Setup checklists

Debain Desktop

These instructions are used when getting a new machine

Install languages

Rust

• Install rust

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Go

• Install go

1. Remove any previous go installation and install from download (command may require sudo)

rm -rf /usr/local/go && tar -C /usr/local -xzf go1.23.3.linux-amd64.tar.gz

2. Ensure go is on PATH

export PATH=$PATH:/usr/local/go/bin

3. Verify that go is installed

go version

Install Alacritty

• Build alacritty
• Create desktop file

  #/usr/share/applications/alacritty.desktop
  [Desktop Entry]
  Type=Application
  TryExec=alacritty
  Exec=alacritty
  Icon=Alacritty
  Terminal=false
  Categories=System;TerminalEmulator;
  

• Install the Fira Mono Nerd Font

wget -P ~/.local/share/fonts https://github.com/ryanoasis/nerd-fonts/releases/latest/download/FiraMono.zip \
&& cd ~/.local/share/fonts \
&& unzip FiraMono.zip \
&& rm FiraMono.zip \
&& fc-cache -fv

Install Starship

• Install starship

cargo install starship --locked

Switch from bash to zsh

• Install zsh

sudo apt install zsh

• Run zsh from the terminal, don't setup anything in .zshrc as this is managed by dotfiles
• Switch from bash to zsh.

chsh -s $(which zsh)

• Logout and then back in.

Load security items

• Copy ssh keys into ~/.ssh. Set appropriate file permissions

chmod 0600 <key>

• Load password manager

Load dotfiles and pre-requisites.

• Install pre-requisites

sudo apt install stow keychain

• Clone the dotfiles repository into ~/dotfiles

cd
git clone [email protected]:mark-pitblado/dotfiles.git.

• Enter the dotfiles directory and run stow

cd ~/dotfiles
stow .

Install Neovim

• Install neovim following the instructions in these notes

Neovim

Install commandline tools

• Run the install script from the dotfiles repository

cd ~/dotfiles
./rust-tools.sh

Install Catppuccin KDE theme

• Follow instructions in https://github.com/catppuccin/kde

VPS

These instructions are for setting up a fresh VPS

Setup non-root user

• Create new user

adduser someuser

• Give new user sudo

usermod -aG sudo someuser

• Test that new user is setup

su - someuser
sudo ls /

Install tmux

This will allow for sessions to be restored in the event that the ssh connection drops

• Install tmux

sudo apt install tmux

Harden SSH

• Remove password authentication

1. Make sure that non-root user has a copy of public ssh-key. This will copy public keys from the local machine to the user on the vps

ssh-copy-id -i key_filepath someuser@someip

2. Test the new key

ssh -i key_filepath someuser@someip

3. Remove password authentication

sudo vim /etc/ssh/sshd_config

Set PasswordAuthentication to no

• Disable login as root

Set PermitRootLogin to no

• Turn of PAM

Set UsePAM to no

4. Change the port for ssh

• Change ssh port

Set Port to some other value

5. Reload the changes

sudo systemctl reload ssh

Install Docker

• Change ssh port

1. Uninstall any existing docker packages from the distribution

for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt-get remove $pkg; done

2. Add the docker GPG key

sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

3. Add the respository to apt

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

Add user to docker group

sudo usermod -aG docker someuser

Install fail2ban

sudo apt update
sudo apt install fail2ban

Confirm that the service is running

systemctl status fail2ban.service

Enable ufw firewall

1. Install ufw

sudo apt install ufw

2. Set defaults

sudo ufw default deny incoming
sudo ufw default allow outgoing

3. Allow ssh (as a minimum)

sudo ufw allow ssh
sudo ufw show added

After confirming everything looks good, activate the configuration.

sudo ufw enable

4. To check the status of ufw, the following command can be used

sudo ufw status

Setup Caddy Server

1. Install caddy

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

After running the above, caddy will automatically be activated. No need to use caddy run.

2. Create a caddy file
3. Reload the server with the caddy file once written. At this point, 80 and 443 should be open so that caddy can get a certificate.

caddy reload