28allday
036e1f4010
- arch-setup.sh now takes a fresh Arch box to a locked-down base, nothing else (omaterm one-shot now lives in the sibling omaserver project) - Port proven UX from omaserver's install-server.sh: machine name asked once (hostname + ssh alias), answers persist across the kernel-upgrade reboot via /root/.arch-setup.conf, reboot offered in-script, public IP detected early, ufw tailscale0 pre-allow (dormant), default-yes prompts - MIT license, README with usage + Arch-specific notes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
2.4 KiB
Markdown
42 lines
2.4 KiB
Markdown
# arch-boot-strap
|
|
|
|
Setup & hardening script for a fresh Arch Linux VPS. Takes a bare box to a clean, locked-down base — **nothing else**. No app stack, no opinions beyond security and maintenance basics.
|
|
|
|
## Usage
|
|
|
|
Run as root on a fresh Arch VPS:
|
|
|
|
```bash
|
|
ssh -t root@YOUR_SERVER 'bash <(curl -fsSL https://raw.githubusercontent.com/28allday/arch-boot-strap/main/arch-setup.sh)'
|
|
```
|
|
|
|
or scp it over and `ssh -t root@YOUR_SERVER bash arch-setup.sh`.
|
|
|
|
Two questions up front — machine name (becomes the hostname and your local `ssh <name>` alias) and a deploy username. Answers survive a mid-run reboot: if the first `pacman -Syu` upgrades the kernel, the script offers to reboot, and the re-run picks up where it left off without re-asking.
|
|
|
|
## What it does
|
|
|
|
- **Deploy user** — wheel group, passwordless sudo, root's `authorized_keys` copied over
|
|
- **SSH hardening** — root login disabled, password auth disabled, key-only, `AllowUsers <deploy-user>`, config validated with `sshd -t` before restart (auto-reverts on failure)
|
|
- **Firewall** — UFW deny incoming, allow 22/tcp; `tailscale0` pre-allowed (dormant unless you install Tailscale later)
|
|
- **fail2ban** — sshd jail, 3 strikes → 1h ban, systemd journal backend (Arch has no auth.log)
|
|
- **Auto-updates** — weekly `pacman -Syu` timer (Arch has no unattended-upgrades)
|
|
- **Housekeeping** — 2GB swap (btrfs-aware, skipped if the image ships its own), journald capped at 50MB, weekly package-cache pruning, ModemManager/udisks2/multipathd disabled
|
|
- **Hostname, timezone, locale** set; prints a ready-to-paste `~/.ssh/config` snippet when done
|
|
|
|
## Arch-specific details baked in
|
|
|
|
- Kernel-upgrade guard: if `-Syu` replaces the running kernel's modules, the script stops and offers a reboot instead of letting module loads fail mysteriously
|
|
- fail2ban `backend = systemd`, service name `sshd` (not `ssh`), `wheel` (not `sudo`)
|
|
- Some provider images strip the `sshd_config.d` Include or ship cloud-init SSH overrides — both handled
|
|
- `kitty-terminfo` installed so SSHing in from kitty doesn't break interactive tools
|
|
- btrfs swapfiles need `btrfs filesystem mkswapfile`, not fallocate
|
|
|
|
## Notes
|
|
|
|
- Safe to re-run; completed steps skip themselves. After the first run root SSH login is disabled — re-run as the deploy user with `sudo`.
|
|
- Want hardening **+ OMATERM** in one shot? That's the sibling project: [omaserver](https://github.com/28allday/omaserver).
|
|
|
|
## License
|
|
|
|
MIT
|