
  freeze)
    if systemctl is-active --quiet postgresql; then
      su - postgres -c "psql -U postgres -c 'CHECKPOINT;'" >/dev/null 2>&1 || true
      logger -t qemu-fsfreeze "已在 Netcup SCP CoW 在线快照冻结前完成 PostgreSQL CHECKPOINT 刷盘"
    fi
    ;;
  thaw)
    logger -t qemu-fsfreeze "Netcup SCP CoW 快照打点完成，客户机文件系统已解冻恢复写入"
    ;;
esac

#!/usr/bin/env bash
# 通过 Netcup SCP Keycloak OIDC 认证并查询服务器实例状态及创建在线 CoW 快照
set -euo pipefail

SCP_TOKEN_URL="https://www.servercontrolpanel.de/realms/scp/protocol/openid-connect/token"
SCP_API_BASE="https://www.servercontrolpanel.de/scp-core/api/v1"

# 1. 使用离线 Refresh Token 向 Keycloak 换取短期有效的 Bearer Access Token：
ACCESS_TOKEN=$(curl -sS -X POST "$SCP_TOKEN_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=scp" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=${NETCUP_SCP_REFRESH_TOKEN}" | jq -r '.access_token')

# 2. 枚举当前账户名下所有 Root Server 与 VPS 实例的 ID、主机名与运行状态：
curl -sS -X GET "${SCP_API_BASE}/servers" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Accept: application/json" | jq '.[] | {id: .id, name: .name, hostname: .hostname, status: .status}'

# 3. 在执行生产环境变更前自动创建一致性在线写时复制（CoW）快照：
SERVER_ID="123456"
curl -sS -X POST "${SCP_API_BASE}/servers/${SERVER_ID}/snapshots" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"name": "pre-upgrade-'$(date +%Y%m%d)'", "description": "Ansible 发布前自动创建的 CoW 快照"}'