diff --git a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md
new file mode 100644
index 0000000000000000000000000000000000000000..4f9b5f16bf6ab2c997758411baf7f98153f5e0f0
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md
@@ -0,0 +1,6 @@
+# Cloud-init creating a simple http static content server
+
+- File `userData` connecting Terraform and Cloud-init
+- Package Nginx + static content
+- Firewall by `network.tf` allowing incoming 80 and 443 (yet unused) connections
+
diff --git a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf
index a17a78fffef217d429aa2c6500663f7fffdd401d..dcfa52d7af012792b763f8d8497510e40972f787 100644
--- a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf
+++ b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf
@@ -27,4 +27,5 @@ resource "hcloud_firewall" "wwwFw" {
       "::/0"
     ]
   }
+
 }
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md
new file mode 100644
index 0000000000000000000000000000000000000000..8893e3ebfccc7828d4da277b6eb2d59e174ec61f
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md
@@ -0,0 +1,5 @@
+# Improving ssh handling and security
+
+- Creating local `bin/ssh` and related `gen/known_hosts` file from templates
+- Enhancing `sshd` security settings
+
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitignore
\ No newline at end of file
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitignore
\ No newline at end of file
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf
new file mode 100644
index 0000000000000000000000000000000000000000..52c074a630f01f203f8f9086d01369b714c4cda6
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf
@@ -0,0 +1,48 @@
+terraform {
+  required_providers {
+    hcloud = {
+      source = "hetznercloud/hcloud"
+    }
+  }
+  required_version = ">= 0.13"
+}
+
+provider "hcloud" {
+  token = var.hcloud_token
+}
+resource "tls_private_key" "host" {
+  algorithm   = "ED25519"
+}
+
+resource "hcloud_ssh_key" "loginUser" {
+  name       = "goik@hdm-stuttgart.de"
+  public_key = file("~/.ssh/id_ed25519.pub")
+}
+
+resource "hcloud_server" "helloServer" {
+  name         = "hello"
+  image        =  "debian-12"
+  server_type  =  "cx11"
+  user_data    = templatefile("tpl/userData.yml", {
+    host_ed25519_private = indent(4, tls_private_key.host.private_key_openssh) # yaml format parsing quirk, sigh!
+    host_ed25519_public  = tls_private_key.host.public_key_openssh
+    devopsSshPublicKey  = hcloud_ssh_key.loginUser.public_key
+  })
+  ssh_keys     = [hcloud_ssh_key.loginUser.id]
+  firewall_ids = [hcloud_firewall.sshFw.id]
+}
+
+resource "local_file" "known_hosts" {
+  content         = "${hcloud_server.helloServer.ipv4_address} ${tls_private_key.host.public_key_openssh}"
+  filename        = "gen/known_hosts"
+  file_permission = "644"
+}
+
+resource "local_file" "ssh_script" {
+  content = templatefile("tpl/ssh.sh", {
+    ip = hcloud_server.helloServer.ipv4_address
+  })
+  filename        = "bin/ssh"
+  file_permission = "700"
+  depends_on      = [local_file.known_hosts]
+}
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf
new file mode 100644
index 0000000000000000000000000000000000000000..0a58ea6647bf9530394a4d5491b0e76eab5da606
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf
@@ -0,0 +1,12 @@
+resource "hcloud_firewall" "sshFw" {
+  name = "www-firewall"
+  rule {
+    direction = "in"
+    protocol  = "tcp"
+    port      = "22"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0"
+    ]
+  }
+}
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf
new file mode 100644
index 0000000000000000000000000000000000000000..a63f85e5283012a999cf461de92feec4adfc2ce8
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf
@@ -0,0 +1,9 @@
+output "hello_ip_addr" {
+  value       = hcloud_server.helloServer.ipv4_address
+  description = "The server's IPv4 address"
+}
+
+output "hello_datacenter" {
+  value       = hcloud_server.helloServer.datacenter
+  description = "The server's datacenter"
+}
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template
new file mode 100644
index 0000000000000000000000000000000000000000..5929da087a27aa9b1d390187a3dd39a7ab347fc0
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template
@@ -0,0 +1 @@
+hcloud_token="your_api_token_goes_here"
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh
new file mode 100644
index 0000000000000000000000000000000000000000..5de61bbbfc9871279e8991caded30b635650ae7b
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+GEN_DIR=$(dirname "$0")/../gen
+
+ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" devops@${ip} "$@"
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml
new file mode 100644
index 0000000000000000000000000000000000000000..cd61df8f304442177d09f8f7364afec9e64bf071
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml
@@ -0,0 +1,20 @@
+#cloud-config
+
+ssh_keys:
+  ed25519_private: |
+    ${host_ed25519_private}
+  ed25519_public: ${host_ed25519_public}
+users:
+  - name: devops
+    groups: users, admin
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ${devopsSshPublicKey}
+
+runcmd:
+  - sed -ie '/^PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
+  - sed -ie '/^PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
+  - sed -ie '/^#AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh/authorized_keys/' /etc/ssh/sshd_config
+  - sed -i '$a AllowUsers devops' /etc/ssh/sshd_config
+  - systemctl restart ssh
diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf
new file mode 100644
index 0000000000000000000000000000000000000000..3eefa6804960a042381853d0ed36d7936b7b5c9b
--- /dev/null
+++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf
@@ -0,0 +1,4 @@
+variable "hcloud_token" {  # See secret.auto.tfvars
+  nullable = false
+  sensitive = true
+}
\ No newline at end of file