Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path, Ceph as the future HA storage upgrade, and baseline SSH/firewall hardening.
2026-07-20 11:45:54 +10:00
commit a854412117
10 changed files with 414 additions and 0 deletions
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Apply baseline SSH hardening to a Proxmox VE node: key-only root login
+# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
+set -euo pipefail
+
+DROPIN_DIR="/etc/ssh/sshd_config.d"
+DROPIN_FILE="${DROPIN_DIR}/99-hardening.conf"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Must run as root." >&2
+    exit 1
+fi
+
+mkdir -p "$DROPIN_DIR"
+cat > "$DROPIN_FILE" <<'EOF'
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+EOF
+echo "Wrote $DROPIN_FILE"
+
+if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
+    authorized_keys_present=""
+fi
+if [ -z "$authorized_keys_present" ]; then
+    echo "WARNING: no authorized_keys found for any user yet." >&2
+    echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
+fi
+
+sshd -t
+systemctl reload sshd
+echo "sshd reloaded with key-only root login."
+
+if ! dpkg -s fail2ban >/dev/null 2>&1; then
+    apt-get update
+    apt-get install -y fail2ban
+fi
+
+mkdir -p /etc/fail2ban/jail.d
+cat > /etc/fail2ban/jail.d/sshd.local <<'EOF'
+[sshd]
+enabled = true
+port = ssh
+backend = systemd
+maxretry = 5
+bantime = 1h
+findtime = 10m
+EOF
+
+systemctl enable --now fail2ban
+systemctl restart fail2ban
+echo "fail2ban enabled for sshd."
@@ -0,0 +1,33 @@
+#!/bin/bash
+# Switch a fresh Proxmox VE install from the enterprise repo (which fails
+# on apt update without a paid subscription) to the no-subscription repo.
+# Idempotent - safe to re-run. Run as root on the PVE host.
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Must run as root." >&2
+    exit 1
+fi
+
+CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
+
+ENTERPRISE_LIST="/etc/apt/sources.list.d/pve-enterprise.list"
+if [ -f "$ENTERPRISE_LIST" ]; then
+    sed -i 's/^deb/#deb/' "$ENTERPRISE_LIST"
+    echo "Disabled $ENTERPRISE_LIST"
+fi
+
+CEPH_ENTERPRISE_LIST="/etc/apt/sources.list.d/ceph.list"
+if [ -f "$CEPH_ENTERPRISE_LIST" ] && grep -q enterprise "$CEPH_ENTERPRISE_LIST" 2>/dev/null; then
+    sed -i 's/^deb/#deb/' "$CEPH_ENTERPRISE_LIST"
+    echo "Disabled $CEPH_ENTERPRISE_LIST"
+fi
+
+NOSUB_LIST="/etc/apt/sources.list.d/pve-no-subscription.list"
+cat > "$NOSUB_LIST" <<EOF
+deb http://download.proxmox.com/debian/pve ${CODENAME} pve-no-subscription
+EOF
+echo "Wrote $NOSUB_LIST for codename '${CODENAME}'."
+
+apt-get update
+echo "Repo switched. Review 'apt list --upgradable' before upgrading."