Files

T

Claude 7cf82d5d28 Add no-keycloak and CrowdSec script variants; restore originals

Provide three tiers of the install script for both 24.04 and 26.04:

- Originals (ubuntu-post-install-24.04.sh / -26.04.sh): restored to their
  true original state, with Keycloak intact, as a fallback baseline. (This
  reverts the in-place Keycloak removal from the previous commit; the cleanup
  now lives in the -no-keycloak variants instead.)
- -no-keycloak.sh: Keycloak fully removed, Authelia as the SSO/2FA option.
- -crowdsec.sh: builds on -no-keycloak and replaces fail2ban entirely with
  CrowdSec (SSH via auth.log/sshd collection, Caddy via caddy collection + log
  acquisition, firewall bouncer for enforcement, plus geo-blocking and
  community IP-reputation blocklists).

Add SCRIPT-VARIANTS.md documenting the three tiers and how the Authelia /
fail2ban / CrowdSec security layers differ.

All variants pass 'bash -n'.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

2026-06-03 11:34:43 +00:00

2.1 KiB

Raw Blame History

Install Script Variants

This repo ships the post-install script in three tiers, for both Ubuntu 24.04 and 26.04. Pick one and run it — they are mutually exclusive (each is a complete, standalone script).

File	Keycloak	SSO	Intrusion prevention
`ubuntu-post-install-<ver>.sh`	✅ included	Keycloak or Authelia	fail2ban (SSH + Caddy)
`ubuntu-post-install-<ver>-no-keycloak.sh`	❌ removed	Authelia	fail2ban (SSH + Caddy)
`ubuntu-post-install-<ver>-crowdsec.sh`	❌ removed	Authelia	CrowdSec (replaces fail2ban)

<ver> is 24.04 or 26.04.

Which one?

Original (.sh) — unchanged baseline, kept for fallback. Still offers Keycloak in the menu.
-no-keycloak — same as original but with Keycloak fully removed. Authelia is the SSO + 2FA option. Use this if you never got Keycloak running and have standardized on Authelia.
-crowdsec — builds on -no-keycloak and swaps fail2ban out for CrowdSec:
- SSH brute-force protection (CrowdSec reads /var/log/auth.log via the crowdsecurity/sshd collection)
- Caddy HTTP auth abuse (the crowdsecurity/caddy collection + a log acquisition at /etc/crowdsec/acquis.d/caddy.yaml)
- Enforcement via crowdsec-firewall-bouncer-iptables
- Geo-blocking + community IP-reputation blocklists — the capability that fail2ban and Authelia both lack

Notes on the security layers

Authelia handles per-account failed-login regulation (lockout). It does not do geo-blocking.
fail2ban bans IPs at the firewall based on Caddy log patterns (401/403/429). No geo-blocking, not credential-aware.
CrowdSec covers SSH + Caddy from a single agent, adds geo/ASN enrichment and crowd-sourced reputation, and is the modern successor to fail2ban.

Useful CrowdSec commands after install:

sudo cscli metrics              # overview / parsing health
sudo cscli decisions list       # current bans
sudo cscli alerts list          # detections
sudo cscli decisions delete --ip <IP>   # unban

2.1 KiB Raw Blame History

Install Script Variants

Which one?

Notes on the security layers

2.1 KiB

Raw Blame History