Always applied in the Linux block, no prompt, idempotent:
- install_fail2ban: fail2ban + nftables, etc/fail2ban/jail.d/local.conf.
sshd jail reads the journal (backend systemd, works with or without
auth.log) and bans the offender on every port, so the SSH port is
irrelevant: the previous server's jail banned 22 while sshd listened
on 337. 5 failures / 10 min / 1 h. Loopback + RFC1918 never banned.
- install_unattended_upgrades: package + 20auto-upgrades (the file
dpkg-reconfigure writes, without the prompt).
- harden_sshd: sshd_config.d/20-hardening.conf (PermitRootLogin no,
MaxAuthTries 3, LoginGraceTime 20), sshd -t gated: a rejected file is
removed and the install continues with a warning. Auth methods, port
and user lists untouched.
Docs: README table + step 13 + packages, CLAUDE.md layout.
/tmp is a RAM-backed tmpfs on Ubuntu (50% of RAM). Agent runs fill it: half
the RAM goes, then every temp-file creation fails with ENOSPC and shells
break. Swap does not lift the cap, so the fix is /tmp on disk.
End-of-install offers (Linux, [y/N], skipped without a terminal, idempotent):
- offer_tmp_on_disk: mask tmp.mount + etc/tmpfiles.d/tmp.conf (wipe at
boot, 10-day purge, /var/tmp rule kept). Effective at next reboot.
- offer_ssh_memory_guard: the previous server's rules. ssh.service drop-in
(OOMScoreAdjust=-1000, MemoryMin=256M) + earlyoom with --avoid sshd and
--prefer node/java. MemoryMin covers sshd only; earlyoom is the real guard.
install_cloudpex deploys the NAS mount helper in the Linux block.
Docs: README steps 12-14 + table, CLAUDE.md layout + lint command.
Add etc/profile.d/disk-usage-warning.sh (POSIX sh) that warns in bold
red at login when / or /home cross 85% usage. Deployed system-wide via
install_disk_warning() (sudo install -D -m 0644), gated inside the
apt-get block since df --output=pcent and /etc/profile.d are GNU/Debian
conventions absent on macOS. Idempotent and re-runnable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM
bastien