I wrote a script which sets up security and stuff for newly provisioned machines if anyone is interested:

→ View original post on X — @jeremyphoward