server-scripts

Standalone server-administration scripts for Linux (RHEL-, Debian- and Arch-family; systemd). Written in POSIX sh; interactive setup workflows are confirm-gated, and every script answers -h / --help.

Before running anything, sh check.sh reports whether this machine has what these scripts need — nothing is installed or changed. Narrow it to one workflow with sh check.sh --for docker (also new, harden, firewall, desktop, remote, vpn or benchmark).

Folder	Run	Purpose
harden/	sudo sh harden/run.sh	Confirmation-gated hardening — key-only SSH login + default-deny firewall + Fail2Ban, guarded by a dead-man's switch
firewall/	sudo sh firewall/run.sh	Firewall rules — add, remove or list individual rules through UFW, firewalld, nftables or iptables
new/	sudo sh new/run.sh	New-server bootstrap — benchmark, updates, hardening, Docker, desktop, remote desktop and encrypted-network clients
benchmark/	sh benchmark/run.sh	Benchmarks — pick YABS, bench.sh or nench; results are shown live and saved to a log
docker/	sudo sh docker/run.sh	Docker Engine + Compose v2 — official repositories per distro, service enabled, group membership handled
desktop/	sudo sh desktop/run.sh	Desktop wizard — GUI setup with optional delegation to remote/VPN installers
remote/	sudo sh remote/run.sh	Remote desktop — RustDesk, xrdp or TigerVNC
vpn/	sudo sh vpn/run.sh	Encrypted networks — NetBird or Tailscale/Headscale client

Each folder is self-contained (its scripts also run standalone), and more script collections will be added as separate folders over time.

Quick start

Bootstrap a fresh server (update everything, then harden):

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/new/run.sh -o "$script" || exit 1
  sudo sh "$script"
)

Hardening only — see harden/README.md for details:

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/harden/run.sh -o "$script" || exit 1
  sudo sh "$script"
)

Firewall only — a default-deny ruleset that keeps your live SSH port open:

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/harden/setup-firewall.sh -o "$script" || exit 1
  sudo sh "$script"
)

After cloning, manage individual rules on an existing firewall:

sudo sh firewall/run.sh list
sudo sh firewall/run.sh add 443/tcp
sudo sh firewall/run.sh remove 443/tcp

Benchmark — pick YABS, bench.sh or nench; no root required. See benchmark/README.md for details:

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/benchmark/run.sh -o "$script" || exit 1
  sh "$script"
)

Docker Engine + Compose v2 — see docker/README.md for details:

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/docker/run.sh -o "$script" || exit 1
  sudo sh "$script"
)

Desktop environment / window manager — see desktop/README.md for details:

(
  script=$(mktemp) || exit 1
  trap 'rm -f "$script"' 0
  trap 'exit 130' 1 2 15
  curl -fsSL https://git.gui.icu/dev/server-scripts/raw/branch/main/desktop/run.sh -o "$script" || exit 1
  sudo sh "$script"
)

After cloning, common access recipes are:

sudo sh desktop/run.sh --de xfce                    # local GUI only
sudo sh desktop/run.sh --remote rustdesk            # remote access for an existing GUI
sudo sh desktop/run.sh --de xfce --remote rustdesk  # install and start both
sudo sh desktop/run.sh --de xfce --remote xrdp
sudo sh desktop/run.sh --remote rustdesk --rustdesk-mode local --auth otp --rustdesk-from 192.168.168.0/24
sudo sh remote/run.sh rustdesk --rustdesk-mode remote --auth both
sudo sh vpn/run.sh netbird --netbird-install-only
sudo sh vpn/run.sh tailscale --login-server https://headscale.example.com

RustDesk and xrdp are started immediately. A reboot is normally unnecessary; the installer reports the few cases where one is required.

Or clone and run locally:

git clone https://git.gui.icu/dev/server-scripts.git
cd server-scripts
sh benchmark/run.sh        # for example

Scripts exit 0 when complete, 2 when the user cancels or leaves a selected workflow incomplete, and 1 on failure. Orchestrators print a per-step summary.

License

MIT — see LICENSE. Every script carries an SPDX-License-Identifier: MIT tag, so a single folder lifted out of this repo still says what it is licensed under.