mountain-beaver/vps-forge

"name": "Hung Up"   },   "homepage": "https://github.com/mountain-beaver/vps-forge",

},   "homepage": "https://github.com/mountain-beaver/vps-forge",   "repository": "https://github.com/mountain-beaver/vps-forge",

"homepage": "https://github.com/mountain-beaver/vps-forge",

"repository": "https://github.com/mountain-beaver/vps-forge",

"documentationUrl": "https://github.com/mountain-beaver/vps-forge#readme",

"supportUrl": "https://github.com/mountain-beaver/vps-forge/issues",

"privacyPolicyUrl": "https://github.com/mountain-beaver/vps-forge/blob/main/PRIVACY.md",

1. **Never cut off access.** Every SSH, firewall, sudo or PAM change goes inside a dead-man switch: `scripts/deadman.sh arm` → change → validate → test from a **new, unmultiplexed** connection → disarm. If the new connection fails, do nothi

- **Disarming.** With NOPASSWD sudo (or the temporary grant) the test is the disarm: `ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n vps-forge-deadman disarm'`. Under password sudo, `sudo -n -v` must fail with `a

- **The admin's IP** is `$(sudo vps-forge-deadman client-ip)`, because `$SSH_CLIENT` is empty under sudo. Stop if it's empty or not an IP. If you aren't on the user's own machine (cloud sandbox, CI), it's *your* IP: mark every entry (ufw, `

6. **Secrets never travel through chat.** Generate passwords, keys and tokens on the server, store them with mode 600, and tell the user where they are. If the user pastes a secret anyway, use it, don't repeat it back, and suggest rotating 

8. **Stop if the box looks compromised.** Unknown UID-0 accounts, unknown `authorized_keys`, `/etc/ld.so.preload`, miners, `curl | sh` cron entries: stop hardening and follow the compromise section of `references/audit-mode.md`. You can't h

8. **Stop if the box looks compromised.** Unknown UID-0 accounts, unknown `authorized_keys`, `/etc/ld.so.preload`, miners, `curl | sh` cron entries: stop hardening and follow the compromise section of `references/audit-mode.md`. You can't h

[Credential-related source omitted]

- Run bundled scripts without copying them by hand: `ssh host 'sudo bash -s -- --flags' < scripts/audit.sh`. Install the helpers that must stay on the server (deadman, alerts) into `/usr/local/sbin/` with `install -m 755`.

- **A narrow request** (move SSH, add fail2ban, create a sudo user, a short checklist of such items): do exactly that, under every safety rule. Making the request safe is part of it, not extra: the admin's IP goes on fail2ban's ignore list 

| 3 | Admin user & SSH | `references/ssh.md` | Admin user with a key, sudo policy chosen, root login and passwords off, modern crypto, verified from a new session |

| 12 | Document & hand off | `assets/SERVER.md`, `references/reproducibility.md`, ssh.md §Hand-off cleanup | `/root/SERVER.md` and the final report, agent-session entries and the temporary sudo grant removed; offer the cloud-init/Ansible ex

- [ ] The deadman is disarmed and no temporary sudo or firewall exceptions are left behind

[Credential-related source omitted]

3. **What only the user can do:** for example save the key, sudo and backup passwords offline, enable provider snapshots, confirm they received the test alert. Name anything you left on purpose, such as root login kept for a deploy key (ssh

- `references/ssh.md`: admin user, sudo policy, the drop-in ordering trap, crypto, port change with socket activation, FIDO2/TOTP, cleanup of provider keys

| Admin user / sudo | `<admin>`; sudo <password / NOPASSWD> |

sudo vps-forge-deadman arm 5      # before touching ssh/ufw; 'disarm' after testing a NEW session

sudo ufw status numbered

sudo fail2ban-client status sshd

sudo needrestart -r l

# ntfy (https://ntfy.sh or self-hosted). Public topics are readable by anyone who

# Telegram: create a bot with @BotFather; chat id from https://api.telegram.org/bot<token>/getUpdates

# Behind Cloudflare (proxied): trust its ranges so logs and rate limits see real client IPs. 	# Ranges: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6

# Ranges: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6

- etckeeper   - curl   - git

- curl   - git   - htop

sshd -t || rm -f "$f"

# The admin's IP (`sudo vps-forge-deadman client-ip`; $SSH_CLIENT is empty under sudo), written

#!/usr/bin/env bash

tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT

curl -fsS --max-time 20 --retry 3 https://www.cloudflare.com/ips-v4 -o "$tmp/v4"

curl -fsS --max-time 20 --retry 3 https://www.cloudflare.com/ips-v6 -o "$tmp/v6"

#!/bin/bash

# /etc/restic/env (chmod 600): read by vps-forge-backup.sh # Repository: pick ONE RESTIC_REPOSITORY='s3:https://s3.<region>.backblazeb2.com/<bucket>/<hostname>'

# Repository: pick ONE RESTIC_REPOSITORY='s3:https://s3.<region>.backblazeb2.com/<bucket>/<hostname>' # RESTIC_REPOSITORY='s3:https://<accountid>.r2.cloudflarestorage.com/<bucket>/<hostname>'

RESTIC_REPOSITORY='s3:https://s3.<region>.backblazeb2.com/<bucket>/<hostname>'

# RESTIC_REPOSITORY='s3:https://<accountid>.r2.cloudflarestorage.com/<bucket>/<hostname>' # RESTIC_REPOSITORY='sftp:uXXXXX@uXXXXX.your-storagebox.de:/backups/<hostname>'   # Hetzner Storage Box (port 23 via /root/.ssh/config) # RESTIC_REPOS

# RESTIC_REPOSITORY='rest:https://user:pass@backup.example.com/<hostname>'          # rest-server --append-only

#!/usr/bin/env bash

hc() { # ping healthchecks: "" = success, /start, /fail   [[ -n "${HC_URL:-}" ]] || return 0   printf 'url = "%s%s"\n' "$HC_URL" "$1" | curl -fsS --max-time 10 --retry 3 -K - -o /dev/null 2>/dev/null || true

[[ -n "${HC_URL:-}" ]] || return 0   printf 'url = "%s%s"\n' "$HC_URL" "$1" | curl -fsS --max-time 10 --retry 3 -K - -o /dev/null 2>/dev/null || true }

printf 'url = "%s%s"\n' "$HC_URL" "$1" | curl -fsS --max-time 10 --retry 3 -K - -o /dev/null 2>/dev/null || true

list=$(mktemp); trap 'rm -f "$list"' EXIT

rm -f "$STAMP_DIR/last-partial"

alias ports='sudo ss -tulpn'

alias fw='sudo ufw status numbered'

#!/usr/bin/env bash

#!/usr/bin/env bash

[Credential-related source omitted]

Does not hand over commands that would lock the user out. Explains that disabling passwords without a working key loses access, walks through creating an ed25519 key locally, installing it for a non-root sudo user, verifying from a new sess

The response creates or uses a non-root admin user with sudo before disabling root login

|---|---|---| | **ntfy** | Install the ntfy app and subscribe to a topic | Public ntfy.sh topics are readable by anyone who knows the name. Use a long random topic (`openssl rand -hex 16`), an access token, or self-hosted ntfy. | | **Telegr

| **ntfy** | Install the ntfy app and subscribe to a topic | Public ntfy.sh topics are readable by anyone who knows the name. Use a long random topic (`openssl rand -hex 16`), an access token, or self-hosted ntfy. | | **Telegram** | @BotFat

| **Telegram** | @BotFather → `/newbot` → token. The user messages the bot, then reads `chat.id` from `https://api.telegram.org/bot<token>/getUpdates` | The token is a secret. It goes only into `/etc/vps-forge/notify.env`. |

First write `/etc/vps-forge/notify.env` (mode 600) with the channel settings. See `assets/alerts/notify.env.example`. Write it over SSH via heredoc so secrets don't appear in command lines, and create it private from the start: `sudo sh -c 

ssh host 'sudo bash -s -- --ssh-login --health' < scripts/install-alerts.sh

What gets installed: - `/usr/local/bin/vps-notify TITLE MESSAGE [low|default|high]` sends to every configured channel. Secrets are passed to curl through stdin config, never argv, so other local users can't see them in `ps`.

- `/usr/local/bin/vps-notify TITLE MESSAGE [low|default|high]` sends to every configured channel. Secrets are passed to curl through stdin config, never argv, so other local users can't see them in `ps`.

ssh host 'sudo bash -s -- --json' < scripts/audit.sh > audit-before.json

ssh host 'sudo bash -s' < scripts/audit.sh          # human-readable view

rm -rf /root/restore-test && restic restore latest --target /root/restore-test --include "$F" ${DUMP:+--include "$DUMP"}

rm -rf /root/restore-test

ssh host 'sudo install -m 755 /dev/stdin /usr/local/sbin/vps-forge-deadman' < scripts/deadman.sh

$APT install ca-certificates curl wget gnupg git vim less htop btop ncdu tmux jq unzip rsync    ufw nftables fail2ban python3-systemd unattended-upgrades apt-listchanges needrestart    etckeeper sudo bash-completion dnsutils

$APT install ca-certificates curl wget gnupg git vim less htop btop ncdu tmux jq unzip rsync \

etckeeper sudo bash-completion dnsutils

On an existing server, check whether such files are already tracked (`git -C /etc ls-files restic vps-forge wireguard`). If so, `git -C /etc rm -r --cached <path>` and commit; the old commits still hold them, so tell the user.

1. `vps-forge-deadman status` must say `not armed`. Don't arm for the drill: a reboot while armed rolls back at boot by design, and that restore re-applies the SSH and firewall state, which would hide exactly what the drill looks for. `disa

3. After a minute, from a new connection: `ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n ufw status | head -n 1; systemctl --failed --no-legend'`. Under password sudo without the temporary grant, expect `a passw

3. After a minute, from a new connection: `ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n ufw status | head -n 1; systemctl --failed --no-legend'`. Under password sudo without the temporary grant, expect `a passw

Under password sudo without the temporary grant, the reboot also ends the root session that the remaining root work depends on: run the drill after phase 12, or leave it to the user. If SSH doesn't come back, use the console: `systemctl sta

- Safe aliases: `ll`, `ports` (`ss -tulpn`), `logs` (`journalctl -e`), `fw` (`sudo ufw status numbered`), `dps` (`docker ps --format` table).

[Credential-related source omitted]

[Credential-related source omitted]

Use Docker's own apt repository. The distro's `docker.io` lags behind and ships without the compose plugin. If you have web access, check the current steps at https://docs.docker.com/engine/install/ (debian or ubuntu). The canonical form is

. /etc/os-release install -m 0755 -d /etc/apt/keyrings curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc

install -m 0755 -d /etc/apt/keyrings curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc chmod a+r /etc/apt/keyrings/docker.asc

curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc

chmod a+r /etc/apt/keyrings/docker.asc echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$ID $VERSION_CODENAME stable" \   > /etc/apt/sources.list.d/docker.list

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$ID $VERSION_CODENAME stable" \

Membership in the `docker` group is **root-equivalent**: anyone in it can mount `/` into a container. Say this plainly before adding the admin user to the group. Alternatives: use `sudo docker`, or rootless Docker (below).

[Credential-related source omitted]

[Credential-related source omitted]

pids_limit: 256     healthcheck:       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]

healthcheck:       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]       interval: 30s

test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]

- Prefer notification-based updates: [Diun](https://crazymax.dev/diun/) watches the registries and sends a notification (it supports ntfy and Telegram natively), and the user updates with `docker compose pull && docker compose up -d`. Blind

1. **Cloudflare Tunnel** (`cloudflared`): the server dials out, and 80/443 stay closed entirely. This is the best option at the paranoid level. 2. **Allowlist Cloudflare ranges:** install `assets/firewall/ufw-cloudflare-sync.sh` to `/usr/lo

2. **Allowlist Cloudflare ranges:** install `assets/firewall/ufw-cloudflare-sync.sh` to `/usr/local/sbin/` with its weekly timer (`assets/firewall/ufw-cloudflare-sync.{service,timer}`). It fetches `https://www.cloudflare.com/ips-v4` and `/i

1. **Publish to localhost only** and put a reverse proxy in front: `ports: ["127.0.0.1:8080:8080"]`. Services that only talk to each other need no `ports:` at all; use a compose network. 2. **Filter in the DOCKER-USER chain** when a contain

2. **Filter in the DOCKER-USER chain** when a container must be reachable directly. The maintained helper is [`ufw-docker`](https://github.com/chaifeng/ufw-docker). Show the user what it does, get their OK to download it, review it, then ru

ADMIN_IP=$(sudo vps-forge-deadman client-ip)   # without sudo when root

`${SSH_CLIENT%% *}` is empty under sudo (`env_reset`), on every supported distro. `client-ip` finds the address of the calling SSH client even through sudo, and exits 1 when there is none. Stop if the result is empty or not an IP, before wr

# their signed apt repository (the same one their install script adds), set up explicitly install -d -m 755 /etc/apt/keyrings curl -fsSL https://packagecloud.io/crowdsec/crowdsec/gpgkey | gpg --dearmor -o /etc/apt/keyrings/crowdsec_crowdsec

install -d -m 755 /etc/apt/keyrings curl -fsSL https://packagecloud.io/crowdsec/crowdsec/gpgkey | gpg --dearmor -o /etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg echo 'deb [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyr

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- **The SSH crypto drop-in is generated, not copied.** KEX and cipher names differ between OpenSSH versions (a file from Debian 13 makes `sshd` on Ubuntu 22.04 exit 255). Generate `01-vps-forge-crypto.conf` in `runcmd` on the target from it

1. **Recon.** Give the user `audit.sh` and one command: `sudo bash audit.sh --json > recon.json; sudo bash audit.sh`. Ask them to paste the human-readable output (it holds no secrets) or upload `recon.json`. Read it like phase 0: distro, Op

- `2-access.sh`: admin user and key, sudo policy, sshd drop-ins, firewall, fail2ban (phases 3–5). Every risky step sits inside a deadman window with the pause below.

- The final audit: `sudo bash audit.sh` again, pasted back, compared with recon (phase 11).

sudo bash 1-base.sh

This is the step that replaces your new-connection test. In `2-access.sh`, around every SSH, firewall, sudo or PAM change:

ssh -o ControlPath=none -p ${PORT} ${ADMIN}@${HOST} 'sudo -n vps-forge-deadman disarm'

The user's second terminal is the new connection: it can't reuse the session the script runs in. Under password sudo the test command is `ssh -t -o ControlPath=none -p ${PORT} ${ADMIN}@${HOST} 'sudo vps-forge-deadman disarm'`, and the user 

- Admin user and sudo policy

2. `vps-forge-deadman arm 5`, write the sudo policy (below), then test and disarm (next section). This proves the admin login and sudo before anything depends on them.

The test runs from a **new, unmultiplexed** connection. Without `-o ControlPath=none`, ssh reuses the multiplexed master and proves nothing. Which command to use depends on the sudo policy:

- **NOPASSWD, or password sudo with the temporary grant** (below). One command proves the login, port, firewall and sudo, and disarms:

`ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n vps-forge-deadman disarm'`

- **Password sudo without the grant.** `sudo -n` always fails here, so it can't be the disarm path. Run `ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n -v'`. It must fail with `a password is required`, which prov

## Admin user and sudo policy

[Credential-related source omitted]

[Credential-related source omitted]

If root already has the user's key, copy **only that key**, never the whole file. Old contractors' keys and provider keys often sit in root's file, and copying the file would hand them the new sudo account. List the keys with `ssh-keygen -l

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

**The user logs in as root today?** At `hardened` and above, still create an admin user and move them off root. Use the name they asked for, otherwise `admin`. Copy only their key as above, prove the admin login and sudo from a new connecti

**Root has deploy keys?** Check with `ssh-keygen -lf /root/.ssh/authorized_keys | grep -iwE 'deploy|ci|github|gitlab|actions|runner|coolify|dokploy|caprover|kamal'`, and ask whether they deploy with Kamal, which logs in as root from their l

**Sudo policy is the user's decision.** Explain the trade-off and let them choose:

- **Password sudo (more secure).** A stolen key alone doesn't give root. The catch is that an agent can't type the password. Set it from the **root** session, before root login goes off: the admin can't run `sudo passwd` without a password 

printf '[Unit]\nDescription=Remove the temporary vps-forge sudo grant\n[Service]\nType=oneshot\nExecStart=/bin/rm -f /etc/sudoers.d/90-vps-forge-temp\n' > /etc/systemd/system/vps-forge-temp-sudo-expiry.service

printf '[Unit]\nDescription=Deadline for the temporary vps-forge sudo grant\n[Timer]\nOnCalendar=%s\nPersistent=true\n[Install]\nWantedBy=timers.target\n' "$(date -d '+4 hours' '+%Y-%m-%d %H:%M:%S')" > /etc/systemd/system/vps-forge-temp-sud

- **NOPASSWD sudo (convenient).** `/etc/sudoers.d/10-<admin>` with `<admin> ALL=(ALL) NOPASSWD:ALL`. This is reasonable when the key is the only factor anyway (hardware or passphrase-protected key) and the box is agent-managed.

Always write sudoers files with `visudo -cf <file>` before moving them into place, using mode 440, inside a deadman window (step 2 above): `printf '%s ALL=(ALL) NOPASSWD:ALL\n' "$U" > /root/sudo.new && visudo -cf /root/sudo.new && install -

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

4. Last step, in one call, because afterwards you have no root: `sudo sh -c 'systemctl disable --now vps-forge-temp-sudo-expiry.timer; rm -f /etc/systemd/system/vps-forge-temp-sudo-expiry.* /etc/sudoers.d/90-vps-forge-temp && systemctl daem

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

. /etc/os-release                                     # $ID is debian or ubuntu, $VERSION_CODENAME e.g. trixie or noble curl -fsSL "https://pkgs.tailscale.com/stable/$ID/$VERSION_CODENAME.noarmor.gpg" -o /usr/share/keyrings/tailscale-archiv

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Also set `net.ipv4.ip_forward = 1` and `rp_filter = 2` in the sysctl file. Find `<wan-if>` with `ip route show default`. - Start it: `systemctl enable --now wg-quick@wg0`. A recent handshake in `wg show` only proves the keys and the UDP pat

- Start it: `systemctl enable --now wg-quick@wg0`. A recent handshake in `wg show` only proves the keys and the UDP path, not routing: from the client, `ping 10.8.0.1` and `curl -s https://ifconfig.me` must return the VPS IP; on the server,

2. `vps-forge-deadman arm 10` 3. Delete both public SSH rules: `ufw delete limit <port>/tcp` and `ufw delete allow from <admin-ip> to any port <port> proto tcp` (plus any other admin or agent-session allow for that port; check `ufw status`)

3. Delete both public SSH rules: `ufw delete limit <port>/tcp` and `ufw delete allow from <admin-ip> to any port <port> proto tcp` (plus any other admin or agent-session allow for that port; check `ufw status`). Keep `ufw allow in on tailsc

4. The public IP no longer answers on the SSH port (`external-check.sh`, or `nc -z -w 5 <public-ip> <port>` fails). A leftover admin rule would still let the admin in from outside.

Caddy obtains and renews certificates by itself, redirects HTTP to HTTPS, serves HTTP/2 and HTTP/3, and has a tiny config. Install it from the official repo; check https://caddyserver.com/docs/install#debian-ubuntu-raspbian for the current 

curl -sSI http://example.com | head -n 3             # 301/308 → https

curl -sSI https://example.com | grep -iE 'strict-transport|x-content-type|referrer-policy|server'

External: `bash scripts/external-check.sh <host> --domain example.com` checks the redirect, the headers, certificate expiry and the TLS versions offered. For depth, testssl.sh (`testssl.sh example.com`), https://securityheaders.com and http

#!/usr/bin/env bash

# Usage:  sudo bash audit.sh [--json] [--quiet] [--no-color]

#         ssh host 'sudo bash -s -- --json' < audit.sh

# Changes nothing on the system. Runs without root, but then several checks are SKIPped. # Exit status: 0 = no FAIL, 1 = at least one FAIL, 2 = usage error. # Part of vps-forge (MIT). https://github.com/mountain-beaver/vps-forge

# Part of vps-forge (MIT). https://github.com/mountain-beaver/vps-forge

prohibit-password|without-password) warn ssh.root_login "root login allowed with keys (PermitRootLogin $v); use an admin user + sudo" ;;

# sudo" never matches. System accounts count too (postgres has /bin/bash). Capped for speed.

sudoers=$(getent group sudo 2>/dev/null | cut -d: -f4)

info accounts.sudo "sudo group: ${sudoers:-empty}"

# The skill hands a generated sudo password over in this file; it must not outlive the hand-off.

[[ -n "$sudo_pw" ]] && warn accounts.sudo_password_file "leftover sudo password file: $(untrusted "$sudo_pw" 200). Delete it once the password is stored elsewhere"

[[ -n "$nopw" ]] && info accounts.nopasswd "NOPASSWD sudo rules in: $nopw"

warn accounts.temp_sudo "temporary sudo grant /etc/sudoers.d/90-vps-forge-temp still present (expires $(untrusted "$tdead" 40))"

warn accounts.temp_sudo "temporary sudo grant /etc/sudoers.d/90-vps-forge-temp still present, with no expiry timer: remove it once the setup is done"

#!/usr/bin/env bash

# vps-forge deadman: automatic rollback of SSH / firewall / sudo / PAM config unless disarmed.

#   ssh -o ControlPath=none -o BatchMode=yes -p <port> <admin>@<host> 'sudo -n vps-forge-deadman disarm'

# (NOPASSWD sudo; for password sudo see references/ssh.md "Test and disarm")

etc/sudoers etc/sudoers.d etc/pam.d/sshd etc/pam.d/sudo etc/pam.d/common-auth

remove_boot_unit() { rm -f "$STATE/armed" "$STATE/armed-snapshot" "$BOOT_LINK" "$BOOT_FILE" "$BOOT_FILE.tmp"; }

client_ip() { # address of the SSH client that runs this; sudo drops SSH_CLIENT, so walk up the parents

command -v nft >/dev/null 2>&1 && { nft list tables > "$dir/nft-tables" 2>/dev/null || rm -f "$dir/nft-tables"; }

find "$STATE" -mindepth 1 -maxdepth 1 -type d -name '20*' -printf '%f\n' | sort | head -n -"$KEEP"      | while read -r old; do [[ "$keep" == *" $old "* ]] || rm -rf "${STATE:?}/$old"; done

| while read -r old; do [[ "$keep" == *" $old "* ]] || rm -rf "${STATE:?}/$old"; done

rm -rf "$new"

cp -a "$src" "$new" || { log "ERROR: copy failed for $dst"; rm -rf "$new"; return 1; }

if ! { mkdir -p "$(dirname "$bak")" && rm -rf "$bak" && mv -T "$dst" "$bak"; }; then

rm -rf "$new"

tar -C "$tmp" -xpf "$dir/snapshot.tar" || { rm -rf "$tmp"; die "cannot extract snapshot"; }

rm -f "$STATE/restore-partial"

rm -rf "$tmp"

rm -f "$dropin"; systemctl daemon-reload

rm -f "$STATE/restored-at" "$STATE/restore-partial" && date +%s > "$STATE/armed-at" || die "cannot write $STATE/armed-at"

echo "$dir" > "$STATE/armed-snapshot" || { rm -f "$STATE/armed-at"; remove_boot_unit; die "cannot write $STATE/armed-snapshot"; }

systemd-run --quiet --collect --unit="$UNIT" --description="vps-forge deadman rollback"        --on-active="${min}m" --timer-property=AccuracySec=1s        /bin/bash "$STATE/bin/deadman.sh" restore --armed "$dir" || { rm -f "$STATE/armed-at

/bin/bash "$STATE/bin/deadman.sh" restore --armed "$dir" || { rm -f "$STATE/armed-at"; remove_boot_unit; die "systemd-run failed"; }

rm -f "$STATE/armed-at" || die "cannot remove $STATE/armed-at"

rm -f "$STATE/armed-at"

client_ip || die "no SSH client found for this session (run it inside an SSH session; sudo is fine)"

#!/usr/bin/env bash

[Credential-related source omitted]

#                               [--no-scan] [--no-login-tests] # #  - open TCP ports (nmap if installed, otherwise nc on common ports). An IPv6 literal is scanned

# #  - open TCP ports (nmap if installed, otherwise nc on common ports). An IPv6 literal is scanned #    with -6; a name that has AAAA records gets a second, separately reported IPv6 pass

#  - open TCP ports (nmap if installed, otherwise nc on common ports). An IPv6 literal is scanned

# /etc/fail2ban/jail.d/vps-forge.local (then: sudo systemctl reload fail2ban).

#   sudo fail2ban-client set sshd unbanip <your-ip>   (also: set recidive unbanip <your-ip>)

if r=$(ssh $SSH_OPTS ${ID_OPTS[@]+"${ID_OPTS[@]}"} -p "$PORT" "$USER_NAME@$HOST" 'echo vpsforge-ok; sudo -n true 2>/dev/null && echo sudo-nopasswd; true' 2>&1); then

case "$r" in *sudo-nopasswd*) info "$USER_NAME has passwordless sudo";; *) info "$USER_NAME sudo requires a password (or no sudo)";; esac

# BSD nc on macOS: -w does not bound the connect itself, -G does.

nc $flag $NC_OPTS "$HOST" "$p" >/dev/null 2>&1 && open="$open$p "

# nc can't tell "closed" from "unreachable": nothing answering at all is suspicious.

case "$scan_tool" in     nmap) if [ -n "$scan_err" ]; then fail "port scan failed, results are incomplete ($scan_err)"; else info "scanned top 1000 ports with nmap"; fi ;;     nc) info "nmap not found; probed common ports with nc (install n

nmap) if [ -n "$scan_err" ]; then fail "port scan failed, results are incomplete ($scan_err)"; else info "scanned top 1000 ports with nmap"; fi ;;     nc) info "nmap not found; probed common ports with nc (install nmap for a full scan)" ;; 

nc) info "nmap not found; probed common ports with nc (install nmap for a full scan)" ;;

*) warn "neither nmap nor nc available; port scan skipped" ;;

pass "root login refused for your key (another key may still work: confirm with 'sudo sshd -T | grep -i permitrootlogin' on the server)"

if have timeout; then TO=(timeout 10); elif have gtimeout; then TO=(gtimeout 10); fi   if have curl; then     r=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' --max-time 10 "http://$DOMAIN/"); crc=$?

if have curl; then     r=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' --max-time 10 "http://$DOMAIN/"); crc=$?     code=${r%% *}; loc=${r#* }

r=$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' --max-time 10 "http://$DOMAIN/"); crc=$?

if [ "$crc" -ne 0 ]; then       case "$crc" in         6) info "http://$DOMAIN does not resolve; check DNS" ;;

case "$crc" in         6) info "http://$DOMAIN does not resolve; check DNS" ;;         7) info "port 80 not reachable (fine with HSTS-preloaded or Tunnel setups)" ;;

6) info "http://$DOMAIN does not resolve; check DNS" ;;

7) info "port 80 not reachable (fine with HSTS-preloaded or Tunnel setups)" ;;         28) info "http://$DOMAIN timed out" ;;         *) info "http://$DOMAIN is unreachable (curl exit $crc)" ;;

28) info "http://$DOMAIN timed out" ;;         *) info "http://$DOMAIN is unreachable (curl exit $crc)" ;;       esac

*) info "http://$DOMAIN is unreachable (curl exit $crc)" ;;

lloc=$(printf '%s' "$loc" | tr 'A-Z' 'a-z')           case "$lloc" in             https://*)

case "$lloc" in             https://*)               rh=$(url_host "$lloc")

https://*)

hraw=$(curl -sS -D - -o /dev/null -L --max-redirs 5 --max-time 10 "https://$DOMAIN/" 2>&1); hrc=$?

case "$srv" in *[0-9]*) warn "Server header leaks a version: $srv";; "") pass "no Server header";; *) info "Server: $srv";; esac     else       fail "https://$DOMAIN not reachable: $(printf '%s' "$hdrs" | head -n 1)"

else       fail "https://$DOMAIN not reachable: $(printf '%s' "$hdrs" | head -n 1)"     fi

fail "https://$DOMAIN not reachable: $(printf '%s' "$hdrs" | head -n 1)"

fi   if [ "$TLS_SKIP" = 1 ]; then     info "TLS certificate and legacy-protocol checks skipped: https://$DOMAIN is not reachable"

if [ "$TLS_SKIP" = 1 ]; then     info "TLS certificate and legacy-protocol checks skipped: https://$DOMAIN is not reachable"   elif have openssl; then

info "TLS certificate and legacy-protocol checks skipped: https://$DOMAIN is not reachable"

#!/usr/bin/env bash

#   remote:         ssh host 'sudo bash -s -- --all --test' < install-alerts.sh

rm -f /etc/systemd/system/vps-forge-health.{service,timer}

tmp=$(mktemp); grep -vF "$PAM_LINE" /etc/pam.d/sshd > "$tmp"; cat "$tmp" > /etc/pam.d/sshd; rm -f "$tmp"

rm -f /usr/local/bin/vps-notify /usr/local/sbin/vps-forge-health /usr/local/sbin/vps-forge-ssh-login

rm -rf /var/lib/vps-forge/alerts

command -v curl >/dev/null || { say "installing curl"; DEBIAN_FRONTEND=noninteractive apt-get install -y -qq curl >/dev/null; }

# ntfy (https://ntfy.sh or self-hosted). Public topics are readable by anyone who

# Telegram: create a bot with @BotFather; chat id from https://api.telegram.org/bot<token>/getUpdates

# vps-notify TITLE [MESSAGE] [low|default|high]: send to every channel in /etc/vps-forge/notify.env. # Secrets are passed to curl via a config on stdin, never on the command line (visible in ps).

# Secrets are passed to curl via a config on stdin, never on the command line (visible in ps).

printf '%s' "$out" } send() { curl -fsS --max-time 10 --retry 2 --retry-delay 2 -K - >/dev/null 2>&1; }

send() { curl -fsS --max-time 10 --retry 2 --retry-delay 2 -K - >/dev/null 2>&1; }

[Credential-related source omitted]

[Credential-related source omitted]

tried=$((tried+1))   {     echo "url = $(cfg "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage")"

{     echo "url = $(cfg "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage")"     echo "data-urlencode = $(cfg "chat_id=$TELEGRAM_CHAT_ID")"

[Credential-related source omitted]

[Credential-related source omitted]

rm -f "$f"

if [[ -n "${HC_HEARTBEAT_URL:-}" ]]; then   printf 'url = "%s"\n' "$HC_HEARTBEAT_URL" | curl -fsS --max-time 10 --retry 3 -K - >/dev/null 2>&1 || true

printf 'url = "%s"\n' "$HC_HEARTBEAT_URL" | curl -fsS --max-time 10 --retry 3 -K - >/dev/null 2>&1 || true