user-data.template

#cloud-config

# ========================================================================
# RASPBERRY PI CLOUD SERVER - USER-DATA TEMPLATE
# ========================================================================
#
# This is a TEMPLATE file for cloud-init configuration.
# DO NOT edit this file directly - it contains variable placeholders.
#
# USAGE:
# 1. Copy secrets.env.example to secrets.env
# 2. Edit secrets.env with your actual configuration
# 3. Make script executable: chmod +x generate-userdata.sh
# 4. Run ./generate-userdata.sh to generate the final user-data file
# 5. Copy user-data to /media/$USER/system-boot/user-data
#
# More information: https://cloudinit.readthedocs.io/
# ========================================================================

# vim: syntax=yaml
#
# Download the latest Ubuntu Server image for RaspberryPi from https://ubuntu.com/download/raspberry-pi.
# Flash the SD-Card and copy this file to the system-boot partition before
# boot the RaspberryPi:
#
# $ unxz ubuntu-25.10-preinstalled-server-arm64+raspi.img.xz
# $ pv ubuntu-25.10-preinstalled-server-arm64+raspi.img.img \
# | sudo dd iflag=fullblock of=/dev/mmcblk0 bs=64M oflag=direct5-10-01-raspios-trixie-arm64-lite.img -B 16m \
# | sudo dd iflag=fullblock of=/dev/sda bs=64M oflag=direct && sync
# $ cp user-data.yaml /media/$USER/system-boot/user-data
#
# Alternatively install Ubuntu Server via "$ sudo apt install rpi-imager", see
# https://ubuntu.com/tutorials/how-to-install-ubuntu-on-your-raspberry-pi#1-overview

# set hostname and update hosts-file entries
hostname: ${HOSTNAME}

# Set up the keyboard layout. See localectl(1), in particular the various
# list-x11-* sub-commands, to determine the available models, layouts,
# variants, and options
keyboard:
  layout: de

# Allow SSH password authentication
ssh_pwauth: true

# modify user information
users:
- name: pirate
  groups: users,docker,video
  shell: /bin/bash
  lock_passwd: false
  #ssh_authorized_keys:
  #- ssh-ed25519 AAAAC..
  ssh_import_id:
  - gh:${GITHUB_USER}
  sudo: ALL=(ALL) NOPASSWD:ALL
- name: ${USER1}
  gecos: ${USER1}
  lock_passwd: true
  no_create_home: true
  shell: /usr/sbin/nologin
- name: ${USER2}
  gecos: ${USER2}
  lock_passwd: true
  no_create_home: true
  shell: /usr/sbin/nologin

chpasswd:
  expire: true
  users:
  - {name: pirate, password: hypriot, type: text}

apt:
  sources:
    docker.list:
      source: "deb [arch=arm64] https://download.docker.com/linux/ubuntu $RELEASE stable"
      keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

package_update: true
package_upgrade: true
package_reboot_if_required: true
packages:
- avahi-daemon
- byobu
- ca-certificates
- curl
- dnsmasq
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
- iptables-persistent
- mc
- mdadm
- net-tools
- samba
- samba-common-bin
- tmux
- vim
- vlan

timezone: "Europe/Berlin"

#device_aliases:
#   <alias name>: <device path>
disk_setup:
    /dev/sda:
        table_type: gpt
        layout: true
        overwrite: false
    /dev/sdb:
        table_type: gpt
        layout: true
        overwrite: false

write_files:
  # configure console font
  #- path: /etc/default/console-setup
  #  content: |
  #    # Consult the console-setup(5) manual page.
  #    ACTIVE_CONSOLES="/dev/tty[1-6]"
  #    CHARMAP="UTF-8"
  #    VIDEOMODE=
  #    FONT="Lat15-Terminus18x10.psf.gz"
  #    FONTFACE=
  #    FONTSIZE=
  #    CODESET="Lat15"
  #  permissions: '0644'
  #  owner: root:root

  # configure VLAN network segmentation with netplan
  - path: /etc/netplan/50-cloud-init.yaml
    owner: root:root
    permissions: '0600'
    content: |
      network:
        version: 2
        renderer: networkd
        ethernets:
          eth0:
            dhcp4: false
            addresses:
              - ${STATIC_IP}/24
            routes:
              - to: default
                via: ${GATEWAY_IP}
            nameservers:
              addresses: [${GATEWAY_IP}, 8.8.8.8]
        vlans:
          eth0.${VLAN_IOT}:
            id: ${VLAN_IOT}
            link: eth0
            addresses:
              - 192.168.${VLAN_IOT}.1/24
          eth0.${VLAN_GUEST}:
            id: ${VLAN_GUEST}
            link: eth0
            addresses:
              - 192.168.${VLAN_GUEST}.1/24

  # configure dnsmasq for VLAN DHCP/DNS services
  - path: /etc/dnsmasq.d/${DOMAIN}.conf
    owner: root:root
    permissions: '0644'
    content: |
      # dnsmasq for VLAN network (DHCP+DNS) - IoT and Guest VLANs
      domain=${DOMAIN}
      expand-hosts
      domain-needed
      bogus-priv
      no-resolv
      server=${UPSTREAM_DNS_SERVER}
      cache-size=2000
      log-queries
      log-dhcp

      # Listen on all relevant interfaces (eth0 for Privat, VLAN interfaces for IoT/Guest)
      interface=eth0
      interface=eth0.${VLAN_IOT}
      interface=eth0.${VLAN_GUEST}
      
      # Don't bind to wildcard address (security)
      bind-interfaces

      # NOTE: For (${DOMAIN}) domain resolution to work on your main network, you must
      # configure your primary router to use this Pi (${STATIC_IP}) as its
      # local DNS server. See README.md for details.

      # VLAN IoT
      dhcp-range=tag:eth0.${VLAN_IOT},${IOT_DHCP_START},${IOT_DHCP_END},24h
      dhcp-option=tag:eth0.${VLAN_IOT},option:router,192.168.${VLAN_IOT}.1
      dhcp-option=tag:eth0.${VLAN_IOT},option:dns-server,${STATIC_IP}

      # VLAN Guest
      dhcp-range=tag:eth0.${VLAN_GUEST},${GUEST_DHCP_START},${GUEST_DHCP_END},24h
      dhcp-option=tag:eth0.${VLAN_GUEST},option:router,192.168.${VLAN_GUEST}.1
      dhcp-option=tag:eth0.${VLAN_GUEST},option:dns-server,${STATIC_IP}

      # DHCP leases file
      dhcp-leasefile=/var/lib/misc/dnsmasq.leases

  # configure iptables firewall rules for VLAN routing and isolation
  - path: /etc/iptables/rules.v4
    owner: root:root
    permissions: '0644'
    content: |
      *nat
      :PREROUTING ACCEPT [0:0]
      :INPUT ACCEPT [0:0]
      :OUTPUT ACCEPT [0:0]
      :POSTROUTING ACCEPT [0:0]
      # NAT for Docker containers (docker0 bridge network)
      -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
      # NAT for IoT and Guest VLANs to WAN
      -A POSTROUTING -s 192.168.${VLAN_IOT}.0/24 -o eth0 -j MASQUERADE
      -A POSTROUTING -s 192.168.${VLAN_GUEST}.0/24 -o eth0 -j MASQUERADE
      COMMIT

      # NOTE: For inter-VLAN routing to work, you must add static routes on your
      # primary router pointing the VLAN subnets (192.168.20.0/24, 192.168.30.0/24)
      # to this Pi's IP address (${STATIC_IP}). See README.md for details.
      *filter
      :INPUT ACCEPT [0:0]
      :FORWARD DROP [0:0]
      :OUTPUT ACCEPT [0:0]
      # Allow established connections
      -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
      # Allow Privat -> Internet, IoT, Guest
      -A FORWARD -s 192.168.${PRIVAT_SUBNET_OCTET}.0/24 -d 0.0.0.0/0 -j ACCEPT
      # Allow Docker container traffic (docker0 bridge)
      -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
      -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
      # Allow IoT/Guest -> WAN (eth0)
      -A FORWARD -i eth0.${VLAN_IOT} -o eth0 -j ACCEPT
      -A FORWARD -i eth0.${VLAN_GUEST} -o eth0 -j ACCEPT
      # Allow intra-VLAN traffic
      -A FORWARD -s 192.168.${VLAN_IOT}.0/24 -d 192.168.${VLAN_IOT}.0/24 -j ACCEPT
      -A FORWARD -s 192.168.${VLAN_GUEST}.0/24 -d 192.168.${VLAN_GUEST}.0/24 -j ACCEPT
      # Block IoT -> Privat
      -A FORWARD -s 192.168.${VLAN_IOT}.0/24 -d 192.168.${PRIVAT_SUBNET_OCTET}.0/24 -j DROP
      # Block Guest -> Privat
      -A FORWARD -s 192.168.${VLAN_GUEST}.0/24 -d 192.168.${PRIVAT_SUBNET_OCTET}.0/24 -j DROP
      COMMIT

  # helper script to display DHCP leases
  - path: /usr/local/bin/show-dhcp-leases
    owner: root:root
    permissions: '0755'
    content: |
      #!/bin/bash
      LEASE_FILE="/var/lib/misc/dnsmasq.leases"
      if [ ! -f "$LEASE_FILE" ]; then
        echo "No dnsmasq lease file found"
        exit 0
      fi
      printf "\n%-20s %-18s %-15s %-20s\n" "LEASE-TIME" "MAC" "IP" "HOSTNAME"
      printf "%0.s-" {1..80}; printf "\n"
      while read -r lease mac ip host _; do
        ts=$(date -d @"$lease" +"%Y-%m-%d %H:%M:%S" 2>/dev/null || echo "$lease")
        printf "%-20s %-18s %-15s %-20s\n" "$ts" "$mac" "$ip" "$host"
      done < "$LEASE_FILE"
      echo ""

  # helper script to check VLAN network configuration
  - path: /usr/local/bin/check-network
    owner: root:root
    permissions: '0755'
    content: |
      #!/bin/bash
      # Network configuration check for VLAN setup
      set -e

      echo "=== Interface status ==="
      if ip link show eth0.20 >/dev/null 2>&1 && ip link show eth0.30 >/dev/null 2>&1; then
        ip -br addr show | grep 'eth0' || true
      else
        echo "VLAN interfaces not yet configured"
      fi

      echo ""
      echo "=== dnsmasq status ==="
      systemctl is-active --quiet dnsmasq && echo "dnsmasq: active" || echo "dnsmasq: NOT active"
      if [ -f /var/lib/misc/dnsmasq.leases ]; then
        lease_count=$(wc -l < /var/lib/misc/dnsmasq.leases)
        echo "DHCP leases: $lease_count"
      else
        echo "No lease file found"
      fi

      echo ""
      echo "=== IP forwarding ==="
      if [ "$(cat /proc/sys/net/ipv4/ip_forward)" = "1" ]; then
        echo "IP forwarding: enabled"
      else
        echo "IP forwarding: DISABLED (should be enabled)"
      fi

      echo ""
      echo "=== iptables NAT rules ==="
      iptables -t nat -L POSTROUTING -n -v 2>/dev/null | grep -E "MASQUERADE|Chain" || echo "No NAT rules found"

      echo ""
      echo "=== iptables FORWARD rules ==="
      iptables -L FORWARD -n -v 2>/dev/null | grep -E "eth0|Chain" | head -10 || echo "No FORWARD rules found"

      echo ""
      echo "=== DNS resolution test ==="
      dig @${STATIC_IP} example.org +short +time=2 2>/dev/null || echo "DNS query failed"

      echo ""
      echo "=== Gateway connectivity ==="
      ping -c 2 -W 2 ${GATEWAY_IP} >/dev/null 2>&1 && echo "Gateway ${GATEWAY_IP}: reachable" || echo "Gateway ${GATEWAY_IP}: UNREACHABLE"

      echo ""
      echo "Done."

  # configure SAMBA shares
  - content: |
      [${USER1}]
      path=/mnt/raid1/${USER1}
      create mask=0700
      directory mask=0700
      valid users = ${USER1}
      write list = ${USER1}
      map read only = no

      [${USER2}]
      path=/mnt/raid1/${USER2}
      create mask=0700
      directory mask=0700
      valid users = ${USER2},${USER1}
      write list = ${USER2},${USER1}
      map read only = no

      [shared]
      path=/mnt/raid1/shared
      writeable=Yes
      create mask=0777
      directory mask=0777
      public=no

      [public]
      path=/mnt/raid1/public
      browseable = yes
      writable = yes
      public = yes
      guest ok = yes
      map read only = no
    path: /etc/samba/smb.conf

  # configure Unifi Controller docker-compose
  - content: |
      services:
        unifi:
          image: ryansch/unifi-rpi:latest
          container_name: unifi
          restart: unless-stopped
          environment:
            JAVA_OPTS: -Xmx1024M
          network_mode: host
          volumes:
            # Unifi v5.0.7 creates all of these directories (some remain empty)
            - config:/var/lib/unifi
            - log:/usr/lib/unifi/logs
            - log2:/var/log/unifi
            - run:/usr/lib/unifi/run
            - run2:/run/unifi
            - work:/usr/lib/unifi/work

      volumes:
        config:
        log:
        log2:
        run:
        run2:
        work:
    path: /opt/unifi/compose.yml
    owner: root:root
    permissions: '0644'

  # configure Unifi systemd service
  - content: |
      [Unit]
      Description=Unifi Controller
      After=docker.service
      BindsTo=docker.service

      [Service]
      TimeoutStartSec=0
      TimeoutStopSec=30
      Restart=always
      RestartSec=10

      WorkingDirectory=/opt/unifi

      ExecStartPre=-/usr/bin/docker compose kill
      ExecStartPre=-/usr/bin/docker compose rm -f

      ExecStart=/usr/bin/docker compose up --force-recreate

      ExecStop=/usr/bin/docker compose stop

      [Install]
      WantedBy=multi-user.target
    path: /opt/unifi/unifi.service
    owner: root:root
    permissions: '0644'

  # configure midnight commander with lynx-like motion (system-wide)
  - path: /etc/skel/.config/mc/ini
    content: |
      [Midnight-Commander]
      use_internal_edit=true

      [Panels]
      navigate_with_arrows=true
    owner: root:root
    permissions: '0644'


# these commands will run once on first boot only
runcmd:
  # pickup hostname-, network-changes
  - systemctl restart avahi-daemon
  - systemctl restart docker

  # initialize VLAN networking
  - modprobe 8021q || true
  - sleep 2
  - netplan apply || true
  - sysctl -w net.ipv4.ip_forward=1
  - grep -q '^net.ipv4.ip_forward=1' /etc/sysctl.conf || echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
  - iptables-restore < /etc/iptables/rules.v4 || true
  
  # disable systemd-resolved to free port 53 for dnsmasq
  - systemctl disable --now systemd-resolved || true
  - rm -f /etc/resolv.conf
  - |
    cat > /etc/resolv.conf << 'EOF'
    nameserver ${GATEWAY_IP}
    nameserver 8.8.8.8
    EOF
  - chattr +i /etc/resolv.conf || true
  
  # start dnsmasq now that port 53 is available
  - systemctl enable --now dnsmasq || true
  - netfilter-persistent save || true

  # configure MOTD - disable unwanted default scripts
  - chmod -x /etc/update-motd.d/10-help-text
  - chmod -x /etc/update-motd.d/50-motd-news 2>/dev/null || true
  - |
    cat > /etc/update-motd.d/99-system-status << 'MOTD_EOF'
    #!/bin/bash
    echo " ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─"
    echo ""

    # Get uptime
    uptime_info=$(uptime -p | sed 's/up //')

    # Get RAID space
    raid_space=$(df -h /mnt/raid1 2>/dev/null | awk 'NR==2 {printf "%s / %s", $3, $2}')

    # Get container count and status
    docker_status=$(systemctl is-active docker 2>/dev/null || echo "inactive")
    container_count=$(docker ps -q 2>/dev/null | wc -l)

    # Get Samba count and shares (exclude default sections like [homes], [printers])
    share_count=$(grep -c '^\[' /etc/samba/smb.conf 2>/dev/null || echo "0")
    share_names=$(grep '^\[' /etc/samba/smb.conf | sed 's/^\[//;s/\]$//' | grep -Ev '^(global|homes|printers)$' | tr '\n' ', ' | sed 's/,$//')

    # Line 1: Hostname and Uptime
    printf "  %-28s  %s\n" "Hostname: $(hostname)" "Uptime: $uptime_info"

    # Line 2: RAID status
    if grep -q '\[UU\]' /proc/mdstat 2>/dev/null; then
        raid_status="Healthy [UU]"
        if mountpoint -q /mnt/raid1 2>/dev/null; then
            printf "  %-28s  %s\n" "RAID: $raid_status" "Storage: $raid_space"
        else
            printf "  %-28s\n" "RAID: $raid_status"
        fi
    elif grep -q 'resync\|recovery' /proc/mdstat 2>/dev/null; then
        printf "  %-28s\n" "RAID: SYNCING"
    else
        printf "  %-28s\n" "RAID: Check /proc/mdstat"
    fi

    # Line 3: Docker status and running containers
    if [ "$container_count" -gt 0 ]; then
        containers=$(docker ps --format "{{.Names}}" | tr '\n' ', ' | sed 's/,$//')
        printf "  %-28s  %s\n" "Docker: $docker_status ($container_count running)" "→ $containers"
    else
        printf "  %-28s\n" "Docker: $docker_status ($container_count running)"
    fi

    # Line 4: Samba status
    samba_status=$(systemctl is-active smbd 2>/dev/null || echo "inactive")
    if [ "$samba_status" = "active" ]; then
        if [ -n "$share_names" ]; then
            printf "  %-28s  %s\n" "Samba: $samba_status ($share_count shares)" "→ $share_names"
        else
            printf "  %-28s\n" "Samba: $samba_status"
        fi
    else
        printf "  %-28s\n" "Samba: $samba_status"
    fi

    # Line 5: dnsmasq status and DHCP leases
    dnsmasq_status=$(systemctl is-active dnsmasq 2>/dev/null || echo "inactive")
    if [ "$dnsmasq_status" = "active" ]; then
        lease_count=$(wc -l < /var/lib/misc/dnsmasq.leases 2>/dev/null || echo "0")
        if [ "$lease_count" -gt 0 ]; then
            printf "  %-28s\n" "dnsmasq: $dnsmasq_status ($lease_count leases)"
            /usr/local/bin/show-dhcp-leases 2>/dev/null | head -8
        else
            printf "  %-28s\n" "dnsmasq: $dnsmasq_status (0 leases)"
        fi
    else
        printf "  %-28s\n" "dnsmasq: $dnsmasq_status"
    fi

    echo ""
    echo "  Tip: Run 'sudo check-network' for detailed network diagnostics"
    echo ""
    MOTD_EOF
  - chmod +x /etc/update-motd.d/99-system-status

  # ========================================================================
  # RAID1 SETUP - Handles both fresh install and existing array scenarios
  # ========================================================================
  # FRESH INSTALL: Create new RAID1 array (only if /dev/md0 doesn't exist)
  - |
    if ! mdadm --detail /dev/md0 >/dev/null 2>&1; then
      echo ">>> Fresh install detected - creating new RAID1 array"
      # Stop and zero any existing RAID metadata to prevent auto-assembly as md127
      mdadm --stop /dev/md127 2>/dev/null || true
      mdadm --zero-superblock /dev/sda1 /dev/sdb1 2>/dev/null || true
      # Create new RAID1 array
      mdadm --create --run --verbose /dev/md0 --level=1 --raid-devices=2 /dev/sda1 /dev/sdb1
      mkfs.ext4 -F /dev/md0
      echo ">>> RAID array /dev/md0 created successfully"
    else
      echo ">>> Existing RAID array /dev/md0 detected - preserving data"
    fi

  # BOTH SCENARIOS: Mount RAID array
  - mkdir -p /mnt/raid1
  - mount /dev/md0 /mnt/raid1 || true

  # BOTH SCENARIOS: Persist RAID configuration (fstab and mdadm.conf)
  - grep -q '/dev/md0' /etc/fstab || echo '/dev/md0 /mnt/raid1 ext4 defaults,nofail,noatime 0 1' >> /etc/fstab
  - |
    if ! grep -q '^ARRAY /dev/md' /etc/mdadm/mdadm.conf 2>/dev/null; then
      mdadm --detail --scan | grep '^ARRAY' >> /etc/mdadm/mdadm.conf
      update-initramfs -u
    fi

  # BOTH SCENARIOS: Create share directory structure (mkdir -p is idempotent)
  - mkdir -p /mnt/raid1/${USER1}
  - mkdir -p /mnt/raid1/${USER2}
  - mkdir -p /mnt/raid1/shared
  - mkdir -p /mnt/raid1/public

  # BOTH SCENARIOS: Ensure correct ownership and permissions (always re-applied)
  - chown -R ${USER1}:sambashare /mnt/raid1/${USER1}
  - chown -R ${USER2}:sambashare /mnt/raid1/${USER2}
  - chown -R pirate:sambashare /mnt/raid1/shared
  - chmod -R 2770 /mnt/raid1/${USER1}
  - chmod -R 2770 /mnt/raid1/${USER2}
  - chmod -R 2770 /mnt/raid1/shared
  - chmod -R 2775 /mnt/raid1/public

  # Add users to sambashare group and set Samba passwords
  - usermod -a -G sambashare ${USER1}
  - usermod -a -G sambashare ${USER2}
  - (echo ${USER1_SAMBA_PASSWORD}; echo ${USER1_SAMBA_PASSWORD}) | smbpasswd -a ${USER1} -s
  - (echo ${USER2_SAMBA_PASSWORD}; echo ${USER2_SAMBA_PASSWORD}) | smbpasswd -a ${USER2} -s
  # ========================================================================
  # RAID1 SETUP - Done
  # ========================================================================

  # set up dynamic DNS updater (wait for Docker to be ready)
  - docker run --name ddclient --env HOSTNAME=${DDNS_HOSTNAME} --env UPDATE_TOKEN=${DDNS_TOKEN} --restart unless-stopped --detach netzfisch/rpi-dyndns

  # set up Unifi controller
  - mkdir -p /opt/unifi
  - systemctl enable --now /opt/unifi/unifi.service

  # set up VPN server
  #- docker run --name vpnserver \
  #             --cap-add NET_ADMIN \
  #             --publish 500:500/udp \
  #             --publish 4500:4500/udp \
  #             --volume /mnt/raid1/shared/configs/vpn:/mnt \
  #             --restart unless-stopped \
  #             --detach netzfisch/rpi-vpn-server

final_message: "The system is finally up, after $UPTIME seconds"

# To DEBUG log into the instance, check '/var/log/cloud-init-output.log', and
# run single commands to verify, e.g.:
#
# $ sudo cloud-init single --name users_groups --frequency always
#
# RAID DATA PROTECTION:
# The runcmd section uses conditional checks (if ! mdadm --detail /dev/md0) to prevent
# destroying existing RAID arrays when re-running cloud-init. The disk_setup and fs_setup
# modules use "overwrite: false" to skip partition/filesystem creation on existing drives.
#
# DOCKER VOLUME PERSISTENCE:
# Docker named volumes (Unifi config, logs, etc.) persist automatically when containers
# are removed. The cleanup procedure removes containers but NOT volumes, preserving all
# Unifi settings, devices, and network configurations across cloud-init re-runs.
# - To verify: docker volume ls | grep unifi
# - To inspect: docker volume inspect unifi_config
# - To reset Unifi (DESTRUCTIVE): docker volume rm unifi_config unifi_log unifi_log2 unifi_run unifi_run2 unifi_work
#
# To RE-RUN cloud-init without losing data:
#
# 1. Wait for RAID sync to complete:
# $ watch cat /proc/mdstat
#
# 2. Unlock the immutable resolv.conf for deletion:
# $ sudo chattr -i /etc/resolv.conf
#
# 3. Clean up ALL auto-generated files and directories:
# $ sudo rm -rf /etc/dnsmasq.d/*.conf /etc/iptables/rules.v4 /etc/netplan/50-cloud-init.yaml /usr/local/bin/show-dhcp-leases /usr/local/bin/check-network /etc/update-motd.d/99-system-status /etc/skel/.config/mc/ini /etc/mdadm/mdadm.conf /etc/samba/smb.conf /opt/unifi/compose.yml /opt/unifi/unifi.service
#
# 4. Stop and remove Docker containers:
# $ docker stop ddclient unifi && docker rm ddclient unifi
#
# 5. Re-run cloud-init (RAID data will be preserved):
# $ sudo cloud-init clean --logs --reboot
#
# The system will reboot and re-apply cloud-init configuration:
# - RAID array /dev/md0 will be detected and preserved (not recreated)
# - All other services will be reconfigured
# - Data in /mnt/raid1 remains intact