156 lines
7.5 KiB
Markdown
156 lines
7.5 KiB
Markdown
# Lightweight Ubuntu Server Setup
|
||
|
||
**English** | [Русский](docs/readme/README.ru.md) | [Español](docs/readme/README.es.md) | [Deutsch](docs/readme/README.de.md) | [Français](docs/readme/README.fr.md) | [Português](docs/readme/README.pt.md) | [中文](docs/readme/README.zh-CN.md) | [日本語](docs/readme/README.ja.md) | [العربية](docs/readme/README.ar.md) | [हिन्दी](docs/readme/README.hi.md)
|
||
|
||
A modular set of Bash installers for the initial setup, security hardening, administration, VPN, web panel, WARP, and backups on Ubuntu Server. Run the unified wizard for a guided installation or execute only the modules you need.
|
||
|
||
> **Manage multiple servers:** use the companion [Server Monitor Manager](https://github.com/ochenstarik-ui/server-monitor-manager) project to add servers, collect reports, and manage several hosts from one application. It is currently in early development and should not yet be treated as production-ready.
|
||
|
||
## Quick installation
|
||
|
||
Copy the complete block into the server terminal. It downloads the repository archive through `codeload.github.com`, stops on errors, and starts the unified installer:
|
||
|
||
```bash
|
||
set -e
|
||
cd "$HOME"
|
||
sudo apt-get update
|
||
sudo apt-get install -y curl ca-certificates tar
|
||
archive="$(mktemp)"
|
||
trap 'rm -f "$archive"' EXIT
|
||
curl -4 -fL \
|
||
--retry 5 \
|
||
--retry-delay 10 \
|
||
--connect-timeout 30 \
|
||
https://codeload.github.com/ochenstarik-ui/lightweight-server/tar.gz/refs/heads/main \
|
||
-o "$archive"
|
||
install -d -m 700 lightweight-server
|
||
tar -xzf "$archive" -C lightweight-server --strip-components=1
|
||
rm -f "$archive"
|
||
trap - EXIT
|
||
cd lightweight-server
|
||
chmod 700 ./*.sh
|
||
sudo ./ochenstarik-server-install.sh
|
||
```
|
||
|
||
The first wizard prompt selects the dialog language. English is the default; Russian, Spanish, German, French, Portuguese, Simplified Chinese, Japanese, Arabic, and Hindi are also available. The wizard then presents steps 1–8 in order. Each step can be installed, skipped, or used to exit the wizard.
|
||
|
||
Keep the current SSH session open while changing the SSH port. Test the new login in a second terminal before disconnecting.
|
||
|
||
## Short wizard-only installation
|
||
|
||
If `raw.githubusercontent.com` is reachable from the server:
|
||
|
||
```bash
|
||
sudo apt-get update
|
||
sudo apt-get install -y curl ca-certificates
|
||
curl -4 -fLO \
|
||
--retry 5 \
|
||
--retry-delay 10 \
|
||
--connect-timeout 30 \
|
||
https://raw.githubusercontent.com/ochenstarik-ui/lightweight-server/main/ochenstarik-server-install.sh
|
||
chmod 700 ochenstarik-server-install.sh
|
||
sudo ./ochenstarik-server-install.sh
|
||
```
|
||
|
||
The wizard downloads any missing module from the `main` branch and validates it with `bash -n` before execution.
|
||
|
||
## Modules
|
||
|
||
| Script | Purpose | Standalone use |
|
||
| --- | --- | --- |
|
||
| `ochenstarik-server-install.sh` | Unified wizard with language selection and sequential module installation | Recommended |
|
||
| `ochenstarik-server-1.sh` | Timezone, terminal locale, program groups, and a 2 GiB swap file | Yes |
|
||
| `ochenstarik-server-2.sh` | Base packages, SSH port, IPv4/IPv6 mode, UFW, and port management | Yes |
|
||
| `ochenstarik-server-user-3.sh` | Administrative user, SSH key permissions, SSH migration, sudo, and fail2ban | Run after step 2 |
|
||
| `ochenstarik-server-tg-4.sh` | Telegram notifications for successful SSH logins | Optional |
|
||
| `ochenstarik-server-vpn-5.sh` | System VPN through Xray with a selectable subscription port | Optional |
|
||
| `ochenstarik-server-panel-warp-6.sh` | 3x-ui panel and local Cloudflare WARP proxy | Optional |
|
||
| `ochenstarik-server-backup-7.sh` | Protected initial snapshot and selected daily, weekly, or monthly schedules | Optional |
|
||
| `ochenstarik-server-ai-agents-8.sh` | Installs selected AI agents for a regular user: Hermes, OpenClaw, OpenHands, OpenCode, or Aider | Optional |
|
||
| `ochenstarik-server-uninstall.sh` | Removes project-managed settings so installation can start again | Use carefully |
|
||
|
||
Every module can be downloaded and run independently:
|
||
|
||
```bash
|
||
curl -fLO https://raw.githubusercontent.com/ochenstarik-ui/lightweight-server/main/SCRIPT_NAME.sh
|
||
chmod 700 SCRIPT_NAME.sh
|
||
bash -n SCRIPT_NAME.sh
|
||
sudo ./SCRIPT_NAME.sh
|
||
```
|
||
|
||
Replace `SCRIPT_NAME.sh` with the required filename from the table.
|
||
|
||
## Installation flow
|
||
|
||
1. Select the wizard dialog language.
|
||
2. Configure the timezone, terminal locale, recommended tools, and swap.
|
||
3. Select IPv4, IPv6, or dual-stack operation; install base services and select the future SSH port.
|
||
4. Create or update the administrative user, install the public SSH key, repair ownership and permissions, and move SSH to the port selected in step 2.
|
||
5. Optionally configure Telegram SSH-login notifications.
|
||
6. Optionally configure the system VPN and subscription port.
|
||
7. Optionally deploy 3x-ui and Cloudflare WARP with selected panel and subscription ports.
|
||
8. Optionally create the permanent initial backup and configure rotating schedules.
|
||
9. Optionally install one or more AI agents for the administrative user.
|
||
|
||
## Optional AI agents
|
||
|
||
Step 8 offers a multiple selection of five popular agents: Hermes Agent, OpenClaw, OpenHands, OpenCode, and Aider. Installers are downloaded only from each project's official HTTPS endpoint, checked with `bash -n`, and executed as the selected regular user rather than `root`.
|
||
|
||
The script does not request or store model-provider API keys. After installation, log in as the selected user and run the displayed onboarding command. AI agents can execute commands, access files, install plugins, and use network services; review their permissions and sandbox settings before connecting production data or secrets.
|
||
|
||
## Firewall and SSH notes
|
||
|
||
- Step 2 supports IPv4-only, IPv6-only, and dual-stack UFW rules.
|
||
- A repeated step 2 run can change the IP-family mode or add ports without reinstalling everything.
|
||
- Step 3 reads the SSH port chosen in step 2 and creates an administrator with sudo access.
|
||
- The home directory, `.ssh`, and `authorized_keys` ownership and permissions are checked on every run.
|
||
- Do not remove temporary port 22 access until a new SSH session succeeds on the selected port.
|
||
|
||
## Backups
|
||
|
||
Step 7 can create:
|
||
|
||
- one initial snapshot that is never rotated automatically;
|
||
- daily backups retained for 7 days;
|
||
- weekly backups retained for 4 weeks;
|
||
- monthly backups retained for 12 months.
|
||
|
||
Schedules are selected independently, so any combination can be enabled. Keep an additional copy on another server or storage device; a local backup does not protect against loss of the entire host.
|
||
|
||
## Multi-server monitoring and management
|
||
|
||
[Server Monitor Manager](https://github.com/ochenstarik-ui/server-monitor-manager) is the companion project for centralized server operations. Its planned architecture includes:
|
||
|
||
- a Flutter client for Android and iOS;
|
||
- an ASP.NET Core API with accounts, TOTP two-factor authentication, and SignalR;
|
||
- an outbound Linux agent for metrics and managed operations;
|
||
- support for adding and monitoring multiple servers from one application.
|
||
|
||
The manager is under active early development. Review its security and development documentation before connecting real production servers.
|
||
|
||
## Requirements
|
||
|
||
- Ubuntu Server with systemd and APT;
|
||
- root access through `sudo`;
|
||
- an active SSH session;
|
||
- outbound HTTPS access to GitHub or GitHub codeload;
|
||
- a valid public SSH key for the administrator setup.
|
||
|
||
## Update
|
||
|
||
For a Git clone:
|
||
|
||
```bash
|
||
cd ~/lightweight-server
|
||
git pull
|
||
sudo ./ochenstarik-server-install.sh
|
||
```
|
||
|
||
## Reset project-managed configuration
|
||
|
||
```bash
|
||
cd ~/lightweight-server
|
||
sudo ./ochenstarik-server-uninstall.sh
|
||
```
|
||
|
||
Read every confirmation carefully. The reset script preserves critical Ubuntu packages and avoids removing access until explicitly confirmed.
|