# arch-boot-strap

Setup & hardening script for a fresh Arch Linux VPS. Takes a bare box to a clean, locked-down base — **nothing else**. No app stack, no opinions beyond security and maintenance basics.

## Usage

Run as root on a fresh Arch VPS:

```bash
ssh -t root@YOUR_SERVER 'bash <(curl -fsSL https://raw.githubusercontent.com/28allday/arch-boot-strap/main/arch-setup.sh)'
```

or scp it over and `ssh -t root@YOUR_SERVER bash arch-setup.sh`.

Two questions up front — machine name (becomes the hostname and your local `ssh <name>` alias) and a deploy username. Answers survive a mid-run reboot: if the first `pacman -Syu` upgrades the kernel, the script offers to reboot, and the re-run picks up where it left off without re-asking.

## What it does

- **Deploy user** — wheel group, passwordless sudo, root's `authorized_keys` copied over
- **SSH hardening** — root login disabled, password auth disabled, key-only, `AllowUsers <deploy-user>`, config validated with `sshd -t` before restart (auto-reverts on failure)
- **Firewall** — UFW deny incoming, allow 22/tcp; `tailscale0` pre-allowed (dormant unless you install Tailscale later)
- **fail2ban** — sshd jail, 3 strikes → 1h ban, systemd journal backend (Arch has no auth.log)
- **Auto-updates** — weekly `pacman -Syu` timer (Arch has no unattended-upgrades)
- **Housekeeping** — 2GB swap (btrfs-aware, skipped if the image ships its own), journald capped at 50MB, weekly package-cache pruning, ModemManager/udisks2/multipathd disabled
- **Hostname, timezone, locale** set; prints a ready-to-paste `~/.ssh/config` snippet when done

## Arch-specific details baked in

- Kernel-upgrade guard: if `-Syu` replaces the running kernel's modules, the script stops and offers a reboot instead of letting module loads fail mysteriously
- fail2ban `backend = systemd`, service name `sshd` (not `ssh`), `wheel` (not `sudo`)
- Some provider images strip the `sshd_config.d` Include or ship cloud-init SSH overrides — both handled
- `kitty-terminfo` installed so SSHing in from kitty doesn't break interactive tools
- btrfs swapfiles need `btrfs filesystem mkswapfile`, not fallocate

## Notes

- Safe to re-run; completed steps skip themselves. After the first run root SSH login is disabled — re-run as the deploy user with `sudo`.
- Want hardening **+ OMATERM** in one shot? That's the sibling project: [omaserver](https://github.com/28allday/omaserver).

## License

MIT