104 lines
3.8 KiB
Bash
104 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Simple installer for Ubuntu server:
|
|
# - unattended-upgrades (security updates + automatic reboot)
|
|
# - Docker (engine + compose plugin) per Docker docs steps 1-3
|
|
# - zsh (set as default shell for original user)
|
|
# - 1Password CLI for access to secrets
|
|
# - secret-tools for storing tokens needed (i.e. for 1Password CLI)
|
|
|
|
# Must be run as root
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "Please run as root: sudo bash $0"
|
|
exit 1
|
|
fi
|
|
|
|
# Detect target user to set default shell for
|
|
TARGET_USER="${SUDO_USER:-$(whoami)}"
|
|
|
|
apt-get update
|
|
|
|
# 1) Enable automatic security updates and automatic reboot
|
|
apt-get install -y unattended-upgrades
|
|
|
|
# Enable periodic updates/unattended-upgrades
|
|
cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
EOF
|
|
|
|
# Ensure automatic reboot after unattended-upgrades (time adjustable)
|
|
cat > /etc/apt/apt.conf.d/99auto-reboot <<'EOF'
|
|
Unattended-Upgrade::Automatic-Reboot "true";
|
|
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
|
|
EOF
|
|
|
|
# Start/enable unattended-upgrades (if system uses service/timer)
|
|
if systemctl list-unit-files | grep -q unattended-upgrades; then
|
|
systemctl enable --now unattended-upgrades || true
|
|
fi
|
|
|
|
# 2) Install Docker (steps 1-3 from Docker docs)
|
|
# Install prerequisites
|
|
apt-get install -y ca-certificates curl gnupg lsb-release
|
|
|
|
# Create keyrings dir and add Docker GPG key
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
chmod a+r /etc/apt/keyrings/docker.asc
|
|
|
|
# Add Docker apt repository
|
|
ARCH=$(dpkg --print-architecture)
|
|
. /etc/os-release
|
|
UBU_CODENAME="${UBUNTU_CODENAME:-$VERSION_CODENAME}"
|
|
echo "deb [arch=${ARCH} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${UBU_CODENAME} stable" \
|
|
> /etc/apt/sources.list.d/docker.list
|
|
|
|
apt-get update
|
|
|
|
# Install Docker Engine + plugins including compose plugin
|
|
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
|
|
# Verify Docker works by running hello-world (this will pull an image)
|
|
if command -v docker >/dev/null 2>&1; then
|
|
docker run --rm hello-world || true
|
|
fi
|
|
|
|
# 3) Install zsh and make it the default shell for the target user
|
|
apt-get install -y zsh
|
|
|
|
ZSH_PATH="$(which zsh)"
|
|
if ! grep -q "^${ZSH_PATH}$" /etc/shells; then
|
|
echo "${ZSH_PATH}" >> /etc/shells
|
|
fi
|
|
|
|
# Change shell for target user (if possible)
|
|
if id "${TARGET_USER}" >/dev/null 2>&1; then
|
|
chsh -s "${ZSH_PATH}" "${TARGET_USER}" || echo "chsh failed for ${TARGET_USER}; you may need to run 'chsh -s ${ZSH_PATH} ${TARGET_USER}' manually"
|
|
else
|
|
echo "User ${TARGET_USER} not found; skipping chsh"
|
|
fi
|
|
|
|
# 4) Install 1Password CLI for access to secrets
|
|
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
|
|
gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg && \
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/$(dpkg --print-architecture) stable main" | \
|
|
tee /etc/apt/sources.list.d/1password.list && \
|
|
mkdir -p /etc/debsig/policies/AC2D62742012EA22/ && \
|
|
curl -sS https://downloads.1password.com/linux/debian/debsig/1password.pol | \
|
|
tee /etc/debsig/policies/AC2D62742012EA22/1password.pol && \
|
|
mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22 && \
|
|
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
|
|
gpg --dearmor --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg && \
|
|
apt update && apt install 1password-cli
|
|
|
|
# Check successful install
|
|
op --version
|
|
|
|
# 5) Install gnome-keyring secret-tool for securely storing tokens
|
|
apt install pass gnupg2
|
|
|
|
|
|
echo "Done. Recommended: log out and back in (or reboot) to start using zsh and ensure all services are active." |