125 lines
3.6 KiB
Bash
125 lines
3.6 KiB
Bash
#!/bin/bash
|
|
# Phase 1: Base system setup for new James server
|
|
# Run as: ssh johan@192.168.3.134 'bash -s' < scripts/new-server-phase1.sh
|
|
set -e
|
|
|
|
SUDO="echo Helder06 | sudo -S"
|
|
|
|
echo "=== Phase 1: Base System Setup ==="
|
|
|
|
# 1. Essentials
|
|
echo ">>> Installing essentials..."
|
|
$SUDO apt-get install -y -q \
|
|
curl wget git jq htop tmux build-essential \
|
|
pass gnupg2 \
|
|
sshpass rsync \
|
|
unzip zip \
|
|
python3-pip python3-venv \
|
|
net-tools dnsutils \
|
|
ufw fail2ban \
|
|
samba \
|
|
ffmpeg \
|
|
trash-cli \
|
|
apt-transport-https \
|
|
ca-certificates \
|
|
software-properties-common 2>&1 | tail -3
|
|
|
|
# 2. Minimal Xfce GUI (for headed Chrome)
|
|
echo ">>> Installing minimal Xfce + LightDM..."
|
|
$SUDO apt-get install -y -q \
|
|
xorg \
|
|
xfce4 \
|
|
xfce4-terminal \
|
|
lightdm \
|
|
lightdm-gtk-greeter \
|
|
dbus-x11 2>&1 | tail -3
|
|
|
|
# Set LightDM as default display manager
|
|
echo "/usr/sbin/lightdm" | $SUDO tee /etc/X11/default-display-manager > /dev/null
|
|
|
|
# Configure autologin
|
|
$SUDO mkdir -p /etc/lightdm/lightdm.conf.d
|
|
cat << 'AUTOLOGIN' | $SUDO tee /etc/lightdm/lightdm.conf.d/50-autologin.conf > /dev/null
|
|
[Seat:*]
|
|
autologin-user=johan
|
|
autologin-user-timeout=0
|
|
user-session=xfce
|
|
AUTOLOGIN
|
|
|
|
echo ">>> Disabling screensaver/power management..."
|
|
# Will be configured in Xfce session; install xfce4-power-manager
|
|
$SUDO apt-get install -y -q xfce4-power-manager 2>&1 | tail -1
|
|
|
|
# 3. NVIDIA Driver + CUDA (GTX 970 for inference)
|
|
echo ">>> Installing NVIDIA driver..."
|
|
$SUDO apt-get install -y -q nvidia-driver-535 nvidia-cuda-toolkit 2>&1 | tail -5
|
|
|
|
# 4. Configure Xorg to use Intel for display, leave NVIDIA for compute
|
|
echo ">>> Configuring Xorg for Intel display..."
|
|
cat << 'XORGCONF' | $SUDO tee /etc/X11/xorg.conf > /dev/null
|
|
# Intel iGPU for display output, NVIDIA GTX 970 for compute only
|
|
Section "Device"
|
|
Identifier "Intel"
|
|
Driver "modesetting"
|
|
BusID "PCI:0:2:0"
|
|
EndSection
|
|
|
|
Section "Screen"
|
|
Identifier "Screen0"
|
|
Device "Intel"
|
|
EndSection
|
|
|
|
Section "ServerLayout"
|
|
Identifier "Layout0"
|
|
Screen "Screen0"
|
|
EndSection
|
|
XORGCONF
|
|
|
|
# 5. Hardening
|
|
echo ">>> Hardening SSH..."
|
|
$SUDO sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
$SUDO sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
$SUDO sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
|
$SUDO systemctl restart sshd
|
|
|
|
echo ">>> Configuring UFW firewall..."
|
|
$SUDO ufw default deny incoming
|
|
$SUDO ufw default allow outgoing
|
|
$SUDO ufw allow ssh
|
|
$SUDO ufw allow from 192.168.0.0/16 to any # LAN access for all services
|
|
$SUDO ufw --force enable
|
|
|
|
echo ">>> Configuring fail2ban..."
|
|
cat << 'F2B' | $SUDO tee /etc/fail2ban/jail.local > /dev/null
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
F2B
|
|
$SUDO systemctl enable fail2ban
|
|
$SUDO systemctl start fail2ban
|
|
|
|
echo ">>> Enabling unattended security updates..."
|
|
$SUDO apt-get install -y -q unattended-upgrades
|
|
$SUDO dpkg-reconfigure -plow unattended-upgrades 2>/dev/null || true
|
|
|
|
# 6. Enable lingering for user services
|
|
echo ">>> Enabling systemd linger for johan..."
|
|
$SUDO loginctl enable-linger johan
|
|
|
|
# 7. Node.js 22
|
|
echo ">>> Installing Node.js 22..."
|
|
curl -fsSL https://deb.nodesource.com/setup_22.x | $SUDO bash - 2>&1 | tail -3
|
|
$SUDO apt-get install -y -q nodejs 2>&1 | tail -3
|
|
|
|
# 8. NPM global directory (no sudo needed)
|
|
mkdir -p ~/.npm-global
|
|
npm config set prefix ~/.npm-global
|
|
grep -q 'npm-global' ~/.bashrc || echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
|
|
|
|
echo "=== Phase 1 Complete ==="
|
|
echo "Reboot recommended for NVIDIA driver + GUI"
|