Change default SSH port and introduce cloud-init support

[jackivanov]

Description

I would like to bring support for cloud-init as the first step to set up a server and make some changes that Ansible is not capable of.

Motivation and Context

The motivations are to eliminate issues like #1613, and bring more security by changing the default SSH port (#1635), the default SSH user, and removing all others hardcoded users by the cloud provider. Cloud-init also might be used to solve more problems and speed up the deployment process.

For Lightsail and Vultr it is only possible with a bash script, for all the others we can use the native cloud-config.

The changes are not compatible with Scaleway For scaleway the uri module is being used (see ansible/ansible/issues/65036) and I'm thinking of removing this provider from Algo as I've been continuously fighting with their services, producing new bugs. I'm not sure the effort is worth any further support.

Fixes #1613, Closes #1635

How Has This Been Tested?

Deployed to every cloud provider, but more tests should be done.

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist:

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have added tests to cover my changes.
• All new and existing tests passed.

[davidemyers]

I like the idea of having a consistent user account across cloud providers.

The bash script should probably make the sudoers file mode 0440 and the .ssh directory mode 0700 to match cloud-init.

I'm not sure why the algo user needs to be in group sudo since you're creating a custom sudoers file, but it would be handy if it was at least in group adm to be able to read logs and use journalctl without having to use sudo.

Here's a patch for the firewall documentation:

diff --git a/docs/firewalls.md b/docs/firewalls.md
index 8feb508..3b76fcc 100644
--- a/docs/firewalls.md
+++ b/docs/firewalls.md
@@ -24,7 +24,7 @@ Any external firewall must be configured to pass the following incoming ports ov
 
 Port | Protocol | Description | Related variables in `config.cfg`
 ---- | -------- | ----------- | ---------------------------------
-22    | TCP | Secure Shell (SSH) | None
+4160  | TCP | Secure Shell (SSH) | `ssh_port`
 500   | UDP | IPsec IKEv2 | `ipsec_enabled`
 4500  | UDP | IPsec NAT-T | `ipsec_enabled`
 51820 | UDP | WireGuard | `wireguard_enabled`, `wireguard_port`

[jackivanov]

I think this is ready for tests and reviews