VPS Bootstrap Script

One-shot provisioning script for a fresh Ubuntu 24.04 VPS with Docker pre-installed. Hardens the OS, locks down SSH to key-only auth, sets up a firewall, and deploys a modular Docker Compose stack for CI and authentication services.

What it does

Services

The stack is modular. Caddy and the Forgejo Runner are always included. The authentication services can be toggled independently.

Network isolation

Prerequisites

• Fresh Ubuntu 24.04 server
• Docker and Docker Compose already installed
• Root or sudo access
• A domain with DNS you control (for automatic TLS)
• SSH public key(s) on your Codeberg profile

Usage

sudo ./bootstrap.sh \
 --username <vps-user> \
 --codeberg-user <codeberg-username> \
 --domain <base-domain> \
 [--ssh-pubkey "<public-key-string>"] \
 [--skip-lldap] \
 [--skip-pocket-id]

Arguments

Examples

Full stack w/ all services:

sudo ./bootstrap.sh \
 --username deploy \
 --codeberg-user myuser \
 --domain example.com

Runner only (no auth services):

sudo ./bootstrap.sh \
 --username deploy \
 --codeberg-user myuser \
 --domain example.com \
 --skip-lldap \
 --skip-pocket-id

Pocket ID but no lldap:

sudo ./bootstrap.sh \
 --username deploy \
 --codeberg-user myuser \
 --domain example.com \
 --skip-lldap

W/ an additional SSH key:

sudo ./bootstrap.sh \
 --username deploy \
 --codeberg-user myuser \
 --domain example.com \
 --ssh-pubkey "ssh-ed25519 AAAA... user@host"

Firewall rules

Generated files

After running, ~/services/ contains:

~/services/
├── docker-compose.yml # Service stack (conditional on flags)
├── Caddyfile # Reverse proxy routes (conditional on flags)
├── .env # Generated secrets — DO NOT COMMIT
├── .env.example # Safe-to-commit template with placeholder values
├── caddy/
│ ├── data/ # TLS certificates (managed by Caddy)
│ └── config/
├── runner/
│ └── data/ # Runner state, config, cache
├── lldap/ # (only if lldap enabled)
│ └── data/
└── pocket-id/ # (only if Pocket ID enabled)
 └── data/

Post-Bootstrap

1. Review secrets in ~/services/.env

2. Point DNS A records to your server IP:

   • auth.<domain> -- Pocket ID (if enabled)
   • ldap.<domain> -- lldap web UI (if enabled)

3. Start the stack:

   cd ~/services && docker compose up -d
   

4. Register the Forgejo Runner (one-time setup):

   # Switch to the sleep command in docker-compose.yml, then:
   docker compose up -d forgejo-runner
   docker exec -it forgejo-runner /bin/sh
   # Inside the container:
   forgejo-runner generate-config > config.yml
   forgejo-runner register \
    --instance https://codeberg.org \
    --token <YOUR_TOKEN> \
    --name <RUNNER_NAME> \
    --labels "docker:docker://node:20-bookworm,ubuntu-latest:docker://ubuntu:24.04"
   exit
   # Switch back to the daemon command, then:
   docker compose up -d forgejo-runner
   

5. Change the lldap admin password (if enabled) — default user is admin, log in at https://ldap.<domain>.

6. Set up Pocket ID (if enabled) — the first user to register at https://auth.<domain> becomes the admin.

7. Verify SSH access before closing your current session:

   ssh <username>@<server-ip>
   

   Password auth is now disabled. If you cannot connect with your key, your current session is still active and you can fix it.

SSH hardening details

The script writes /etc/ssh/sshd_config.d/hardened.conf with:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
X11Forwarding no
MaxAuthTries 3
MaxSessions 5
ClientAliveInterval 300
ClientAliveCountMax 2
AllowAgentForwarding no
AllowTcpForwarding no

The config is validated with sshd -t before sshd is restarted. If validation fails, the hardened config is removed and the script exits.

Design notes

• Docker-in-Docker for the Forgejo Runner avoids exposing the host Docker socket to CI workloads. The runner talks to an isolated DinD sidecar over internal TCP.
• Caddy handles TLS automatically via Let's Encrypt with zero manual cert management.
• lldap maps its internal ports (3890/6360) to standard LDAP ports (389/636) on the host so other servers can authenticate directly.
• The script is idempotent where possible — it checks for an existing user before creating one, and validates sshd config before restarting.
• Secrets are never logged — generated via openssl rand and written directly to .env.