bootstrap/main
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document sudo-user creation + retarget + new flags

Browse Source
This commit is contained in:
mk 2026-07-28 05:05:03 +03:00
parent e7a9349292
commit 34137d185e
1 changed files with 43 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
README.md
View File

@ -6,10 +6,10 @@ Turn a fresh Debian/Ubuntu/Arch VPS into a familiar workstation in one command.
```sh
curl -fsSL <shortener> | bash
# run everything non-interactively:
curl -fsSL <shortener> | bash -s -- --yes
# run a single step:
curl -fsSL <shortener> | bash -s -- --only packages
# run everything non-interactively and create a sudo user 'mk':
curl -fsSL <shortener> | bash -s -- --yes --username mk
```
The shortener points at the **raw `install.sh`** in this repo, which clones the
@ -27,18 +27,50 @@ bash ~/.bootstrap/setup.sh --only hardening
| # | step | what it does |
|---|-------------|--------------------------------------------------------------------|
| 0 | preflight | verify distro + network + privileges |
| 1 | packages | git, byobu, ufw, mosh, btop, eza, fzf, ripgrep, bat, zoxide, jq, fd, tree, ncdu, lazygit, starship, … (+ `yay` on Arch) |
| 2 | docker | Docker engine + compose v2 plugin, `$USER` in `docker` group |
| 3 | angie | Angie (nginx fork) web server |
| 4 | shell-zsh | zsh + oh-my-zsh + plugins, set default shell, ship config |
| 5 | nvm | nvm → `~/.nvm` + Node LTS |
| 6 | nvim | clone `g.mk.fo/bootstrap/nvim-minimal` → `~/.config/nvim` |
| 7 | hardening | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban, **angie config layout** |
| 8 | sanity | read-only report + recommended manual follow-ups |
| 0 | preflight | verify distro + network + privileges |
| 1 | create-user | (when direct root) create a passwordless sudo user, copy root's authorized_keys, retarget config at them |
| 2 | packages | git, byobu, ufw, mosh, btop, eza, fzf, ripgrep, bat, zoxide, jq, fd, tree, ncdu, lazygit, starship, … (+ `yay` on Arch) |
| 3 | docker | Docker engine + compose v2 plugin, `$TARGET_USER` in `docker` group |
| 4 | angie | Angie (nginx fork) web server |
| 5 | shell-zsh | zsh + oh-my-zsh + plugins, set default shell, ship config (to `~$TARGET_USER/.config/zsh`) |
| 6 | nvm | nvm → `~$TARGET_USER/.nvm` + Node LTS |
| 7 | nvim | clone `g.mk.fo/bootstrap/nvim-minimal` → `~$TARGET_USER/.config/nvim` |
| 8 | hardening | ssh (key-only root), ufw, updates, unattended-upgrades, tz, hostname, swapfile, locale, fail2ban, **angie config layout** |
| 9 | sanity | read-only report + recommended manual follow-ups |
Every step is idempotent — re-running is safe.
## Sudo user (when running as direct root)
Running the one-liner as **direct root** (no `SUDO_USER`) is the common
provider-provisioned-VPS case. The `create-user` step then:
- **Arch**: auto-creates a non-root sudoer (AUR/`makepkg` can't run as root),
with a `y/N` confirm on the username (default `mk`).
- **Debian/Ubuntu**: asks `y/N` whether to create one (optional — apt works
as root).
- Always when sudoed-root (`SUDO_USER` set): uses that invoking user as the target,
syncing their sudoers + ssh keys instead of creating a new account.
- Never when not root: you're already a normal user; yourself is the target.
Flags:
- `--create-user` force the prompt regardless of distro,
- `--username NAME` use that name and skip the name prompt.
The created user:
- is added to `wheel` (Arch) or `sudo`+`adm` (Debian), shell set to zsh,
- has **no password** (`passwd -d`) — SSH key login only (you'll disable ssh
password auth in the hardening step),
- gets `/root/.ssh/authorized_keys` copied to `~user/.ssh/` (chmod 600/700),
with the fingerprints printed so you can sanity-check they're yours,
- gets `/etc/sudoers.d/<user>`: `Defaults:<user> !tty_tickets`,
`Defaults:<user> timestamp_timeout=10080` (7-day cache), and
`<user> ALL=(ALL) NOPASSWD:ALL`. Validated with `visudo -c` before install.
All later config steps (zsh/omz, nvim, nvm, docker group) target
`~$TARGET_USER`. After bootstrap, **test `ssh <user>@<host>` from a new
terminal before closing the root session.**
## Zsh plugins enabled (oh-my-zsh)
`git sudo command-not-found colored-man-pages extract copypath dirhistory`