Stage 1: base Proxmox config/hardening toolset #1

2026-07-21T08:52:05Z

beatzaplenty commented

2026-07-21 08:52:05 +00:00

Summary

Stage 1 base config/hardening toolset for any Proxmox VE host (independent of the future HA/Ceph cluster, deferred as Stage 2)
Idempotent scripts under scripts/ (shared helpers in scripts/lib/common.sh): remove enterprise apt repos and switch to no-subscription, SSH key-only hardening + fail2ban, unattended security-only upgrades (no auto-reboot), PVE firewall (mgmt-only SSH/8006, default-deny), subscription-nag popup suppression (persisted via an apt hook), named PVE admin user creation
scripts/bootstrap.sh runs the full sequence end-to-end; scripts/audit.sh verifies it read-only
Docs (docs/00-overview.md etc.) restructured around Stage 1 (active, current pve1 hardware) vs Stage 2 (future dedicated cluster/Ceph hardware)
Already applied to and verified on pve1 (all audit.sh checks passing)

Test plan

scripts/audit.sh run on pve1, all checks pass
Enterprise apt sources removed, no-subscription repo active, apt-get update succeeds
SSH key-only root login + fail2ban confirmed active
PVE firewall enabled with default-deny + mgmt-only allow rules, verified reachable from mgmt CIDR
Subscription nag popup suppressed, confirmed to survive a package upgrade via the apt Post-Invoke hook
Enable 2FA/TOTP for wayne@pve and root@pam via the web UI (manual, not scriptable)

## Summary - Stage 1 base config/hardening toolset for any Proxmox VE host (independent of the future HA/Ceph cluster, deferred as Stage 2) - Idempotent scripts under `scripts/` (shared helpers in `scripts/lib/common.sh`): remove enterprise apt repos and switch to no-subscription, SSH key-only hardening + fail2ban, unattended security-only upgrades (no auto-reboot), PVE firewall (mgmt-only SSH/8006, default-deny), subscription-nag popup suppression (persisted via an apt hook), named PVE admin user creation - `scripts/bootstrap.sh` runs the full sequence end-to-end; `scripts/audit.sh` verifies it read-only - Docs (`docs/00-overview.md` etc.) restructured around Stage 1 (active, current pve1 hardware) vs Stage 2 (future dedicated cluster/Ceph hardware) - Already applied to and verified on `pve1` (all `audit.sh` checks passing) ## Test plan - [x] `scripts/audit.sh` run on `pve1`, all checks pass - [x] Enterprise apt sources removed, no-subscription repo active, `apt-get update` succeeds - [x] SSH key-only root login + fail2ban confirmed active - [x] PVE firewall enabled with default-deny + mgmt-only allow rules, verified reachable from mgmt CIDR - [x] Subscription nag popup suppressed, confirmed to survive a package upgrade via the apt Post-Invoke hook - [ ] Enable 2FA/TOTP for `wayne@pve` and `root@pam` via the web UI (manual, not scriptable)

beatzaplenty added 1 commit 2026-07-21 08:52:05 +00:00

Stage 1 base config/hardening toolset, applied and verified on pve1 2cca6a7dc0

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.

beatzaplenty marked the pull request as work in progress 2026-07-21 08:52:58 +00:00

beatzaplenty marked the pull request as ready for review 2026-07-21 08:53:25 +00:00

beatzaplenty merged commit 8c5b76cb15 into main

2026-07-21 08:53:29 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/debian-configuration#1