Users can now install and configure everything by simply running the main script.
Re-running the script allows adding new services to existing installations.
NEW SERVICES IN MAIN SCRIPT:
CADDY WEB SERVER:
- Automatic HTTPS with Let's Encrypt
- Reverse proxy for all services
- Creates example Caddyfile with ActualBudget and Keycloak configs
- Detects existing installations (asks before reconfiguring)
- Automatically backs up existing Caddyfile before changes
- Pre-configured with /var/log/caddy volume for fail2ban integration
- Includes HTTP/3 support
FAIL2BAN INTRUSION PREVENTION:
- Automated installation via apt
- Creates Caddy filter for JSON logs (401, 403, 429 status codes)
- Creates Caddy jail with configurable settings
- Automatically creates /var/log/caddy directory
- Tests configuration before restart
- Verifies jail is active after restart
- Shows status and useful commands
FEATURES:
✅ Detects if services already exist (won't overwrite)
✅ Backs up configurations before changes
✅ Interactive prompts for all settings
✅ Validates configurations before applying
✅ Can be re-run to add services to existing setup
✅ Works alongside existing services
✅ Follows same pattern as ActualBudget/Keycloak
WORKFLOW:
1. Run ubuntu-post-install.sh
2. Select services to install (ActualBudget, Keycloak, Caddy, fail2ban, etc.)
3. Script handles everything automatically
4. Re-run anytime to add more services
The caddy-setup-helper.sh remains available as a standalone tool for
advanced configuration, but the main script is now the primary method.
The caddy-setup-helper.sh script now handles everything automatically (after asking
for confirmation), only falling back to manual instructions if errors occur.
AUTOMATED WORKFLOW:
1. ✅ Backup Caddyfile (ALWAYS FIRST - before any changes)
2. ✅ Check if fail2ban is installed
3. ✅ Install fail2ban if missing (with confirmation)
4. ✅ Create /var/log/caddy directory
5. ✅ Check if Caddy container has log volume mounted
6. ✅ Automatically add log volume to docker-compose.yml if needed
7. ✅ Create fail2ban filter at /etc/fail2ban/filter.d/caddy-auth.conf
8. ✅ Create fail2ban jail at /etc/fail2ban/jail.d/caddy.conf (with custom settings)
9. ✅ Test fail2ban configuration
10. ✅ Restart fail2ban and verify jail is active
11. ✅ Add service configurations (ActualBudget, Keycloak) to Caddyfile
12. ✅ Validate and reload Caddy configuration
ERROR HANDLING:
- All operations tracked with error messages array
- If any step fails, script continues but tracks the failure
- At the end, shows all errors encountered
- Provides exact manual commands to fix issues
- Backup is ALWAYS created before any changes
USER EXPERIENCE:
- Interactive prompts with sensible defaults
- Clear colored output (INFO, SUCCESS, WARNING, ERROR)
- Progress feedback at each step
- Final summary with useful commands
- Only shows manual instructions if automation failed
SAFETY FEATURES:
- Caddyfile backup before ANY modifications
- docker-compose.yml backup before modifications
- Validation before reloading Caddy
- Test fail2ban config before restart
- Restore instructions always shown after backup
This matches the integrated experience of other services - fully automated
unless something goes wrong, in which case it provides manual steps.
FIXES:
- Fix Magic Mirror npm install to run inside Docker container instead of on host
- npm (Node Package Manager) commands now execute inside the MagicMirror container
where Node.js is installed, preventing errors on hosts without Node.js
NEW SERVICES:
- Add ActualBudget: Open-source personal finance management with bank sync (SimpleFIN)
- Add Keycloak: Identity and Access Management (SSO, OAuth2, SAML, MFA)
- Both services integrated into main installation script and available as standalone
docker-compose files for existing servers
CADDY & FAIL2BAN:
- Add caddy-setup-helper.sh: Interactive script to configure Caddy and fail2ban
* Detects existing Caddy installation
* Automatically backs up Caddyfile with timestamp
* Checks for fail2ban support
* Provides service integration examples
- Add fail2ban filter and jail configurations for Caddy protection
- Add comprehensive setup guide (CADDY-FAIL2BAN-SETUP.md)
DOCUMENTATION:
- Detailed deployment instructions for each service
- Reverse proxy configuration examples
- Security best practices and headers
- Backup/restore procedures
- Troubleshooting guides
This update enables secure deployment of new services on existing servers with
proper Caddy reverse proxy integration and fail2ban protection against attacks.
- Add interactive "Start now?" prompts to all Docker containers
- Add UFW firewall port opening for Docker services when enabled
- Add Magic Mirror config copy option with custom.css support
- Add automatic detection and download of third-party MMM-* modules
- Add npm install for Magic Mirror module dependencies
Drive Setup (runs at script start):
- New setup_drives() function runs before other installations
- Auto-detects unpartitioned drives, offers to format
- Creates ~/drives/ mount points
- Adds to fstab and runs mount -a
- Partitioning/formatting for new drives without partition tables
Immich Improvements:
- Separate UPLOAD_LOCATION from EXTERNAL_LIBRARY (different paths)
- Upload: ~/drives/primary/photos/immich-uploads (new photos)
- External: ~/drives/primary/photos (existing photos, read-only)
- Warns if both paths are the same
- Added immich-cli instructions for uploading old photos with correct EXIF dates
- Container auto-start option after install
Container Management:
- Added "Start now?" prompt for Immich after install
Step 6 now scans docker-compose files for volume mounts:
- Detects absolute paths that don't exist on new system
- Shows old path and suggests ~/drives/primary/{folder}
- User can: accept suggestion, skip, or enter custom path
- Updates compose file with new path
- Creates directory if needed
Example:
Container: immich
Old path: /home/user1/media/driveb
Suggested: ~/drives/primary/driveb
[Enter] Accept | [S] Skip | [path] Custom
When source is on mounted drive (/mnt/*, ~/drives/*, /media/*):
- [C] Copy - Copy to ~/docker (for old OS drive migration)
- [S] Symlink - Create ~/docker → source (for data drive)
- [U] Use in-place - Use source directly, no copy
This handles both scenarios:
- Old OS drive mounted temporarily → Copy
- Data drive you'll keep using → Symlink or use in-place
- Auto-detect ~/drives/*/docker, /mnt/*/docker, /media/*/docker
- Show numbered list for easy selection (type "1" to select first)
- Still accepts any custom path
- Shows common locations as examples if nothing auto-detected
- New [M] Migration option at script start
- Auto-detects Docker directories (/var/docker, /opt/docker, ~/docker)
- Scans for docker-compose.yml files and lists containers with sizes
- Whiptail checklist for selecting containers to migrate
- Option to stop containers before copy (clean database state)
- Preserves versions - no unwanted upgrades during migration
- After migration, offers to install additional services
- Three modes now: Normal install, Migration, Disaster Recovery
- Install Kopia in Step 1 (core utilities)
- Add Step 9: Reconnect Kopia repository after restore
- Backups now work immediately after disaster recovery
- Update README with 9-step recovery process
- Immich: Ask for photo storage location (default ~/drives/primary/photos)
- Immich: External library support for existing photos (read-only)
- Immich: Storage template guidance for yyyy/mm organization
- Add Watchtower container with notify-only mode (safe for apps with DB migrations)
- Document what Docker data lives where and what gets backed up
- Update README with v2.9 changelog
- Add MeshCentral Server as Docker app (ports 4430, 4433)
- Recovery mode now installs core utilities first (openssh-server, git, etc.)
- Add whiptail checklist for selecting which services to restore
- Users can now choose some/none/all services instead of all-or-nothing
- Update README with v2.8 changelog and MeshCentral port
New features:
- --restore flag for disaster recovery mode
- Interactive mode selector at script start (N=Normal, R=Recovery)
- Full disaster recovery flow:
1. Show available drives, auto-mount if device path given
2. Auto-detect Kopia repository
3. Try to find password in backed-up .env, or prompt
4. Install Docker if needed
5. List available snapshots, let user choose or use 'latest'
6. Restore snapshot to temp location
7. Detect all docker-compose.yml files = services to restore
8. Copy services to ~/docker/
9. Optionally start all containers
10. Cleanup temp files
Removed old buried import section that only showed manual instructions.
Documentation:
- Added Disaster Recovery section to README
- Added --restore to command-line options
- Documented what gets restored and requirements
- Added v2.7 changelog entry
Changes the installation pattern for Docker apps to be more robust:
- Install docker-compose.yml FIRST (always succeeds)
- THEN try configuration with prompts
- Use sensible defaults if prompts fail
- Continue to next app even if current config fails
- Added || true and 2>/dev/null to prevent script stops
Updated apps: Frigate, Frigate-Notify, Caddy, ddclient
Config templates now include clear warnings:
- "YOU MUST EDIT THIS FILE" for required configs
- "YOU MAY NEED TO EDIT THIS FILE" for optional configs
- Links to documentation
This ensures the script completes even with complex interdependent
services that may need manual configuration after install.
New Docker applications:
- FindMyDevice (FMD) server for self-hosted Android device tracking
- Frigate-Notify for push notifications on Frigate AI detections
Caddy improvements:
- Interactive domain configuration during setup
- Comprehensive Caddyfile template with all services (commented)
- Clear instructions for caddy_net Docker network usage
- .env file with MY_DOMAIN variable
Frigate-Notify features:
- Auto-detects if Frigate and ntfy are installed
- Interactive setup for Frigate URL and ntfy topic
- WebAPI mode by default (polls Frigate every 30s)
- Config template with labels, zones, quiet hours
- Warns about public ntfy.sh privacy implications
New Docker applications:
- Jellyfin (free media server with hardware acceleration)
- Frigate NVR (AI-powered object detection)
- Caddy (reverse proxy with automatic HTTPS)
- ddclient (dynamic DNS updater)
- ntfy (self-hosted push notifications)
- Uptime Kuma (service uptime monitoring)
- wg-easy (WireGuard VPN with web UI)
- Traccar (GPS tracking server)
- Portainer (Docker management UI)
Container backup system:
- Kopia backup for all Docker container data
- Backup script for configs, databases, app state
- Restore script for disaster recovery
- Backs up Immich memories, Emby metadata, Minecraft worlds, etc.
All apps use docker-compose in ~/docker/{appname}/ with storage on
primary drive where appropriate.
After configuring the Primary share, the script now displays:
- How to edit /etc/samba/smb.conf with nano
- Example share configuration block
- How to restart smbd/nmbd services
- How to verify with testparm
VPN additions:
- WireGuard VPN with key generation and config setup
- Tailscale mesh VPN with Tailscale SSH documentation
Remote desktop additions:
- TeamViewer installation and setup
- MeshCentral agent with server URL prompt
Other changes:
- Enhanced NetBird documentation on SSH key management
- Detection functions and status display for all new tools
- Updated README with VPN Setup and Remote Desktop Setup sections
Major changes:
- Local backup uses rsync exclusively with support for 1-4 drives
- Drive names are now customizable (default: primary, backup1, etc.)
- Added separate cloud backup option with rclone + encryption
- Guided setup for Google Drive and OneDrive with encryption
- rclone.conf auto-backed up to all local drives
- Added off-site backup guidance (Signal, Box.com, password managers)
- Removed old rsync/rclone choice and full/split modes
Documentation updates:
- Explain why fail2ban provides no benefit with key-only SSH
- Explain why rsync instead of RAID
- Document rclone.conf decryption and restore process
- Update all backup-related sections for new structure
- Add --dry-run flag to preview installations without changes
- Add --unattended flag for automated/scripted installs with defaults
- Add logging to /var/log/post-install.log
- Add fail2ban protection when SSH password auth is enabled
- Add UFW firewall configuration option
- Update all prompts for unattended mode support
- Update README with new features and troubleshooting
- Add software detection for Docker, Samba, NetBird, RustDesk, rclone, rsync
- Script shows current system status and offers to reinstall/reconfigure
- All components now optional with y/n prompts
- Add backup tool selection: rsync (recommended for local) vs rclone (cloud)
- Add backup mode selection: full (one drive) vs split (two drives)
- Generate appropriate backup script based on tool + mode selection
- Update summary section to only show installed components
- Update README with new features, rsync vs rclone comparison, backup modes
- Mark Samba File Sharing section as optional
- Mark Backup System section as optional
- Update interactive prompts section with new Samba/backup prompts
- Add note to Backup Configuration section about optional nature
- Update Samba section to indicate conditional installation
- Reorganize "Files Created" section by optional/required
- Update Security Notes to indicate optional features
- Add Samba file sharing installation and configuration to match
README documentation (was documented but not implemented)
- Rename ubuntu-readme.md to README.md for standard GitHub display
- Update download instructions with actual GitHub repository URLs
Claude