nosignal/arch-boot-strap
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
Setup & hardening script for a fresh Arch Linux VPS — clean locked-down base, nothing else
9 commits 1 branch 0 tags 78 KiB
Find a file
Exact
28allday 036e1f4010 Refocus as pure hardening base: drop docker + omaterm prep, add README/LICENSE 
- arch-setup.sh now takes a fresh Arch box to a locked-down base, nothing else
  (omaterm one-shot now lives in the sibling omaserver project)
- Port proven UX from omaserver's install-server.sh: machine name asked once
  (hostname + ssh alias), answers persist across the kernel-upgrade reboot
  via /root/.arch-setup.conf, reboot offered in-script, public IP detected
  early, ufw tailscale0 pre-allow (dormant), default-yes prompts
- MIT license, README with usage + Arch-specific notes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-06 16:35:10 +01:00
arch-setup.sh Refocus as pure hardening base: drop docker + omaterm prep, add README/LICENSE 2026-06-06 16:35:10 +01:00
LICENSE Refocus as pure hardening base: drop docker + omaterm prep, add README/LICENSE 2026-06-06 16:35:10 +01:00
README.md Refocus as pure hardening base: drop docker + omaterm prep, add README/LICENSE 2026-06-06 16:35:10 +01:00

README.md

arch-boot-strap

Setup & hardening script for a fresh Arch Linux VPS. Takes a bare box to a clean, locked-down base — nothing else. No app stack, no opinions beyond security and maintenance basics.

Usage

Run as root on a fresh Arch VPS:

ssh -t root@YOUR_SERVER 'bash <(curl -fsSL https://raw.githubusercontent.com/28allday/arch-boot-strap/main/arch-setup.sh)'

or scp it over and ssh -t root@YOUR_SERVER bash arch-setup.sh.

Two questions up front — machine name (becomes the hostname and your local ssh <name> alias) and a deploy username. Answers survive a mid-run reboot: if the first pacman -Syu upgrades the kernel, the script offers to reboot, and the re-run picks up where it left off without re-asking.

What it does

  • Deploy user — wheel group, passwordless sudo, root's authorized_keys copied over
  • SSH hardening — root login disabled, password auth disabled, key-only, AllowUsers <deploy-user>, config validated with sshd -t before restart (auto-reverts on failure)
  • Firewall — UFW deny incoming, allow 22/tcp; tailscale0 pre-allowed (dormant unless you install Tailscale later)
  • fail2ban — sshd jail, 3 strikes → 1h ban, systemd journal backend (Arch has no auth.log)
  • Auto-updates — weekly pacman -Syu timer (Arch has no unattended-upgrades)
  • Housekeeping — 2GB swap (btrfs-aware, skipped if the image ships its own), journald capped at 50MB, weekly package-cache pruning, ModemManager/udisks2/multipathd disabled
  • Hostname, timezone, locale set; prints a ready-to-paste ~/.ssh/config snippet when done

Arch-specific details baked in

  • Kernel-upgrade guard: if -Syu replaces the running kernel's modules, the script stops and offers a reboot instead of letting module loads fail mysteriously
  • fail2ban backend = systemd, service name sshd (not ssh), wheel (not sudo)
  • Some provider images strip the sshd_config.d Include or ship cloud-init SSH overrides — both handled
  • kitty-terminfo installed so SSHing in from kitty doesn't break interactive tools
  • btrfs swapfiles need btrfs filesystem mkswapfile, not fallocate

Notes

  • Safe to re-run; completed steps skip themselves. After the first run root SSH login is disabled — re-run as the deploy user with sudo.
  • Want hardening + OMATERM in one shot? That's the sibling project: omaserver.

License

MIT