kalloeash/vm-template ? reverse-engineered prompt

Build me a repo that hardens a fresh Debian family VM in one command. I want it to take a stock Ubuntu or Debian cloud image and apply the usual secure setup that a person would normally do by hand, including updates, a sudo admin user, SSH locked down to keys only, root login off, firewall rules, fail2ban, kernel and network hardening, Docker log limits, journald persistence, and a final report with a hardening score.

Make it idempotent so running it twice shows nothing changed the second time. I want a make harden flow for applying changes, a make audit flow that only checks things and reports results, plus support for running individual pieces on their own. Please include tests, a cloud init example, and documentation for how to use it on a fresh VM. If you need current docs for tools like Lynis or ssh audit, look them up online.