158 lines
8.3 KiB
Markdown
158 lines
8.3 KiB
Markdown
# Lightweight Ubuntu Server Setup
|
||
|
||
**English** | [Русский](docs/readme/README.ru.md) | [Español](docs/readme/README.es.md) | [Deutsch](docs/readme/README.de.md) | [Français](docs/readme/README.fr.md) | [Português](docs/readme/README.pt.md) | [中文](docs/readme/README.zh-CN.md) | [日本語](docs/readme/README.ja.md) | [العربية](docs/readme/README.ar.md) | [हिन्दी](docs/readme/README.hi.md)
|
||
|
||
A modular set of Bash installers for the initial setup, security hardening, administration, VPN, web panel, WARP, and backups on Ubuntu Server. Run the unified wizard for a guided installation or execute only the modules you need.
|
||
|
||
> **Manage multiple servers:** use the companion [Server Monitor Manager](https://github.com/ochenstarik-ui/server-monitor-manager) project to add servers, collect reports, and manage several hosts from one application. It is currently in early development and should not yet be treated as production-ready.
|
||
|
||
## Quick installation
|
||
|
||
Copy the complete block into the server terminal. It downloads the repository archive through `codeload.github.com`, stops on errors, and starts the unified installer:
|
||
|
||
```bash
|
||
set -e
|
||
cd "$HOME"
|
||
sudo apt-get update
|
||
sudo apt-get install -y curl ca-certificates tar
|
||
archive="$(mktemp)"
|
||
trap 'rm -f "$archive"' EXIT
|
||
curl -4 -fL \
|
||
--retry 5 \
|
||
--retry-delay 10 \
|
||
--connect-timeout 30 \
|
||
https://codeload.github.com/ochenstarik-ui/lightweight-server/tar.gz/refs/heads/main \
|
||
-o "$archive"
|
||
install -d -m 700 lightweight-server
|
||
tar -xzf "$archive" -C lightweight-server --strip-components=1
|
||
rm -f "$archive"
|
||
trap - EXIT
|
||
cd lightweight-server
|
||
chmod 700 ./*.sh
|
||
sudo ./ochenstarik-server-install.sh
|
||
```
|
||
|
||
The first wizard prompt selects the dialog language. English is the default; Russian, Spanish, German, French, Portuguese, Simplified Chinese, Japanese, Arabic, and Hindi are also available. The wizard then opens the main menu with steps 1–8 plus the uninstall/reset option. Select any item, run it, and the wizard returns to the main menu.
|
||
|
||
Keep the current SSH session open while changing the SSH port. Test the new login in a second terminal before disconnecting.
|
||
|
||
The wizard intentionally requires all module scripts to be present locally. Use the full archive or `git clone`; a single downloaded wizard file will not fetch missing modules from the mutable `main` branch.
|
||
|
||
## Modules
|
||
|
||
| Script | Purpose | Standalone use |
|
||
| --- | --- | --- |
|
||
| `ochenstarik-server-install.sh` | Unified wizard with language selection and a main menu for all modules | Recommended |
|
||
| `ochenstarik-server-1.sh` | Timezone, terminal locale, program groups, and a 2 GiB swap file | Yes |
|
||
| `ochenstarik-server-2.sh` | Base packages, SSH port, IPv4/IPv6 mode, UFW, and port management | Yes |
|
||
| `ochenstarik-server-user-3.sh` | Administrative user, SSH key permissions, SSH migration, sudo, and fail2ban | Run after step 2 |
|
||
| `ochenstarik-server-tg-4.sh` | Telegram notifications for successful SSH logins | Optional |
|
||
| `ochenstarik-server-vpn-5.sh` | System VPN through Xray; repeated runs can connect, disconnect, reconfigure, or show status | Optional |
|
||
| `ochenstarik-server-panel-warp-6.sh` | 3x-ui panel and local Cloudflare WARP proxy | Optional |
|
||
| `ochenstarik-server-backup-7.sh` | Protected initial snapshot and selected daily, weekly, or monthly schedules | Optional |
|
||
| `ochenstarik-server-ai-agents-8.sh` | Installs selected AI agents: Hermes, OpenClaw, OpenHands, OpenCode, Aider, AutoGPT, or Pi Coding Agent | Optional |
|
||
| `ochenstarik-server-uninstall.sh` | Removes project-managed settings so installation can start again | Available from the wizard; use carefully |
|
||
|
||
Every module can be run independently from the full archive or cloned repository:
|
||
|
||
```bash
|
||
chmod 700 SCRIPT_NAME.sh
|
||
bash -n SCRIPT_NAME.sh
|
||
sudo ./SCRIPT_NAME.sh
|
||
```
|
||
|
||
Replace `SCRIPT_NAME.sh` with the required filename from the table.
|
||
|
||
## Installation flow
|
||
|
||
1. Select the wizard dialog language.
|
||
2. Configure the timezone, terminal locale, recommended tools, and swap.
|
||
3. Select IPv4, IPv6, or dual-stack operation; install base services and select the future SSH port.
|
||
4. Create or update the administrative user, install the public SSH key, repair ownership and permissions, and move SSH to the port selected in step 2.
|
||
5. Optionally configure Telegram SSH-login notifications.
|
||
6. Optionally configure the system VPN and subscription port.
|
||
7. Optionally deploy 3x-ui and Cloudflare WARP with selected panel and subscription ports.
|
||
8. Optionally create the permanent initial backup and configure rotating schedules.
|
||
9. Optionally install one or more AI agents for the administrative user.
|
||
|
||
## VPN connection control
|
||
|
||
After the first successful setup, running `ochenstarik-server-vpn-5.sh` again opens an action menu: connect using saved settings, disconnect while keeping the configuration, replace the subscription, or show status. The same actions are available directly:
|
||
|
||
```bash
|
||
sudo ./ochenstarik-server-vpn-5.sh --enable
|
||
sudo ./ochenstarik-server-vpn-5.sh --disable
|
||
sudo ./ochenstarik-server-vpn-5.sh --reconfigure
|
||
sudo ./ochenstarik-server-vpn-5.sh --status
|
||
```
|
||
|
||
Disconnecting removes the system routing rules but keeps Xray and its configuration so the VPN can be reconnected without entering the subscription again.
|
||
|
||
## Optional AI agents
|
||
|
||
Step 8 offers a multiple selection of seven popular agents: Hermes Agent, OpenClaw, OpenHands, OpenCode, Aider, AutoGPT, and Pi Coding Agent. Installers are downloaded only from each project's official HTTPS endpoint, checked with `bash -n`, and launched as the selected regular user rather than directly as `root`.
|
||
|
||
AutoGPT is a larger Docker-based platform. Its official installer can request `sudo`, install Docker-related dependencies, and start local services. Pi is a lightweight terminal coding agent; after installation, start it with `pi` and use `/login` to connect a supported provider.
|
||
|
||
The script does not request or store model-provider API keys. After installation, log in as the selected user and run the displayed onboarding command. AI agents can execute commands, access files, install plugins, and use network services; review their permissions and sandbox settings before connecting production data or secrets.
|
||
|
||
## Firewall and SSH notes
|
||
|
||
- Step 2 supports IPv4-only, IPv6-only, and dual-stack UFW rules. IPv4-only mode blocks public inbound IPv6 through UFW without disabling the kernel IPv6 stack.
|
||
- A repeated step 2 run can change the IP-family mode or add ports without reinstalling everything.
|
||
- Step 3 reads the SSH port chosen in step 2 and creates an administrator with sudo access.
|
||
- The home directory, `.ssh`, and `authorized_keys` ownership and permissions are checked on every run.
|
||
- Do not remove temporary port 22 access until a new SSH session succeeds on the selected port.
|
||
|
||
## Backups
|
||
|
||
Step 7 can create:
|
||
|
||
- one initial snapshot that is never rotated automatically;
|
||
- daily backups retained for 7 days;
|
||
- weekly backups retained for 4 weeks;
|
||
- monthly backups retained for 12 months.
|
||
|
||
Schedules are selected independently, so any combination can be enabled. Keep an additional copy on another server or storage device; a local backup does not protect against loss of the entire host.
|
||
|
||
## Multi-server monitoring and management
|
||
|
||
[Server Monitor Manager](https://github.com/ochenstarik-ui/server-monitor-manager) is the companion project for centralized server operations. Its planned architecture includes:
|
||
|
||
- a Flutter client for Android and iOS;
|
||
- an ASP.NET Core API with accounts, TOTP two-factor authentication, and SignalR;
|
||
- an outbound Linux agent for metrics and managed operations;
|
||
- support for adding and monitoring multiple servers from one application.
|
||
|
||
The manager is under active early development. Review its security and development documentation before connecting real production servers.
|
||
|
||
## Requirements
|
||
|
||
- Ubuntu Server with systemd and APT;
|
||
- root access through `sudo`;
|
||
- an active SSH session;
|
||
- outbound HTTPS access to GitHub or GitHub codeload;
|
||
- a valid public SSH key for the administrator setup.
|
||
|
||
## Update
|
||
|
||
For a Git clone:
|
||
|
||
```bash
|
||
cd ~/lightweight-server
|
||
git pull
|
||
sudo ./ochenstarik-server-install.sh
|
||
```
|
||
|
||
## Reset project-managed configuration
|
||
|
||
```bash
|
||
cd ~/lightweight-server
|
||
sudo ./ochenstarik-server-uninstall.sh
|
||
```
|
||
|
||
Read every confirmation carefully. The reset script preserves critical Ubuntu packages and avoids removing access until explicitly confirmed.
|
||
|
||
## License
|
||
|
||
This project is licensed under the MIT License. See [LICENSE](LICENSE).
|