root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.9.7: Caddy + CrowdSec modules; category menu with required-gate

Browse Source 
- services/caddy.sh (homelab): reverse proxy + auto HTTPS, own ~/docker/caddy
  folder (compose + starter Caddyfile + README).
- services/crowdsec.sh (homelab): system-level IPS (agent + firewall bouncer +
  Caddy acquisition + optional ntfy alerts), README in ~/docker/crowdsec.
- setup.sh guided flow redesign:
  * Prints REQUIRED set (essentials + glow + docker check) with a cancel option.
  * Offers Caddy first (most services proxy through it).
  * Category menu LOOP: pick category -> checklist ([installed] marked) ->
    install -> back to menu, until Done. whiptail + text fallback.
- Categories reorganized: base/homelab/utilities/media/cameras/gaming/backup;
  moved ntfy/filebrowser/portainer/uptimekuma/watchtower to utilities;
  caddy->crowdsec->authelia ordered first in homelab.

Verified: bash -n all; --list groups by category with caddy first; cancel path
prints 'Cancelled, nothing changed'; dry-run guided flow runs required + loops
menu; run-one still works.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK
This commit is contained in:
Claude
2026-06-03 17:16:32 +00:00
parent 4a37b3622d
commit 9dc8c4063d
11 changed files with 624 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+22
View File
@@ -4,6 +4,28 @@ All notable changes to this project. Versions follow `MAJOR.MINOR.PATCH`.
The project is pre-1.0 while the modular system reaches parity with the
monolithic `ubuntu-post-install-*.sh` scripts.
## [0.9.7] - 2026-06-03
### Added
- `services/caddy.sh` *(homelab)* — Caddy reverse proxy + automatic HTTPS, own
`~/docker/caddy/` folder (compose + starter Caddyfile + README). Services add
their site blocks to its Caddyfile.
- `services/crowdsec.sh` *(homelab)* — system-level intrusion prevention
(agent + firewall bouncer + Caddy log acquisition + optional ntfy ban alerts);
README in `~/docker/crowdsec/`.
- **Guided menu redesign** in `setup.sh`:
- Prints the **required** set (essential packages incl. glow + a Docker check)
up front and lets you **cancel** before anything changes.
- Offers **Caddy first** (most services depend on it).
- **Category menu loop**: pick a category → checklist (already-installed shown
as `[installed]`) → install → back to the menu for the next category, until
you choose Done. whiptail UI with a plain-text fallback.
### Changed
- **Categories** reorganized: `base · homelab · utilities · media · cameras ·
gaming · backup`. Moved ntfy, filebrowser, portainer, uptimekuma, watchtower
to `utilities`. Within `homelab`, Caddy → CrowdSec → Authelia sort first.
## [0.9.6] - 2026-06-03
### Added
MODULAR.md
+7 -4
View File
@@ -72,10 +72,13 @@ single shared compose file.
## Groups
`base` · `homelab` · `gaming` · `backup`. The menu and `--list` are grouped by
these. The **gaming** group (Wolf, js99er, Minecraft) makes this script a
sensible base for either a homelab box or a gaming box — install only what that
machine needs.
`base` · `homelab` · `utilities` · `media` · `cameras` · `gaming` · `backup`.
The guided menu (`sudo ./setup.sh`) shows the **required** packages first with a
cancel option, then offers **Caddy** (most services proxy through it), then a
**category menu you loop through** — pick a category, tick services (already
installed ones are marked `[installed]`), install, and you land back on the menu
to pick the next category. Within `homelab`, Caddy → CrowdSec → Authelia are
ordered first.
## Migration status
VERSION
+1 -1
View File
@@ -1 +1 @@
0.9.6
0.9.7
services/caddy.sh
+218
View File
@@ -0,0 +1,218 @@
#!/bin/bash
# services/caddy.sh — Caddy reverse proxy + automatic HTTPS.
# Part of the modular post-install system (sourced by setup.sh).
#
# Caddy is the front door for the homelab: it terminates TLS (automatic
# Let's Encrypt certificates), reverse-proxies to your other services, and
# writes JSON access logs that CrowdSec reads for intrusion prevention.
#
# Each web service adds its own site block to $CADDY_DIR/Caddyfile (the shared
# configure_caddy_for_service helper does this automatically), then Caddy is
# reloaded without downtime.
register_service caddy homelab "Reverse proxy + automatic HTTPS (Caddy)" 443
install_caddy() {
require_docker || return 1
log_info "Installing Caddy reverse proxy..."
local CADDY_DIR="$DOCKER_DIR/caddy"
echo ""
echo "┌─────────────────────────────────────────────────────────────────┐"
echo "│ CADDY - Modern Web Server & Reverse Proxy │"
echo "│ Automatic HTTPS, reverse proxy for all your services │"
echo "│ Port: 80 (HTTP), 443 (HTTPS) │"
echo "└─────────────────────────────────────────────────────────────────┘"
echo ""
# ── DRY-RUN: describe the plan and bail before touching anything real ────
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $CADDY_DIR (data/, config/)"
echo "[DRY-RUN] Would write $CADDY_DIR/docker-compose.yml (ports 80/443 + HTTP/3)"
echo "[DRY-RUN] Would write a starter $CADDY_DIR/Caddyfile (if none exists)"
echo "[DRY-RUN] Would write $CADDY_DIR/README.md"
echo "[DRY-RUN] Would optionally start Caddy (docker compose up -d)"
return 0
fi
# Reconfigure guard: warn if Caddy already looks installed.
if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then
echo ""
echo "⚠ Caddy appears to be already installed at $CADDY_DIR"
local RECONFIGURE_CADDY=""
prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY
if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then
echo " Skipping Caddy installation"
return 0
fi
fi
mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config"
ensure_docker_dir_ownership "$CADDY_DIR"
# Backup existing Caddyfile if it exists
if [ -f "$CADDY_DIR/Caddyfile" ]; then
mkdir -p "$CADDY_DIR/backups"
local BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)"
cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE"
echo " ✓ Backed up existing Caddyfile to: $BACKUP_FILE"
fi
cd "$CADDY_DIR" || return 1
cat > docker-compose.yml << 'CADDY_COMPOSE'
name: caddy
services:
caddy:
image: caddy:latest
container_name: caddy
restart: unless-stopped
ports:
- "80:80"
- "443:443"
- "443:443/udp" # HTTP/3
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile
- ./data:/data
- ./config:/config
- /var/log/caddy:/var/log/caddy
environment:
- ACME_AGREE=true
labels:
- "io.podman.annotations.label/crowdsec.enable=true"
CADDY_COMPOSE
# Create Caddyfile if it doesn't exist
if [ ! -f "Caddyfile" ]; then
cat > Caddyfile << 'CADDYFILE'
{
# Global options
admin off
# Email for Let's Encrypt notifications
# email admin@yourdomain.com
}
# Example configuration - edit this for your services
# Uncomment and modify these examples:
# ── Authelia SSO snippet (auto-added by installer if Authelia is installed) ───
# (authelia) {
# forward_auth authelia:9091 {
# uri /api/authz/forward-auth
# copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
# }
# }
#
# Authelia login portal
# auth.yourdomain.com {
# reverse_proxy authelia:9091
# }
#
# To protect any service with Authelia, add: import authelia
# Example:
# myservice.yourdomain.com {
# import authelia
# reverse_proxy localhost:PORT
# }
# ActualBudget
# budget.yourdomain.com {
# log {
# output file /var/log/caddy/actualbudget-access.log
# format json
# level INFO
# }
# reverse_proxy localhost:5006
# header {
# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# X-Frame-Options "SAMEORIGIN"
# X-Content-Type-Options "nosniff"
# X-XSS-Protection "1; mode=block"
# Referrer-Policy "strict-origin-when-cross-origin"
# }
# }
# Add more services here...
CADDYFILE
echo " ✓ Created example Caddyfile"
else
echo " ℹ Using existing Caddyfile"
fi
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$CADDY_DIR"
echo " ✓ Caddy configured at $CADDY_DIR"
write_readme "$CADDY_DIR" << 'CADDY_README'
# Caddy — reverse proxy + automatic HTTPS
Caddy is the front door for this box. It:
- Reverse-proxies incoming requests to your other services.
- Obtains and renews TLS certificates automatically (Let's Encrypt / ZeroSSL),
so every site is HTTPS with no manual cert wrangling.
- Listens on **80** (HTTP, redirects to HTTPS) and **443** (HTTPS, incl. HTTP/3
on 443/udp).
- Writes JSON access logs to `/var/log/caddy/` — these are what CrowdSec reads
to detect and ban malicious traffic.
## Adding services
Other services add their own **site blocks** to `./Caddyfile` (the installer's
`configure_caddy_for_service` helper appends them automatically when you install
a web service). You can also edit it by hand:
```
myservice.example.com {
reverse_proxy localhost:1234
log {
output file /var/log/caddy/myservice.example.com.log
format json
}
}
```
## Reloading after edits
Apply Caddyfile changes without downtime:
```
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
```
## Start / stop
From this folder (`~/docker/caddy`):
```
docker compose up -d # start
docker compose down # stop
docker compose logs -f # follow logs
```
## Where things live
- Caddyfile: `~/docker/caddy/Caddyfile` (mounted at `/etc/caddy/Caddyfile`)
- Access logs: `/var/log/caddy/*.log` (JSON; consumed by CrowdSec)
- Certs/state: `~/docker/caddy/data` and `~/docker/caddy/config`
- Backups of the Caddyfile: `~/docker/caddy/backups/`
CADDY_README
local START_CADDY=""
prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY
if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then
docker compose up -d 2>/dev/null && echo " ✓ Caddy started" || echo " ⚠ Failed to start Caddy"
fi
echo ""
echo " Configuration file: $CADDY_DIR/Caddyfile"
echo " Edit Caddyfile to add your domains and services"
echo " Reload config: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
echo ""
echo " ⚠ IMPORTANT: Edit the Caddyfile to configure your domains!"
echo " - Uncomment and modify the example configurations"
echo " - Add your domain names"
echo " - Configure services you want to expose"
echo ""
}
services/crowdsec.sh
+221
View File
@@ -0,0 +1,221 @@
#!/bin/bash
# services/crowdsec.sh — CrowdSec intrusion prevention (fail2ban successor).
# Part of the modular post-install system (sourced by setup.sh).
#
# CrowdSec is a SYSTEM install (apt repo + agent), NOT a docker-compose service:
# • Installs the CrowdSec agent and the iptables firewall bouncer (enforces bans).
# • Installs detection collections for SSH, Linux, Caddy and base HTTP scenarios.
# • Reads Caddy's JSON access logs (/var/log/caddy/*.log) to spot attacks.
# • Optionally pushes ban alerts to an ntfy topic.
# • Adds community IP reputation + optional geo-enrichment on top.
#
# There is no ~/docker/crowdsec compose; we only create a docs-only folder there
# with a README pointing at the real config under /etc/crowdsec.
register_service crowdsec homelab "Intrusion prevention: bans + geo + IP reputation (CrowdSec)"
install_crowdsec() {
log_info "Installing CrowdSec intrusion prevention..."
local DOCS_DIR="$DOCKER_DIR/crowdsec"
echo ""
echo "┌─────────────────────────────────────────────────────────────────┐"
echo "│ CROWDSEC - Intrusion Prevention (fail2ban successor) │"
echo "│ Bans malicious IPs + geo-blocking + community IP reputation │"
echo "│ Protects SSH, Caddy, and other services │"
echo "└─────────────────────────────────────────────────────────────────┘"
echo ""
# ── DRY-RUN: describe the plan and bail before touching anything real ────
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would install the CrowdSec agent (curl https://install.crowdsec.net | sh; apt install crowdsec)"
echo "[DRY-RUN] Would install the firewall bouncer (crowdsec-firewall-bouncer-iptables)"
echo "[DRY-RUN] Would ensure /var/log/caddy exists for log acquisition"
echo "[DRY-RUN] Would install collections: sshd, linux, caddy, base-http-scenarios"
echo "[DRY-RUN] Would write Caddy acquisition /etc/crowdsec/acquis.d/caddy.yaml"
echo "[DRY-RUN] Would optionally wire ntfy ban alerts into the default profile"
echo "[DRY-RUN] Would enable + restart crowdsec and crowdsec-firewall-bouncer"
echo "[DRY-RUN] Would write $DOCS_DIR/README.md (docs-only folder)"
return 0
fi
# ── 1. Install the CrowdSec agent ────────────────────────────────────────
if command -v cscli &> /dev/null; then
echo " ✓ CrowdSec is already installed"
else
echo " Adding CrowdSec repository and installing agent..."
if curl -s https://install.crowdsec.net | sudo sh && sudo apt install -y crowdsec; then
echo " ✓ CrowdSec installed successfully"
else
echo " ⚠ Failed to install CrowdSec"
echo " See https://docs.crowdsec.net/ for manual installation"
fi
fi
# ── 2. Firewall bouncer (enforces bans via iptables/nftables) ────────────
echo " Installing firewall bouncer..."
sudo apt install -y crowdsec-firewall-bouncer-iptables 2>/dev/null || \
echo " ⚠ Could not install firewall bouncer automatically"
# ── 3. Create log directory for Caddy ────────────────────────────────────
if [ ! -d "/var/log/caddy" ]; then
sudo mkdir -p /var/log/caddy
sudo chmod 755 /var/log/caddy
echo " ✓ Created /var/log/caddy directory"
fi
# ── 4. Detection collections: SSH, Caddy HTTP scenarios, base http ───────
echo " Installing CrowdSec collections (sshd, caddy, base-http)..."
sudo cscli collections install crowdsecurity/sshd crowdsecurity/linux crowdsecurity/caddy crowdsecurity/base-http-scenarios 2>/dev/null || \
echo " ⚠ Some collections may already be installed"
# ── 5. Tell CrowdSec to read Caddy's JSON access logs ────────────────────
local ACQUIS_FILE="/etc/crowdsec/acquis.d/caddy.yaml"
if [ ! -f "$ACQUIS_FILE" ]; then
echo " Creating Caddy log acquisition for CrowdSec..."
sudo mkdir -p /etc/crowdsec/acquis.d
local ACQUIS_CONTENT='filenames:
- /var/log/caddy/*.log
- /var/log/caddy/*-access.log
labels:
type: caddy'
if echo "$ACQUIS_CONTENT" | sudo tee "$ACQUIS_FILE" > /dev/null; then
echo " ✓ Created Caddy acquisition ($ACQUIS_FILE)"
else
echo " ⚠ Failed to create acquisition - create it manually"
fi
else
echo " ✓ Caddy acquisition already exists"
fi
# ── 6. Geo-blocking + reputation (the capability fail2ban/Authelia lack) ─
echo ""
echo " Geo-blocking & IP reputation (optional):"
echo " Enrich events with country/ASN data:"
echo " sudo cscli collections install crowdsecurity/geoip-enrich"
echo " Subscribe to community/3rd-party blocklists at:"
echo " https://app.crowdsec.net/"
# ── 7. Optional: push ban alerts to ntfy ─────────────────────────────────
local CS_NTFY=""
prompt_yn "Send CrowdSec ban alerts to an ntfy topic? (y/n):" "n" CS_NTFY
if [ "$CS_NTFY" = "y" ] || [ "$CS_NTFY" = "Y" ]; then
local CS_NTFY_URL=""
prompt_text " ntfy topic URL (e.g. https://ntfy.sh/my-crowdsec):" "https://ntfy.sh/crowdsec-alerts" CS_NTFY_URL
sudo mkdir -p /etc/crowdsec/notifications
local NTFY_FILE="/etc/crowdsec/notifications/ntfy.yaml"
local NTFY_CONTENT="type: http
name: ntfy
log_level: info
format: |
{{range . -}}
{{range .Decisions -}}
{{.Value}} banned: {{.Scenario}} for {{.Duration}}
{{end -}}
{{end -}}
url: $CS_NTFY_URL
method: POST
headers:
Title: CrowdSec ban
Priority: high
Tags: rotating_light"
if echo "$NTFY_CONTENT" | sudo tee "$NTFY_FILE" > /dev/null; then
echo " ✓ Created ntfy notification ($NTFY_FILE)"
# Wire the notification into the default profile (only once)
if ! grep -qE "^\s*- ntfy" /etc/crowdsec/profiles.yaml 2>/dev/null; then
sudo awk '1; /^on_success:/ && !d {print "notifications:"; print " - ntfy"; d=1}' \
/etc/crowdsec/profiles.yaml | sudo tee /etc/crowdsec/profiles.yaml.new > /dev/null \
&& sudo mv /etc/crowdsec/profiles.yaml.new /etc/crowdsec/profiles.yaml
echo " ✓ Enabled ntfy alerts in CrowdSec default profile"
else
echo " ✓ ntfy already referenced in CrowdSec profile"
fi
echo " ℹ Alerts fire when an IP is banned (after repeated failed attempts),"
echo " not on every individual failed login."
else
echo " ⚠ Failed to write ntfy notification config"
fi
fi
# ── 8. Restart services to apply ─────────────────────────────────────────
local RESTART_CS=""
prompt_yn "Restart CrowdSec to apply changes? (y/n):" "y" RESTART_CS
if [ "$RESTART_CS" = "y" ] || [ "$RESTART_CS" = "Y" ]; then
sudo systemctl enable crowdsec 2>/dev/null || true
if sudo systemctl restart crowdsec; then
echo " ✓ CrowdSec restarted successfully"
sudo systemctl enable crowdsec-firewall-bouncer 2>/dev/null || true
sudo systemctl restart crowdsec-firewall-bouncer 2>/dev/null || true
sleep 2
sudo cscli metrics 2>/dev/null | head -20 || true
else
echo " ⚠ Failed to restart CrowdSec"
echo " Check logs: sudo journalctl -u crowdsec -n 50"
fi
fi
# ── 9. Docs-only folder under ~/docker for discoverability ───────────────
write_readme "$DOCS_DIR" << 'CROWDSEC_README'
# CrowdSec — intrusion prevention
CrowdSec is a **system service** (installed via apt), not a Docker container, so
there is no `docker-compose.yml` in this folder — it exists only to document the
install. The real configuration lives under `/etc/crowdsec`.
## What it does
- Detects malicious behaviour (SSH brute force, web scans, etc.) by parsing logs.
- Bans offending IPs via the **firewall bouncer** (iptables/nftables).
- Pulls **community IP reputation** blocklists so known-bad IPs are blocked
before they ever touch your services.
- Optionally enriches events with **geo/ASN** data for geo-blocking.
## Key commands
```
sudo cscli metrics # parsers/scenarios/acquisition health
sudo cscli decisions list # currently banned IPs
sudo cscli decisions delete --ip <IP> # unban an IP
sudo cscli decisions add --ip <IP> # manually ban an IP
sudo cscli alerts list # recent alerts
sudo cscli collections list # installed detection collections
```
## Where configs live
- Log acquisition (what to watch): `/etc/crowdsec/acquis.d/`
- Caddy access logs: `/etc/crowdsec/acquis.d/caddy.yaml`
(`/var/log/caddy/*.log` — Caddy writes JSON access logs there)
- Notifications: `/etc/crowdsec/notifications/`
- ntfy ban alerts (if enabled): `/etc/crowdsec/notifications/ntfy.yaml`,
wired into `/etc/crowdsec/profiles.yaml`
- Bouncer config: `/etc/crowdsec/bouncers/`
## Geo + reputation notes
- Geo-enrichment (country/ASN tagging) is optional:
`sudo cscli collections install crowdsecurity/geoip-enrich`
- Subscribe to community / 3rd-party blocklists at https://app.crowdsec.net/
- ntfy alerts fire when an IP is **banned** (after repeated failed attempts),
not on every individual failed login.
## Service control
```
sudo systemctl status crowdsec
sudo systemctl restart crowdsec
sudo systemctl status crowdsec-firewall-bouncer
sudo journalctl -u crowdsec -n 50
```
CROWDSEC_README
echo ""
echo " Useful commands:"
echo " List active bans: sudo cscli decisions list"
echo " List alerts: sudo cscli alerts list"
echo " Manually ban IP: sudo cscli decisions add --ip 1.2.3.4"
echo " Unban IP: sudo cscli decisions delete --ip 1.2.3.4"
echo " Show metrics: sudo cscli metrics"
echo ""
}
services/filebrowser.sh
+1 -1
View File
@@ -2,7 +2,7 @@
# services/filebrowser.sh — FileBrowser web-based file manager.
# Part of the modular post-install system (sourced by setup.sh).
register_service filebrowser homelab "Web file manager (FileBrowser)" 8085
register_service filebrowser utilities "Web file manager (FileBrowser)" 8085
install_filebrowser() {
require_docker || return 1
services/ntfy.sh
+1 -1
View File
@@ -2,7 +2,7 @@
# services/ntfy.sh — ntfy self-hosted push notification server.
# Part of the modular post-install system (sourced by setup.sh).
register_service ntfy homelab "Self-hosted push notifications (ntfy)" 8090
register_service ntfy utilities "Self-hosted push notifications (ntfy)" 8090
install_ntfy() {
require_docker || return 1
services/portainer.sh
+1 -1
View File
@@ -2,7 +2,7 @@
# services/portainer.sh — Portainer Docker management web UI.
# Part of the modular post-install system (sourced by setup.sh).
register_service portainer homelab "Docker management UI (Portainer)" 9443
register_service portainer utilities "Docker management UI (Portainer)" 9443
install_portainer() {
require_docker || return 1
services/uptimekuma.sh
+1 -1
View File
@@ -2,7 +2,7 @@
# services/uptimekuma.sh — Uptime Kuma uptime/status monitoring.
# Part of the modular post-install system (sourced by setup.sh).
register_service uptimekuma homelab "Uptime/status monitoring (Uptime Kuma)" 3001
register_service uptimekuma utilities "Uptime/status monitoring (Uptime Kuma)" 3001
install_uptimekuma() {
require_docker || return 1
services/watchtower.sh
+1 -1
View File
@@ -2,7 +2,7 @@
# services/watchtower.sh — Watchtower automatic container update monitoring.
# Part of the modular post-install system (sourced by setup.sh).
register_service watchtower homelab "Automatic container updates (Watchtower)"
register_service watchtower utilities "Automatic container updates (Watchtower)"
install_watchtower() {
require_docker || return 1
setup.sh
+150 -72
View File
@@ -1,26 +1,31 @@
#!/bin/bash
# setup.sh — modular post-install dispatcher.
#
# One source of truth, two ways to run it:
# sudo ./setup.sh interactive menu (pick any services)
# One source of truth, multiple ways to run it:
# sudo ./setup.sh guided install: required packages, then a
# category menu you loop through
# sudo ./setup.sh <service> ... install one or more services directly
# ./setup.sh --list list available services (grouped)
# ./setup.sh --version print version
#
# Flags:
# --dry-run preview actions without making changes
# --unattended use defaults, no prompts
# --unattended use defaults, no prompts (pair with explicit service names)
#
# Every service lives in services/<name>.sh, registers itself, and defines
# install_<name>. Adding a service = adding one file. Updating a service =
# editing one file. Nothing is duplicated or generated.
# Every service lives in services/<name>.sh, registers itself with
# register_service, and defines install_<name>. Adding a service = adding one
# file; it appears in the menu automatically. Nothing is generated.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# ── Parse global flags, collect service names ────────────────────────────────
DRY_RUN=false
UNATTENDED=false
DO_LIST=false
# Category display order (groups not listed here are appended alphabetically).
CATEGORY_ORDER=(base homelab utilities media cameras gaming backup)
# Service ordering hint within a category (lower = earlier). Default 50.
declare -A SERVICE_PRIORITY=( [caddy]=1 [crowdsec]=2 [authelia]=3 )
# ── Parse flags / collect service names ──────────────────────────────────────
DRY_RUN=false; UNATTENDED=false; DO_LIST=false
REQUESTED=()
for arg in "$@"; do
case "$arg" in
@@ -28,9 +33,7 @@ for arg in "$@"; do
--unattended) UNATTENDED=true ;;
--list|-l) DO_LIST=true ;;
--version|-V) cat "$HERE/VERSION" 2>/dev/null || echo "unknown"; exit 0 ;;
-h|--help)
sed -n '2,18p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
exit 0 ;;
-h|--help) sed -n '2,18p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
-*) echo "Unknown flag: $arg" >&2; exit 1 ;;
*) REQUESTED+=("$arg") ;;
esac
@@ -40,90 +43,165 @@ export DRY_RUN UNATTENDED
# ── Load helpers + all service modules (they self-register) ──────────────────
# shellcheck source=lib/common.sh
source "$HERE/lib/common.sh"
shopt -s nullglob
for _mod in "$HERE"/services/*.sh; do
# shellcheck source=/dev/null
source "$_mod"
done
for _mod in "$HERE"/services/*.sh; do source "$_mod"; done
shopt -u nullglob
# Ordered list of unique groups, in first-seen order.
groups_in_order() {
local seen=" " g
# ── Helpers over the registry ────────────────────────────────────────────────
# Groups present, in CATEGORY_ORDER first, then any extras alphabetically.
groups_present() {
local g present=() seen=" "
for name in "${SERVICE_ORDER[@]}"; do
g="${SERVICE_GROUP[$name]}"
case "$seen" in *" $g "*) : ;; *) echo "$g"; seen="$seen$g " ;; esac
case "$seen" in *" $g "*) : ;; *) present+=("$g"); seen="$seen$g " ;; esac
done
local out=()
for g in "${CATEGORY_ORDER[@]}"; do
printf '%s\n' "${present[@]}" | grep -qx "$g" && out+=("$g")
done
for g in "${present[@]}"; do
printf '%s\n' "${CATEGORY_ORDER[@]}" | grep -qx "$g" || out+=("$g")
done
printf '%s\n' "${out[@]}"
}
# Services in a group, ordered by SERVICE_PRIORITY then name.
services_in_group() {
local group="$1" name
for name in "${SERVICE_ORDER[@]}"; do
[ "${SERVICE_GROUP[$name]}" = "$group" ] && echo "${SERVICE_PRIORITY[$name]:-50} $name"
done | sort -n -k1 | awk '{print $2}'
}
# Best-effort "is it already installed?" for the [installed] marker.
is_installed() {
case "$1" in
base) command -v ncdu >/dev/null 2>&1 ;;
glow) command -v glow >/dev/null 2>&1 ;;
crowdsec) command -v cscli >/dev/null 2>&1 ;;
*) [ -e "$DOCKER_DIR/$1" ] ;;
esac
}
run_service() {
local name="$1"
if [ -z "${SERVICE_GROUP[$name]:-}" ]; then log_error "Unknown service: $name (try --list)"; return 1; fi
declare -F "install_${name}" >/dev/null || { log_error "Service '$name' has no install_${name}"; return 1; }
log_info "=== ${name} (${SERVICE_DESC[$name]}) ==="
"install_${name}"
}
list_services() {
local g name
while IFS= read -r g; do
echo ""
echo "── ${g^^} ──"
for name in "${SERVICE_ORDER[@]}"; do
[ "${SERVICE_GROUP[$name]}" = "$g" ] || continue
echo ""; echo "── ${g^^} ──"
while IFS= read -r name; do
printf " %-16s %s\n" "$name" "${SERVICE_DESC[$name]}"
done
done < <(groups_in_order)
done < <(services_in_group "$g")
done < <(groups_present)
echo ""
}
run_service() {
local name="$1"
if [ -z "${SERVICE_GROUP[$name]:-}" ]; then
log_error "Unknown service: $name (try: $0 --list)"
return 1
fi
if ! declare -F "install_${name}" >/dev/null; then
log_error "Service '$name' has no install_${name} function."
return 1
fi
log_info "=== ${name} (${SERVICE_DESC[$name]}) ==="
"install_${name}"
}
# ── --list ───────────────────────────────────────────────────────────────────
if [ "$DO_LIST" = true ]; then
list_services
exit 0
fi
if [ "$DO_LIST" = true ]; then list_services; exit 0; fi
# ── Direct service install: ./setup.sh minecraft homeassistant ─────────────
# ── Direct install: ./setup.sh caddy homeassistant ──────────────────────────
if [ "${#REQUESTED[@]}" -gt 0 ]; then
require_root
rc=0
for name in "${REQUESTED[@]}"; do
run_service "$name" || rc=1
done
rc=0; for name in "${REQUESTED[@]}"; do run_service "$name" || rc=1; done
exit "$rc"
fi
# ── Interactive menu ─────────────────────────────────────────────────────────
# ── Guided interactive flow ──────────────────────────────────────────────────
require_root
SELECTED=()
if command -v whiptail >/dev/null 2>&1; then
_items=()
for name in "${SERVICE_ORDER[@]}"; do
_items+=("$name" "${SERVICE_DESC[$name]}" "OFF")
done
_choice=$(whiptail --title "Ubuntu Post-Install — Services" \
--checklist "Select services to install (space to toggle):" 25 78 16 \
"${_items[@]}" 3>&1 1>&2 2>&3) || { echo "Cancelled."; exit 0; }
# whiptail returns space-separated, quoted names
eval "SELECTED=($_choice)"
else
echo "Available services:"
list_services
read -rp "Enter service names to install (space-separated): " -a SELECTED
# 1) Show the REQUIRED set and let the user cancel before anything happens.
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ Ubuntu Post-Install · v$(cat "$HERE/VERSION" 2>/dev/null || echo '?')"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo "REQUIRED (installed/verified first):"
echo " • Essential CLI packages: net-tools, git, curl, wget, htop, tree,"
echo " ncdu, zip/unzip, jq, rsync, and glow (markdown reader)"
echo " • Docker presence check (needed by all containerized services)"
echo ""
echo "Then you'll get a category menu to pick optional services."
echo ""
PROCEED=""
prompt_yn "Proceed with the required setup? (y/n):" "y" PROCEED
if [ "$PROCEED" != "y" ] && [ "$PROCEED" != "Y" ]; then
echo "Cancelled. Nothing was changed."
exit 0
fi
[ "${#SELECTED[@]}" -eq 0 ] && { echo "Nothing selected."; exit 0; }
# 2) Run required.
run_service base
if ! command -v docker >/dev/null 2>&1; then
log_warning "Docker is not installed. Containerized services need it."
echo " Install with: curl -fsSL https://get.docker.com | sh"
fi
rc=0
for name in "${SELECTED[@]}"; do
run_service "$name" || rc=1
# 3) Offer Caddy first (most services proxy through it).
if [ -n "${SERVICE_GROUP[caddy]:-}" ] && ! is_installed caddy; then
echo ""
OFFER_CADDY=""
prompt_yn "Install Caddy now? It's the reverse proxy most services use. (y/n):" "y" OFFER_CADDY
[ "$OFFER_CADDY" = "y" ] || [ "$OFFER_CADDY" = "Y" ] && run_service caddy
fi
# 4) Category menu loop: pick a category → checklist → install → back to menu.
have_whiptail=false
command -v whiptail >/dev/null 2>&1 && have_whiptail=true
while true; do
mapfile -t CATS < <(groups_present)
if [ "$have_whiptail" = true ]; then
cat_items=()
for g in "${CATS[@]}"; do
n=$(services_in_group "$g" | wc -l)
cat_items+=("$g" "$n service(s)")
done
cat_items+=("DONE" "Finish and exit")
CHOSEN_CAT=$(whiptail --title "Service Categories" --menu \
"Pick a category (services you install come back here):" 22 70 14 \
"${cat_items[@]}" 3>&1 1>&2 2>&3) || break
else
echo ""; echo "Categories:"; i=1
for g in "${CATS[@]}"; do echo " $i) $g"; i=$((i+1)); done
echo " d) Done"
read -rp "Pick a category [d]: " pick
[ "$pick" = "d" ] || [ -z "$pick" ] && break
CHOSEN_CAT="${CATS[$((pick-1))]:-}"
[ -z "$CHOSEN_CAT" ] && { echo "Invalid."; continue; }
fi
[ "$CHOSEN_CAT" = "DONE" ] && break
mapfile -t SVCS < <(services_in_group "$CHOSEN_CAT")
SELECTED=()
if [ "$have_whiptail" = true ]; then
svc_items=()
for name in "${SVCS[@]}"; do
tag="${SERVICE_DESC[$name]}"
is_installed "$name" && tag="$tag [installed]"
svc_items+=("$name" "$tag" "OFF")
done
CHOICE=$(whiptail --title "${CHOSEN_CAT^^}" --checklist \
"Space to select, Enter to install. Already-installed are marked:" 22 78 14 \
"${svc_items[@]}" 3>&1 1>&2 2>&3) || continue
eval "SELECTED=($CHOICE)"
else
echo ""; echo "${CHOSEN_CAT^^}:"
for name in "${SVCS[@]}"; do
m=""; is_installed "$name" && m=" [installed]"
printf " %-16s %s%s\n" "$name" "${SERVICE_DESC[$name]}" "$m"
done
read -rp "Enter service names to install (space-separated, blank to go back): " -a SELECTED
fi
for name in "${SELECTED[@]}"; do run_service "$name"; done
done
exit "$rc"
echo ""
log_success "Done. Re-run 'sudo ./setup.sh' any time to add more."