Arch Linux VPS setup & hardening script (ported from vps-bootstrap)
This commit is contained in:
Gavin Nugent
commit
7fa912af1b
1 changed files with 619 additions and 0 deletions
619
arch-setup.sh
Executable file
619
arch-setup.sh
Executable file
|
|
@ -0,0 +1,619 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# VPS Setup & Hardening Script for Arch Linux
|
||||||
|
# For use with ONCE (Basecamp) + Docker deployments
|
||||||
|
# Run as root on a fresh Arch Linux VPS
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# DEFAULTS
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
GITHUB_PAT=""
|
||||||
|
TIMEZONE="Europe/London"
|
||||||
|
LOCALE="en_GB.UTF-8"
|
||||||
|
|
||||||
|
# Comma-separated list of repos to clone (leave empty to skip)
|
||||||
|
# Format: "user/repo:/opt/apps/dirname,user/repo2:/opt/apps/dirname2"
|
||||||
|
REPOS_TO_CLONE=""
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# COLOURS
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
log() { echo -e "${GREEN}[✓]${NC} $1"; }
|
||||||
|
warn() { echo -e "${YELLOW}[!]${NC} $1"; }
|
||||||
|
err() { echo -e "${RED}[✗]${NC} $1"; }
|
||||||
|
step() { echo -e "\n${CYAN}━━━ $1 ━━━${NC}\n"; }
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# PRE-FLIGHT CHECKS
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
if [ "$EUID" -ne 0 ]; then
|
||||||
|
err "This script must be run as root."
|
||||||
|
err "Usage: sudo bash arch-setup.sh"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! grep -qi '^ID=arch' /etc/os-release 2>/dev/null; then
|
||||||
|
warn "This script is designed for Arch Linux. Proceed with caution."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# INTERACTIVE SETUP
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
echo -e "${CYAN}"
|
||||||
|
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||||
|
echo "║ VPS Setup & Hardening Script ║"
|
||||||
|
echo "║ Arch Linux · Docker · ONCE · Git ║"
|
||||||
|
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||||
|
echo -e "${NC}"
|
||||||
|
|
||||||
|
# SSH alias
|
||||||
|
echo ""
|
||||||
|
echo " This name is used in your local SSH config so you can"
|
||||||
|
echo " connect with: ssh <alias> (e.g. ssh titan, ssh nebula)"
|
||||||
|
read -rp "SSH alias for this server [vps]: " input_alias
|
||||||
|
SSH_ALIAS="${input_alias:-vps}"
|
||||||
|
|
||||||
|
# Username
|
||||||
|
echo ""
|
||||||
|
read -rp "Choose a username for the deploy user [deploy]: " input_user
|
||||||
|
DEPLOY_USER="${input_user:-deploy}"
|
||||||
|
|
||||||
|
# Validate username
|
||||||
|
if ! [[ "$DEPLOY_USER" =~ ^[a-z_][a-z0-9_-]*$ ]]; then
|
||||||
|
err "Invalid username. Use lowercase letters, numbers, hyphens, underscores."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Git name
|
||||||
|
read -rp "Git display name [Gavin]: " input_git_name
|
||||||
|
GIT_NAME="${input_git_name:-Gavin}"
|
||||||
|
|
||||||
|
# Git email
|
||||||
|
read -rp "Git email: " input_git_email
|
||||||
|
GIT_EMAIL="${input_git_email}"
|
||||||
|
|
||||||
|
if [ -z "$GIT_EMAIL" ]; then
|
||||||
|
warn "No Git email set — you can configure this later"
|
||||||
|
GIT_EMAIL="not-set@example.com"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# GitHub PAT
|
||||||
|
echo ""
|
||||||
|
echo " A GitHub Personal Access Token lets the server pull from"
|
||||||
|
echo " your private repos and container registry (GHCR)."
|
||||||
|
echo " You can skip this and add one later."
|
||||||
|
read -rp "GitHub username (leave empty to skip): " input_gh_user
|
||||||
|
GITHUB_USER="${input_gh_user:-}"
|
||||||
|
|
||||||
|
if [ -n "$GITHUB_USER" ]; then
|
||||||
|
read -rp "GitHub PAT: " input_pat
|
||||||
|
GITHUB_PAT="${input_pat:-}"
|
||||||
|
|
||||||
|
if [ -n "$GITHUB_PAT" ]; then
|
||||||
|
# Validate PAT format (should start with ghp_ or github_pat_)
|
||||||
|
if ! [[ "$GITHUB_PAT" =~ ^(ghp_|github_pat_) ]]; then
|
||||||
|
warn "PAT doesn't look right — expected it to start with ghp_ or github_pat_"
|
||||||
|
read -p "Continue anyway? (y/n) " -n 1 -r
|
||||||
|
echo ""
|
||||||
|
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||||
|
GITHUB_PAT=""
|
||||||
|
GITHUB_USER=""
|
||||||
|
warn "Skipping GitHub setup — you can configure it later"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
warn "No PAT provided — skipping GitHub setup"
|
||||||
|
GITHUB_USER=""
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
GITHUB_PAT=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Confirm
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}━━━ Confirm settings ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
echo " SSH alias: $SSH_ALIAS"
|
||||||
|
echo " Deploy user: $DEPLOY_USER"
|
||||||
|
echo " Git name: $GIT_NAME"
|
||||||
|
echo " Git email: $GIT_EMAIL"
|
||||||
|
echo " GitHub user: $([ -n "$GITHUB_USER" ] && echo "$GITHUB_USER" || echo 'Not set')"
|
||||||
|
echo " Git PAT: $([ -n "$GITHUB_PAT" ] && echo 'Set' || echo 'Not set')"
|
||||||
|
echo " Timezone: $TIMEZONE"
|
||||||
|
echo ""
|
||||||
|
read -p "Continue? (y/n) " -n 1 -r
|
||||||
|
echo ""
|
||||||
|
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||||
|
echo "Aborted."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 1. SYSTEM UPDATES & ESSENTIALS
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "1/8 · System updates & essential packages"
|
||||||
|
|
||||||
|
pacman -Syu --noconfirm
|
||||||
|
pacman -S --noconfirm --needed \
|
||||||
|
ufw \
|
||||||
|
fail2ban \
|
||||||
|
curl \
|
||||||
|
tmux \
|
||||||
|
git \
|
||||||
|
docker \
|
||||||
|
docker-compose
|
||||||
|
|
||||||
|
# Docker must be running before ONCE installs (the ONCE installer does not
|
||||||
|
# install Docker on Arch — only on apt-based distros)
|
||||||
|
systemctl enable --now docker.service
|
||||||
|
|
||||||
|
log "System updated, packages installed, Docker running"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 2. TIMEZONE & LOCALE
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "2/8 · Timezone & locale"
|
||||||
|
|
||||||
|
timedatectl set-timezone "$TIMEZONE"
|
||||||
|
log "Timezone set to $TIMEZONE"
|
||||||
|
|
||||||
|
# Generate and set locale (minimal Arch cloud images often ship C.UTF-8 only)
|
||||||
|
if ! locale -a 2>/dev/null | grep -qi "^${LOCALE/UTF-8/utf8}$"; then
|
||||||
|
sed -i "s/^#${LOCALE}/${LOCALE}/" /etc/locale.gen
|
||||||
|
locale-gen
|
||||||
|
fi
|
||||||
|
echo "LANG=$LOCALE" > /etc/locale.conf
|
||||||
|
log "Locale set to $LOCALE"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 3. CREATE DEPLOY USER
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "3/8 · Deploy user"
|
||||||
|
|
||||||
|
if id "$DEPLOY_USER" &>/dev/null; then
|
||||||
|
warn "User '$DEPLOY_USER' already exists — skipping creation"
|
||||||
|
else
|
||||||
|
useradd -m -s /bin/bash "$DEPLOY_USER"
|
||||||
|
usermod -aG wheel "$DEPLOY_USER"
|
||||||
|
log "User '$DEPLOY_USER' created and added to wheel group"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Allow sudo without password for deploy user
|
||||||
|
echo "$DEPLOY_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/$DEPLOY_USER
|
||||||
|
chmod 440 /etc/sudoers.d/$DEPLOY_USER
|
||||||
|
log "Passwordless sudo enabled for $DEPLOY_USER"
|
||||||
|
|
||||||
|
# Copy root's authorized_keys to deploy user if they exist
|
||||||
|
if [ -f /root/.ssh/authorized_keys ]; then
|
||||||
|
mkdir -p /home/$DEPLOY_USER/.ssh
|
||||||
|
cp /root/.ssh/authorized_keys /home/$DEPLOY_USER/.ssh/authorized_keys
|
||||||
|
chown -R $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/.ssh
|
||||||
|
chmod 700 /home/$DEPLOY_USER/.ssh
|
||||||
|
chmod 600 /home/$DEPLOY_USER/.ssh/authorized_keys
|
||||||
|
log "SSH keys copied from root to $DEPLOY_USER"
|
||||||
|
else
|
||||||
|
warn "No SSH keys found for root — you'll need to add keys manually:"
|
||||||
|
warn " ssh-copy-id $DEPLOY_USER@YOUR_SERVER_IP"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 4. HARDEN SSH
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "4/8 · SSH hardening"
|
||||||
|
|
||||||
|
# Backup original config
|
||||||
|
cp /etc/ssh/sshd_config "/etc/ssh/sshd_config.backup.$(date +%Y%m%d)"
|
||||||
|
|
||||||
|
# Neutralise conflicting directives in the main config so our drop-in wins
|
||||||
|
sed -i 's/^\s*PermitRootLogin\b/#&/' /etc/ssh/sshd_config
|
||||||
|
sed -i 's/^\s*PasswordAuthentication\b/#&/' /etc/ssh/sshd_config
|
||||||
|
sed -i 's/^\s*PubkeyAuthentication\b/#&/' /etc/ssh/sshd_config
|
||||||
|
sed -i 's/^\s*X11Forwarding\b/#&/' /etc/ssh/sshd_config
|
||||||
|
sed -i 's/^\s*PermitEmptyPasswords\b/#&/' /etc/ssh/sshd_config
|
||||||
|
log "Commented out conflicting directives in sshd_config"
|
||||||
|
|
||||||
|
# Remove cloud-init SSH overrides that can conflict (some VPS images use them)
|
||||||
|
rm -f /etc/ssh/sshd_config.d/50-cloud-init.conf
|
||||||
|
|
||||||
|
# Ensure the drop-in directory is included (Arch's stock sshd_config has this,
|
||||||
|
# but some provider images strip it)
|
||||||
|
mkdir -p /etc/ssh/sshd_config.d
|
||||||
|
if ! grep -q '^Include /etc/ssh/sshd_config.d/\*\.conf' /etc/ssh/sshd_config; then
|
||||||
|
sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' /etc/ssh/sshd_config
|
||||||
|
warn "Added missing Include for sshd_config.d drop-ins"
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat > /etc/ssh/sshd_config.d/hardened.conf << EOF
|
||||||
|
# Custom SSH hardening
|
||||||
|
PermitRootLogin no
|
||||||
|
PasswordAuthentication no
|
||||||
|
PubkeyAuthentication yes
|
||||||
|
MaxAuthTries 3
|
||||||
|
MaxSessions 5
|
||||||
|
AllowUsers $DEPLOY_USER
|
||||||
|
ClientAliveInterval 300
|
||||||
|
ClientAliveCountMax 2
|
||||||
|
X11Forwarding no
|
||||||
|
PermitEmptyPasswords no
|
||||||
|
EOF
|
||||||
|
|
||||||
|
log "SSH hardened — root disabled, key-only auth"
|
||||||
|
|
||||||
|
# Test config before restarting (service is 'sshd' on Arch, not 'ssh')
|
||||||
|
if sshd -t; then
|
||||||
|
systemctl restart sshd
|
||||||
|
log "SSH restarted successfully"
|
||||||
|
else
|
||||||
|
err "SSH config test failed — reverting"
|
||||||
|
rm /etc/ssh/sshd_config.d/hardened.conf
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 5. FIREWALL (UFW)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "5/8 · Firewall (UFW)"
|
||||||
|
|
||||||
|
ufw default deny incoming
|
||||||
|
ufw default allow outgoing
|
||||||
|
ufw allow 22/tcp comment 'SSH'
|
||||||
|
ufw allow 80/tcp comment 'HTTP'
|
||||||
|
ufw allow 443/tcp comment 'HTTPS'
|
||||||
|
|
||||||
|
# Enable without prompt, and make it survive reboots
|
||||||
|
echo "y" | ufw enable
|
||||||
|
systemctl enable ufw
|
||||||
|
|
||||||
|
log "UFW enabled — ports 22, 80, 443 open"
|
||||||
|
ufw status verbose
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 6. FAIL2BAN
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "6/8 · Fail2ban"
|
||||||
|
|
||||||
|
# Arch logs auth to the systemd journal — there is no /var/log/auth.log,
|
||||||
|
# so use the systemd backend instead of a logpath
|
||||||
|
cat > /etc/fail2ban/jail.local << EOF
|
||||||
|
[DEFAULT]
|
||||||
|
bantime = 3600
|
||||||
|
findtime = 600
|
||||||
|
maxretry = 3
|
||||||
|
banaction = ufw
|
||||||
|
backend = systemd
|
||||||
|
|
||||||
|
[sshd]
|
||||||
|
enabled = true
|
||||||
|
port = 22
|
||||||
|
filter = sshd
|
||||||
|
maxretry = 3
|
||||||
|
bantime = 3600
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl enable fail2ban
|
||||||
|
systemctl restart fail2ban
|
||||||
|
log "Fail2ban configured and running (systemd journal backend)"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 7. AUTOMATIC UPDATES (weekly pacman -Syu timer)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "7/8 · Automatic updates"
|
||||||
|
|
||||||
|
# Arch has no unattended-upgrades equivalent — use a weekly full update timer.
|
||||||
|
# NOTE: rolling release means an update can very occasionally need manual
|
||||||
|
# intervention (check https://archlinux.org/news/ if something breaks).
|
||||||
|
cat > /etc/systemd/system/pacman-update.service << EOF
|
||||||
|
[Unit]
|
||||||
|
Description=Weekly pacman system update
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/usr/bin/pacman -Syu --noconfirm
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > /etc/systemd/system/pacman-update.timer << EOF
|
||||||
|
[Unit]
|
||||||
|
Description=Weekly pacman system update
|
||||||
|
|
||||||
|
[Timer]
|
||||||
|
OnCalendar=weekly
|
||||||
|
RandomizedDelaySec=1h
|
||||||
|
Persistent=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=timers.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable --now pacman-update.timer
|
||||||
|
log "Weekly auto-update timer enabled (pacman-update.timer)"
|
||||||
|
warn "Rolling release: check 'journalctl -u pacman-update' if anything misbehaves after an update"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# 8. ONCE (Docker already installed via pacman in step 1)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "8/8 · ONCE"
|
||||||
|
|
||||||
|
log "Installing ONCE..."
|
||||||
|
su - $DEPLOY_USER -c 'curl https://get.once.com | ONCE_INTERACTIVE=false sh' || {
|
||||||
|
warn "ONCE auto-install had issues — you can install manually:"
|
||||||
|
warn " ssh $SSH_ALIAS"
|
||||||
|
warn " curl https://get.once.com | sh"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Ensure deploy user is in docker group
|
||||||
|
if getent group docker &>/dev/null; then
|
||||||
|
usermod -aG docker $DEPLOY_USER
|
||||||
|
log "$DEPLOY_USER added to docker group"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# SWAP (2GB)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Swap file"
|
||||||
|
|
||||||
|
if [ ! -f /swapfile ]; then
|
||||||
|
fallocate -l 2G /swapfile
|
||||||
|
chmod 600 /swapfile
|
||||||
|
mkswap /swapfile
|
||||||
|
swapon /swapfile
|
||||||
|
grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab
|
||||||
|
log "2GB swap created and enabled"
|
||||||
|
else
|
||||||
|
warn "Swap file already exists — skipping"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# DISABLE UNNECESSARY SERVICES
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Disable unnecessary services"
|
||||||
|
|
||||||
|
for svc in ModemManager udisks2 multipathd; do
|
||||||
|
if systemctl is-enabled "$svc" &>/dev/null; then
|
||||||
|
systemctl stop "$svc"
|
||||||
|
systemctl disable "$svc"
|
||||||
|
log "Disabled $svc"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# CAP JOURNAL LOGS (50MB)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Cap journal logs"
|
||||||
|
|
||||||
|
mkdir -p /etc/systemd/journald.conf.d
|
||||||
|
cat > /etc/systemd/journald.conf.d/size.conf << EOF
|
||||||
|
[Journal]
|
||||||
|
SystemMaxUse=50M
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl restart systemd-journald
|
||||||
|
log "Journal capped at 50MB"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# CLEAN PACMAN CACHE (keep last 2 versions of each package)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Pacman cache hygiene"
|
||||||
|
|
||||||
|
pacman -S --noconfirm --needed pacman-contrib
|
||||||
|
systemctl enable --now paccache.timer
|
||||||
|
log "paccache.timer enabled — old package versions pruned weekly"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# GIT CONFIGURATION
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Git configuration"
|
||||||
|
|
||||||
|
su - $DEPLOY_USER << GITEOF
|
||||||
|
git config --global user.name "$GIT_NAME"
|
||||||
|
git config --global user.email "$GIT_EMAIL"
|
||||||
|
git config --global credential.helper store
|
||||||
|
git config --global init.defaultBranch main
|
||||||
|
GITEOF
|
||||||
|
|
||||||
|
log "Git configured for $DEPLOY_USER"
|
||||||
|
|
||||||
|
# Store PAT if provided (correct format: https://USERNAME:TOKEN@github.com)
|
||||||
|
if [ -n "$GITHUB_PAT" ] && [ -n "$GITHUB_USER" ]; then
|
||||||
|
su - $DEPLOY_USER -c "echo 'https://$GITHUB_USER:$GITHUB_PAT@github.com' > /home/$DEPLOY_USER/.git-credentials"
|
||||||
|
chmod 600 /home/$DEPLOY_USER/.git-credentials
|
||||||
|
chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/.git-credentials
|
||||||
|
log "GitHub PAT stored for git (https://$GITHUB_USER:***@github.com)"
|
||||||
|
|
||||||
|
# Log Docker into GHCR so Once can pull container images
|
||||||
|
log "Logging Docker into ghcr.io..."
|
||||||
|
if echo "$GITHUB_PAT" | su - $DEPLOY_USER -c "docker login ghcr.io -u $GITHUB_USER --password-stdin"; then
|
||||||
|
log "Docker logged into ghcr.io as $GITHUB_USER"
|
||||||
|
else
|
||||||
|
warn "Docker GHCR login failed — you can run manually: docker login ghcr.io -u $GITHUB_USER"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Clone repos if specified
|
||||||
|
if [ -n "$REPOS_TO_CLONE" ]; then
|
||||||
|
IFS=',' read -ra REPO_PAIRS <<< "$REPOS_TO_CLONE"
|
||||||
|
for pair in "${REPO_PAIRS[@]}"; do
|
||||||
|
IFS=':' read -r repo dir <<< "$pair"
|
||||||
|
if [ ! -d "$dir" ]; then
|
||||||
|
mkdir -p "$(dirname "$dir")"
|
||||||
|
su - $DEPLOY_USER -c "git clone https://github.com/$repo.git $dir"
|
||||||
|
chown -R $DEPLOY_USER:$DEPLOY_USER "$dir"
|
||||||
|
log "Cloned $repo → $dir"
|
||||||
|
else
|
||||||
|
warn "$dir already exists — skipping clone"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# CREATE DIRECTORIES
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Directory structure"
|
||||||
|
|
||||||
|
mkdir -p /opt/apps
|
||||||
|
chown -R $DEPLOY_USER:$DEPLOY_USER /opt/apps
|
||||||
|
log "Created /opt/apps for custom Docker apps"
|
||||||
|
|
||||||
|
mkdir -p /var/www
|
||||||
|
chown -R $DEPLOY_USER:$DEPLOY_USER /var/www
|
||||||
|
log "Created /var/www for static sites"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# DEPLOY HELPER SCRIPT
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "Deploy helper script"
|
||||||
|
|
||||||
|
cat > /home/$DEPLOY_USER/deploy.sh << 'DEPLOYSCRIPT'
|
||||||
|
#!/bin/bash
|
||||||
|
# Usage: ./deploy.sh <app-directory> [branch]
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
APP_DIR="${1:?Usage: ./deploy.sh <app-directory> [branch]}"
|
||||||
|
BRANCH="${2:-main}"
|
||||||
|
|
||||||
|
if [ ! -d "$APP_DIR" ]; then
|
||||||
|
echo "Error: $APP_DIR does not exist"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd "$APP_DIR"
|
||||||
|
echo "📦 Deploying $(basename $APP_DIR) from branch $BRANCH..."
|
||||||
|
|
||||||
|
echo "⬇️ Pulling latest..."
|
||||||
|
git fetch origin
|
||||||
|
git checkout "$BRANCH"
|
||||||
|
git pull origin "$BRANCH"
|
||||||
|
|
||||||
|
if [ -f "docker-compose.yml" ] || [ -f "compose.yml" ]; then
|
||||||
|
echo "🐳 Docker Compose detected — rebuilding..."
|
||||||
|
docker compose down
|
||||||
|
docker compose up -d --build
|
||||||
|
echo "✅ Containers running:"
|
||||||
|
docker compose ps
|
||||||
|
elif [ -f "Dockerfile" ]; then
|
||||||
|
APP_NAME=$(basename "$APP_DIR")
|
||||||
|
echo "🐳 Dockerfile detected — rebuilding $APP_NAME..."
|
||||||
|
docker build -t "$APP_NAME" .
|
||||||
|
docker stop "$APP_NAME" 2>/dev/null || true
|
||||||
|
docker rm "$APP_NAME" 2>/dev/null || true
|
||||||
|
docker run -d --name "$APP_NAME" --restart unless-stopped "$APP_NAME"
|
||||||
|
echo "✅ Container running"
|
||||||
|
else
|
||||||
|
echo "📁 Static site — no build step needed"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "🎉 Deployed at $(date)"
|
||||||
|
DEPLOYSCRIPT
|
||||||
|
|
||||||
|
chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/deploy.sh
|
||||||
|
chmod +x /home/$DEPLOY_USER/deploy.sh
|
||||||
|
log "Deploy helper created at ~/deploy.sh"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# GENERATE LOCAL SSH CONFIG FILE
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
step "SSH config for your local machine"
|
||||||
|
|
||||||
|
SERVER_IP=$(curl -4 -s --max-time 5 ifconfig.me 2>/dev/null || \
|
||||||
|
curl -4 -s --max-time 5 icanhazip.com 2>/dev/null || \
|
||||||
|
echo "YOUR_SERVER_IP")
|
||||||
|
|
||||||
|
cat > /home/$DEPLOY_USER/ssh-config-snippet.txt << SSHEOF
|
||||||
|
Host $SSH_ALIAS
|
||||||
|
HostName $SERVER_IP
|
||||||
|
User $DEPLOY_USER
|
||||||
|
IdentityFile ~/.ssh/id_ed25519
|
||||||
|
SSHEOF
|
||||||
|
|
||||||
|
chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/ssh-config-snippet.txt
|
||||||
|
log "SSH config snippet saved to ~/ssh-config-snippet.txt"
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# SUMMARY
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}"
|
||||||
|
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||||
|
echo "║ SETUP COMPLETE ║"
|
||||||
|
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||||
|
echo -e "${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${GREEN}SSH${NC}"
|
||||||
|
echo " ├─ User: $DEPLOY_USER"
|
||||||
|
echo " ├─ Root login: disabled"
|
||||||
|
echo " └─ Auth: key-only"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${GREEN}Firewall${NC}"
|
||||||
|
echo " ├─ 22/tcp SSH"
|
||||||
|
echo " ├─ 80/tcp HTTP"
|
||||||
|
echo " └─ 443/tcp HTTPS"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${GREEN}Services${NC}"
|
||||||
|
echo " ├─ Docker: $(docker --version 2>/dev/null || echo 'installed')"
|
||||||
|
echo " ├─ ONCE: run 'once' as $DEPLOY_USER to manage apps"
|
||||||
|
echo " ├─ Fail2ban: active (systemd backend)"
|
||||||
|
echo " └─ Auto-updates: weekly pacman-update.timer"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${GREEN}Paths${NC}"
|
||||||
|
echo " ├─ Custom apps: /opt/apps/"
|
||||||
|
echo " ├─ Static sites: /var/www/"
|
||||||
|
echo " ├─ Deploy script: ~/deploy.sh <app-dir> [branch]"
|
||||||
|
echo " └─ SSH config: ~/ssh-config-snippet.txt"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}NEXT STEPS${NC}"
|
||||||
|
echo ""
|
||||||
|
echo " 1. On your local machine, run this to add the SSH config:"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}────── COPY BELOW THIS LINE ──────${NC}"
|
||||||
|
echo ""
|
||||||
|
echo "cat >> ~/.ssh/config << 'EOF'"
|
||||||
|
echo ""
|
||||||
|
echo "Host $SSH_ALIAS"
|
||||||
|
echo " HostName $SERVER_IP"
|
||||||
|
echo " User $DEPLOY_USER"
|
||||||
|
echo " IdentityFile ~/.ssh/id_ed25519"
|
||||||
|
echo "EOF"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}────── COPY ABOVE THIS LINE ──────${NC}"
|
||||||
|
echo ""
|
||||||
|
echo " 2. Test SSH: ssh $SSH_ALIAS"
|
||||||
|
echo " 3. Run ONCE: ssh $SSH_ALIAS 'once'"
|
||||||
|
echo " 4. Deploy: ssh $SSH_ALIAS '~/deploy.sh /opt/apps/myapp'"
|
||||||
|
echo ""
|
||||||
|
echo " Once step 1 is done, Claude Code can control this server."
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}A reboot is recommended to apply kernel updates:${NC}"
|
||||||
|
echo -e " ${CYAN} reboot${NC}"
|
||||||
|
echo ""
|
||||||
Loading…
Add table
Reference in a new issue