28allday 036e1f4010 Refocus as pure hardening base: drop docker + omaterm prep, add README/LICENSE

- arch-setup.sh now takes a fresh Arch box to a locked-down base, nothing else
  (omaterm one-shot now lives in the sibling omaserver project)
- Port proven UX from omaserver's install-server.sh: machine name asked once
  (hostname + ssh alias), answers persist across the kernel-upgrade reboot
  via /root/.arch-setup.conf, reboot offered in-script, public IP detected
  early, ufw tailscale0 pre-allow (dormant), default-yes prompts
- MIT license, README with usage + Arch-specific notes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-06 16:35:10 +01:00

2.4 KiB

Raw Permalink Blame History

arch-boot-strap

Setup & hardening script for a fresh Arch Linux VPS. Takes a bare box to a clean, locked-down base — nothing else. No app stack, no opinions beyond security and maintenance basics.

Usage

Run as root on a fresh Arch VPS:

ssh -t root@YOUR_SERVER 'bash <(curl -fsSL https://raw.githubusercontent.com/28allday/arch-boot-strap/main/arch-setup.sh)'

or scp it over and ssh -t root@YOUR_SERVER bash arch-setup.sh.

Two questions up front — machine name (becomes the hostname and your local ssh <name> alias) and a deploy username. Answers survive a mid-run reboot: if the first pacman -Syu upgrades the kernel, the script offers to reboot, and the re-run picks up where it left off without re-asking.

What it does

Deploy user — wheel group, passwordless sudo, root's authorized_keys copied over
SSH hardening — root login disabled, password auth disabled, key-only, AllowUsers <deploy-user>, config validated with sshd -t before restart (auto-reverts on failure)
Firewall — UFW deny incoming, allow 22/tcp; tailscale0 pre-allowed (dormant unless you install Tailscale later)
fail2ban — sshd jail, 3 strikes → 1h ban, systemd journal backend (Arch has no auth.log)
Auto-updates — weekly pacman -Syu timer (Arch has no unattended-upgrades)
Housekeeping — 2GB swap (btrfs-aware, skipped if the image ships its own), journald capped at 50MB, weekly package-cache pruning, ModemManager/udisks2/multipathd disabled
Hostname, timezone, locale set; prints a ready-to-paste ~/.ssh/config snippet when done

Arch-specific details baked in

Kernel-upgrade guard: if -Syu replaces the running kernel's modules, the script stops and offers a reboot instead of letting module loads fail mysteriously
fail2ban backend = systemd, service name sshd (not ssh), wheel (not sudo)
Some provider images strip the sshd_config.d Include or ship cloud-init SSH overrides — both handled
kitty-terminfo installed so SSHing in from kitty doesn't break interactive tools
btrfs swapfiles need btrfs filesystem mkswapfile, not fallocate

Notes

Safe to re-run; completed steps skip themselves. After the first run root SSH login is disabled — re-run as the deploy user with sudo.
Want hardening + OMATERM in one shot? That's the sibling project: omaserver.

License

MIT

2.4 KiB Raw Permalink Blame History