restructure: move proxmox/ into subfolder, add pihole/ section

All existing content moved from repo root into proxmox/ to make room for other Debian machine configs. Adds pihole/ with: - config/pihole.toml — snapshot of current Pi-hole v6 config - config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot) - pull-config.sh <source-host> <dest-dir> — pull live config to disk - apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
2026-07-23 12:16:35 +10:00
parent 7a038b534f
commit 2909db5d04
28 changed files with 1894 additions and 0 deletions
@@ -0,0 +1,67 @@
+#!/bin/bash
+# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
+# Runs the individual scripts in order. Idempotent - safe to re-run.
+#
+# If ADMIN_USER and ADMIN_SSH_KEY are set, a Linux system user is created
+# with SSH key access and sudo before SSH hardening runs - so key-based
+# login is in place before password auth is disabled. If they are not set,
+# a reminder is printed at the end to run setup-linux-admin-user.sh manually
+# (but do this BEFORE disconnecting, since password auth will be disabled).
+#
+# Usage:
+#   MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
+#   MGMT_CIDR=192.168.2.0/24 ADMIN_USER=wayne ADMIN_SSH_KEY="ssh-ed25519 ..." ./bootstrap.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if [ -z "${MGMT_CIDR:-}" ]; then
+    echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
+    exit 1
+fi
+
+STEP=0
+next_step() { STEP=$((STEP + 1)); echo; echo "=== ${STEP}: $* ==="; }
+
+next_step "remove enterprise repos, switch to no-subscription"
+"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
+
+# Create the Linux admin user before SSH hardening so that authorized_keys
+# is in place before password auth is disabled.
+if [ -n "${ADMIN_USER:-}" ] && [ -n "${ADMIN_SSH_KEY:-}" ]; then
+    next_step "Linux admin user '${ADMIN_USER}' + SSH key + sudo group"
+    "${SCRIPT_DIR}/setup-linux-admin-user.sh" "$ADMIN_USER" "$ADMIN_SSH_KEY"
+
+    next_step "passwordless sudo for pvesh/qm/pct (${ADMIN_USER})"
+    "${SCRIPT_DIR}/setup-admin-sudo.sh" "$ADMIN_USER"
+else
+    echo
+    echo "WARNING: ADMIN_USER / ADMIN_SSH_KEY not set -- skipping Linux user setup."
+    echo "  Run setup-linux-admin-user.sh and setup-admin-sudo.sh BEFORE disconnecting"
+    echo "  from this session, since the next step disables password authentication."
+fi
+
+next_step "SSH hardening (key-only root login + fail2ban)"
+"${SCRIPT_DIR}/harden-ssh.sh"
+
+next_step "unattended security upgrades"
+"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
+
+next_step "PVE firewall (mgmt-only SSH/8006)"
+MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
+
+next_step "disable subscription nag (cosmetic)"
+"${SCRIPT_DIR}/disable-subscription-nag.sh"
+
+echo
+echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
+if [ -z "${ADMIN_USER:-}" ]; then
+    echo "  - ${SCRIPT_DIR}/setup-linux-admin-user.sh <username> <ssh-pubkey>"
+    echo "  - ${SCRIPT_DIR}/setup-admin-sudo.sh <username>   (NOPASSWD for pvesh/qm/pct)"
+fi
+echo "  - ${SCRIPT_DIR}/create-admin-user.sh <username>   (PVE web UI account)"
+echo "  - Enable 2FA/TOTP for that user and root@pam via the web UI"
+echo "  - ${SCRIPT_DIR}/audit.sh   (verify everything above)"