cloud-init User Data Generator

Generate #cloud-config user data that creates an admin user with your SSH key, hardens SSH, installs packages, adds swap, enables a firewall and installs Docker.

Free · No sign-up · Your inputs stay in your browser

Input

Generate cloud-init user data

HostnameAdmin userTime zoneSwap fileEmpty for none.

SSH public keyPackages

Key-only SSH, no root loginInstall Docker

Output

user-data

846 characters

#cloud-config
hostname: web-1
timezone: UTC
package_update: true
package_upgrade: true
packages:
  - nginx
  - ufw
  - fail2ban
  - unattended-upgrades

users:
  - name: deploy
    groups: [sudo, docker]
    shell: /bin/bash
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    lock_passwd: true
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyOnlyReplaceMe deploy@laptop

swap:
  filename: /swapfile
  size: 2G

ssh_pwauth: false
disable_root: true
write_files:
  - path: /etc/ssh/sshd_config.d/99-hardening.conf
    content: |
      PermitRootLogin no
      PasswordAuthentication no
      KbdInteractiveAuthentication no

runcmd:
  - ufw allow OpenSSH
  - ufw allow 'Nginx Full'
  - ufw --force enable
  - curl -fsSL https://get.docker.com | sh
  - usermod -aG docker deploy
  - systemctl reload ssh || systemctl reload sshd

Paste into the user data field of DigitalOcean, Hetzner, AWS EC2 or any image that ships cloud-init; the first line must be #cloud-config. It runs once, on first boot. Check the result on the machine with cloud-init status --long, and the log in /var/log/cloud-init-output.log.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

Where it goes

Paste it into the user data field when creating a server on DigitalOcean, Hetzner, AWS EC2, Linode or any image that includes cloud-init. It runs once, on first boot. The first line must be #cloud-config exactly, or the file is treated as a script. The cloud-init examples document each module.

Checking what happened

On the server, cloud-init status --long reports whether it finished and /var/log/cloud-init-output.log shows command output. A YAML mistake makes cloud-init skip the whole file, so validate with cloud-init schema --config-file user-data.yaml before using it.

Frequently asked questions

Can I run cloud-init again on an existing server?

cloud-init clean --logs followed by a reboot makes it run again as if first boot, but modules that create users or write files may conflict with what exists. It is designed for first boot.

Is user data private?

It is readable from inside the instance through the metadata service and in the provider's console. Do not put long-lived secrets in it; fetch them at boot from a secrets manager.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

cloud-init User Data Generator

Generate cloud-init user data

user-data

Where it goes

Checking what happened

Frequently asked questions

Similar tools

Time Zone List

List Randomizer

Checksum Calculator