Merge feature/apt-packages into develop

gitleaks, web stack (mariadb-server, imagemagick, unversioned php-* modules),
ubuntu-desktop-minimal before the RDP setup, and a lspci-gated
install_nvidia_driver() that runs ubuntu-drivers install. README + TODO updated.

.claude/memory/decisions.md

@@ -98,3 +98,21 @@ in repo, live apply = user.
 main install.sh never aborts; keep-existing [Y/n]; skipped without TTY). Script parses lines
 (`sed -n s/^KEY=//p`), never sources → no code exec as root from config. Alt rejected: sed placeholders into
 deployed script — config + code mixed, every re-run overwrites values. Status: done in repo.
+
+## BDR-013 — security baseline always-on in install.sh: fail2ban (all-ports), unattended-upgrades, sshd limits
+2026-09-22. User: "fail2ban and the like, systematically". Chose no-prompt Linux-block steps: (1) fail2ban sshd
+jail `backend = systemd` + `banaction = %(banaction_allports)s` → SSH port irrelevant (old server banned 22 while
+sshd on 337, LRN-012); `ignoreip` = loopback + RFC1918 static (no LAN detection; trade-off: compromised LAN host
+never banned); 5/10m/1h from RECOVERY doc 01. (2) `20auto-upgrades` file instead of interactive dpkg-reconfigure.
+(3) sshd drop-in limited to PermitRootLogin/MaxAuthTries/LoginGraceTime, `sshd -t` gated, rejected file removed +
+install continues. Declined by user: auditd rules, ufw whitelist (site-specific ports, lockout risk → would be an
+offer, not systematic). Not included by design: PasswordAuthentication no / AllowUsers / X11Forwarding no
+(lockout or workflow risk). Status: done in repo (feature/security-baseline), live apply = user.
+
+## BDR-014 — install.sh mirrors machine apt set: GNOME + LAMP unconditional, NVIDIA via ubuntu-drivers
+2026-09-28. Source: `apt-mark showmanual` + /var/log/apt/history.log diffed vs script. Added gitleaks, web stack
+(mariadb-server imagemagick php-* unversioned → follows distro PHP), ubuntu-desktop-minimal before RDP setup
+(gnome-remote-desktop needs GDM, bare server had none), `install_nvidia_driver()` = `lspci -d 10de:` gate +
+`ubuntu-drivers install` (distro-recommended, 595-open today). Alternatives rejected: pin nvidia-driver-595-open
+(ages, hardware-bound), LAMP behind confirm() offer (user: base list), GNOME left implicit (RDP fails silently).
+Status: merged to develop. Live rerun of install.sh = user.

.claude/memory/journal.md

@@ -50,3 +50,31 @@ menu. Fix: source dtach-router from bashrc-linux (every interactive shell); inst
 unwire_dtach_profile() strips stale ~/.profile block (avoids double-prompt on plain SSH). User chose simplest
 (per-tab) over once-per-connection sentinel. shellcheck install.sh CLEAN, bash -n OK, strip proven idempotent
 on .profile copy. BDR-009 (supersedes BDR-007) + LRN-008. Live needs ./install.sh re-run.
+
+## 2026-09-22 — /tmp on disk + SSH OOM guard + cloudpex conf
+User: swap for /tmp? keep RAM for ssh, old-server rules, cloudpex README+installer. Found /tmp = tmpfs 50% RAM
+→ swap rejected, mask tmp.mount offer (BDR-010). Old rules in NAS RECOVERY/40-systeme: ssh drop-in + earlyoom →
+end-of-install offers (BDR-011). cloudpex tracked; site values → /etc/cloudpex.conf prompted by installer
+(BDR-012). shellcheck/bash -n CLEAN, stub harnesses (LRN-011; EVAL-002 open until live apply). Reconciled
+main→develop (a210d01 dtach was main-only), feature finished via lib → develop 836bb67. Not applied live.
+Flagged: secrets in NAS transfert/root (BLK-005), remote-install.sh BRANCH=master stale vs main, gitea-deploy/
+untracked, remote feature branch left on origin (lib deletes local only).
+Later same day: security baseline always-on in install.sh (fail2ban all-ports + RFC1918 ignore, unattended-
+upgrades file, sshd limits drop-in sshd -t gated) on feature/security-baseline (BDR-013, LRN-012: old jail
+banned 22 not 337). auditd + ufw declined. shellcheck/bash -n CLEAN, stub harness incl. sshd -t reject path,
+configparser + apt-config checks. Branch pushed, NOT finished (no merge signal). Live apply = user runbook.
+Update: user said merge → feature/security-baseline finished via lib, develop a6c416e pushed.
+Cleanup: user asked all-in-develop + delete branches. Hooks refresh committed (a42e8f6). All 3 remote feature
+branches verified merged; `git push --delete` DENIED by permission layer → user runs it. gitea-deploy/ (untracked
+Gitea server deploy project, 31 files, no secrets) moved to ~/Documents/gitea-deploy, own repo via gitflow init,
+pushed main+develop to git.bchanot.fr (push-to-create worked). deploy.conf gitignored.
+
+## 2026-09-28
+- feature/apt-packages (0bc9e3f, unmerged): install.sh mirrors machine apt set. Diff `apt-mark showmanual` +
+apt history vs script → added gitleaks, web stack (mariadb-server imagemagick php-* unversioned),
+ubuntu-desktop-minimal before RDP, install_nvidia_driver() (lspci 10de gate, `ubuntu-drivers install`, no pin).
+User approved 3 choices (GNOME in, ubuntu-drivers, LAMP unconditional). shellcheck + bash -n + stub run OK.
+- Blocked mid-commit: lib pre-commit ran `gitleaks git --staged`, Ubuntu apt gitleaks = 8.16 (no `git` subcmd,
+exit 1 read as leak). Fixed in claude-config bugfix/gitleaks-protect-fallback (347073a, unmerged): probe
+`gitleaks git --help`, fallback `protect --staged`; T16c symlink-farm PATH. make test 0. Hooks refreshed here (9e49b9d).
+- Note: `gh` in install.sh list but not installed on this box (script not rerun since added).

.claude/memory/learnings.md

@@ -85,3 +85,19 @@ here). Old-server earlyoom file valid as-is. Env-file syntax check: `sh -n`.
 Extract functions (`sed -n '/^fn()/,/^}/p'`) into scratch, define `sudo(){ echo "SUDO: $*"; }` + `systemctl`
 + `findmnt` stubs, override `confirm` per scenario, `</dev/null` for no-TTY. Covers every branch, prints exact
 sudo calls, `set -e` behaviour included. Gotcha: `unset -f` on an overridden fn removes it entirely.
+
+## LRN-012 — fail2ban jail must match the real sshd port, or ban all ports
+2026-09-22. Old server: sshd `Port 337`, fail2ban sshd jail with default `port = ssh` (=22) → bans hit port 22
+only, SSH on 337 stayed open to the banned IP. Silent, no error. Fix options: `port = 337` (needs detection /
+templating, drifts if port changes) or `banaction = %(banaction_allports)s` (offender blocked everywhere, port
+irrelevant) — chose allports. Offline checks without fail2ban installed: python `configparser` with
+BasicInterpolation resolves `%(x)s` refs and proves the file parses; apt.conf → `apt-config
+--config-file=<f> dump APT::Periodic`. sshd drop-ins can't be `sshd -t`-tested without root (host keys).
+
+## LRN-013 — distro package lags upstream: probe subcommand before calling it
+2026-09-28. Ubuntu apt gitleaks = 8.16; lib pre-commit hook written for >= 8.19 (`gitleaks git --staged`).
+"unknown command" exit 1 read as a leak → every commit blocked, silently (stderr swallowed). Script calling a
+subcommand born in version N must probe `tool sub --help` and fall back (`protect --staged`). Test faking
+"binary absent" via shorter PATH (`/usr/bin:/bin`) breaks once the binary lives in /usr/bin: symlink farm of
+/usr/bin minus the binary instead. Apply: any tool install.sh pulls from apt while ~/.claude scripts assume
+the upstream release. Fix: claude-config bugfix/gitleaks-protect-fallback.

.claude/tasks/TODO.md

@@ -47,6 +47,25 @@ Root cause: /tmp is tmpfs (50% RAM) → agents fill it → RAM halved + ENOSPC b
 - [x] cloudpex/install.sh: prompt host/share/user/mnt/vers (regex-validated), keep-existing [Y/n], no-TTY skip
 - [x] cloudpex/README.md + README.md + CLAUDE.md: no site values, describe prompts + conf file
 - [x] registries: BDR-010/011/012, LRN-009/010/011, BLK-005/006, EVAL-002, journal
-- [ ] reconcile: merge main (a210d01 dtach) into develop via lib helper
-- [ ] gitflow finish feature → develop (explicit user signal: "puis merge")
-- [ ] runbook for live apply on this machine
+- [x] reconcile: merge main (a210d01 dtach) into develop via lib helper
+- [x] gitflow finish feature → develop (explicit user signal: "puis merge")
+- [x] runbook for live apply on this machine
+
+## Feature — security baseline in install.sh (2026-09-22)
+Branch: feature/security-baseline (off develop). Scope approved: fail2ban, unattended-upgrades, sshd hardening. auditd + ufw declined.
+- [x] etc/fail2ban/jail.d/local.conf — sshd jail, backend systemd, allports ban, RFC1918 ignoreip
+- [x] etc/apt/apt.conf.d/20auto-upgrades — Periodic Update-Package-Lists + Unattended-Upgrade = 1
+- [x] etc/ssh/sshd_config.d/20-hardening.conf — PermitRootLogin no, MaxAuthTries 3, LoginGraceTime 20
+- [x] install.sh: install_fail2ban / install_unattended_upgrades / harden_sshd (sshd -t gated), called in Linux block
+- [x] README.md (table, step 13, packages) + CLAUDE.md layout
+- [x] shellcheck + bash -n; stub harness harden_sshd (accept / reject paths); configparser check of jail file
+- [x] commit; registries (BDR-013, LRN-012); runbook. No finish without explicit signal.
+
+## Feature — install.sh mirrors this machine's apt packages (2026-09-28)
+Branch: feature/apt-packages (off develop). Source: apt-mark showmanual + /var/log/apt/history.log diffed against install.sh.
+- [x] gitleaks in the base list (backs the pre-commit hook)
+- [x] web stack group: mariadb-server imagemagick + unversioned php-* modules (approved: base list, not an offer)
+- [x] ubuntu-desktop-minimal before setup_remote_desktop (approved)
+- [x] install_nvidia_driver(): lspci vendor 10de gate + ubuntu-drivers install (approved: no version pin)
+- [x] README steps 11 + packages; shellcheck + bash -n; stub run of the NVIDIA helper
+- [x] commit on the feature branch. No finish without explicit signal.

.githooks/post-commit

@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow post-commit — generated by gitflow_init. Do not hand-edit.
+# Pushes every commit as it lands (BDR-095): a remote only backs up what it
+# holds. Never fails the commit: no origin / offline / refused → warning only.
+# Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
+[ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
+# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
+[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+git remote get-url origin >/dev/null 2>&1 || exit 0
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
+if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi
+if $t git push -q -u --follow-tags origin "$br" >/dev/null 2>&1; then exit 0; fi
+echo "gitflow post-commit: push of '$br' FAILED — this commit exists only on this disk." >&2
+echo "  Push by hand: git push -u origin $br   (rejected as non-fast-forward? never force-push; ask first)" >&2
+exit 0

.githooks/post-merge

@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow post-merge — generated by gitflow_init. Do not hand-edit.
+# Pushes every commit as it lands (BDR-095): a remote only backs up what it
+# holds. Never fails the commit: no origin / offline / refused → warning only.
+# Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
+[ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
+# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
+[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+git remote get-url origin >/dev/null 2>&1 || exit 0
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
+if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi
+if $t git push -q -u --follow-tags origin "$br" >/dev/null 2>&1; then exit 0; fi
+echo "gitflow post-commit: push of '$br' FAILED — this commit exists only on this disk." >&2
+echo "  Push by hand: git push -u origin $br   (rejected as non-fast-forward? never force-push; ask first)" >&2
+exit 0

.githooks/pre-commit

@@ -7,17 +7,40 @@ br=$(git symbolic-ref --short -q HEAD 2>/dev/null)
 git rev-parse --verify -q HEAD >/dev/null 2>&1 || exit 0   # root commit — allow
 [ -f "$gd/MERGE_HEAD" ] && exit 0                          # merge in progress — allow
 
+# Secret backstop (job7) — any branch, not just protected ones. Non-blocking
+# if gitleaks isn't installed; auto-discovers ./.gitleaks.toml (repo root).
+# gitleaks >= 8.19 scans the index with `git --staged`; older builds (Ubuntu's
+# 8.16 package) only know `protect --staged`, and `git` exits 1 there as an
+# unknown command — which would block every commit. Probe the subcommand first.
+if command -v gitleaks >/dev/null 2>&1; then
+  gl_sub=git
+  gitleaks git --help >/dev/null 2>&1 || gl_sub=protect
+  if ! gitleaks "$gl_sub" --staged --no-banner >/dev/null 2>&1; then
+    echo "gitflow pre-commit: BLOCKED — gitleaks found a secret in staged changes." >&2
+    echo "  Details: gitleaks $gl_sub --staged --no-banner" >&2
+    echo "  Genuine false-positive? add an allowlist rule to .gitleaks.toml — never bypass with --no-verify." >&2
+    exit 1
+  fi
+else
+  echo "gitflow pre-commit: gitleaks not installed — secret scan skipped (https://github.com/gitleaks/gitleaks)." >&2
+fi
+
+# Per-repo opt-out of the branch model (a clone of a foreign project):
+#   git config gitflow.protect false
+[ "$(git config --bool --default true gitflow.protect)" = false ] && exit 0
+
 case "$br" in
   main|develop) ;;                        # protected — keep checking
   *) exit 0 ;;                                              # working branch — allow
 esac
 
-# whitelist: all-staged-under-.claude/ (memory/doc/deploy helpers) — allow
-if [ -z "$(git diff --cached --name-only | grep -v '^\.claude/' | head -1)" ]; then
+# whitelist: all-staged-under-.claude/ (memory/doc/deploy helpers) or
+# .githooks/ (the hooks themselves, refreshed by the lib) — allow
+if [ -z "$(git diff --cached --name-only | grep -vE '^\.(claude|githooks)/' | head -1)" ]; then
   exit 0
 fi
 
 echo "gitflow pre-commit: BLOCKED — direct commit on '$br'." >&2
 echo "  Branch from the right base (feature/bugfix->develop, hotfix->main), or merge." >&2
-echo "  (.claude/** memory commits are exempt; --no-verify bypasses locally.)" >&2
+echo "  (.claude/** and .githooks/** commits are exempt; foreign clone? git config gitflow.protect false)" >&2
 exit 1

.githooks/reference-transaction

@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow reference-transaction — generated by gitflow_init. Do not hand-edit.
+# Refuses deleting (or renaming) main / develop, whatever the
+# command. Mirrors gitflow_protected_base (lib/gitflow.sh).
+[ "$1" = prepared ] || exit 0
+while read -r _old new ref; do
+  case "$ref" in refs/heads/main|refs/heads/develop) ;; *) continue ;; esac
+  case "$new" in *[!0]*) continue ;; esac     # new value not all-zeros → an update, not a deletion
+  # Per-repo opt-out (a foreign clone): git config gitflow.protect false
+  [ "$(git config --bool --default true gitflow.protect)" = false ] && exit 0
+  echo "gitflow reference-transaction: BLOCKED — deleting '$ref', a protected base." >&2
+  echo "  main and develop are never deleted or renamed. A merged working branch: gitflow.sh delete <branch>" >&2
+  exit 1
+done
+exit 0

CLAUDE.md

@@ -26,6 +26,9 @@ etc/profile.d/disk-usage-warning.sh     login-time low-disk warning → /etc/pro
 etc/tmpfiles.d/tmp.conf                 disk-backed /tmp cleanup rules (offer: /tmp on disk)
 etc/systemd/ssh.service.d/override.conf sshd OOM-exempt drop-in (offer: SSH memory guard)
 etc/default/earlyoom                    earlyoom args, spare sshd / kill node first (same offer)
+etc/fail2ban/jail.d/local.conf          sshd jail: journal backend, all-ports ban, LAN ignored (always)
+etc/apt/apt.conf.d/20auto-upgrades      unattended security upgrades on (always)
+etc/ssh/sshd_config.d/20-hardening.conf sshd limits that cannot lock out, sshd -t gated (always)
 cloudpex/{cloudpex,install.sh,README.md} on-demand SMB mount helper → /usr/local/bin; site values
                                          prompted at install → /etc/cloudpex.conf, never in the script (FR docs)
 .claude/{tasks,memory,audits}/   Claude working state

README.md

@@ -21,6 +21,9 @@ curl -fsSL https://git.bchanot.fr/bchanot/config/raw/branch/master/remote-instal
 | `etc/tmpfiles.d/tmp.conf` | Cleanup rules for a disk-backed `/tmp` (wiped at boot, 10-day purge). Deployed by the `/tmp` on disk offer. |
 | `etc/systemd/ssh.service.d/override.conf` | `ssh.service` drop-in: sshd exempt from the OOM killer + memory reclaim protection. Deployed by the SSH memory guard offer. |
 | `etc/default/earlyoom` | earlyoom arguments: spare sshd/systemd, kill node/java first. Deployed by the SSH memory guard offer. |
+| `etc/fail2ban/jail.d/local.conf` | fail2ban sshd jail: journal backend, all-ports ban, 5 tries / 10 min / 1 h, private LAN never banned. Deployed on every Linux install. |
+| `etc/apt/apt.conf.d/20auto-upgrades` | Enables unattended security upgrades (what `dpkg-reconfigure` writes). Deployed on every Linux install. |
+| `etc/ssh/sshd_config.d/20-hardening.conf` | sshd limits that cannot lock you out: `PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`. Deployed on every Linux install after `sshd -t`. |
 | `vim/vimrc`          | Vim config: pathogen, molokai, syntastic (C with `-Wall -Werror -Wextra`), NERDTree, 42-style canonical class generators (`:ClassH`, `:ClassC`). |
 | `vim/autoload/`      | `pathogen.vim` plugin loader (committed).                      |
 | `vim/colors/`        | `molokai.vim` colorscheme (committed).                         |
@@ -64,21 +67,25 @@ What it does:
 8. Copies the `bin/` scripts (`dt`, `dtach-router`, `claude-provider`) into `~/.local/bin`. The dtach session-resume menu ships in the deployed `bashrc-linux`, so every interactive shell offers it — including VS Code Remote-SSH terminals, which are non-login and never read `~/.profile`. The installer also strips any older dtach block left in `~/.profile` so a plain SSH login doesn't prompt twice.
 9. On Linux, installs `etc/profile.d/disk-usage-warning.sh` to `/etc/profile.d/` (needs `sudo`) so each login warns when `/` or `/home` cross 85% usage.
 10. On Linux, installs **code-server** (VS Code in the browser) via its vendor script — skipped if already present — and enables the `code-server@$USER` systemd service.
-11. On Linux, sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active.
+11. On Linux, installs **`ubuntu-desktop-minimal`** (GDM + GNOME Shell, ~1.5 GB): the RDP remote login below hands out a GNOME session, which a bare server install does not have. Then sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active. Finally, when `lspci` sees an NVIDIA GPU, runs `ubuntu-drivers install` to put on the driver the distro recommends for the card (no version pinned; loads at the next reboot). Skipped on machines without an NVIDIA GPU.
 12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh`, which prompts for the NAS host, share name, SMB user, mount point and SMB version and writes them to `/etc/cloudpex.conf` (root, `0600`; an existing config is shown and kept unless you say `n`; skipped when no terminal is attached). Nothing is mounted, no password stored, see [`cloudpex/README.md`](cloudpex/README.md).
-13. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
-14. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
+13. On Linux, installs the **security baseline**, always, no prompt: **fail2ban** (+ `nftables`) with `etc/fail2ban/jail.d/local.conf` (sshd jail reading the journal, bans the offending IP on every port so the SSH port does not matter, 5 failures in 10 min → 1 h ban, loopback and private LAN ranges never banned); **unattended-upgrades** enabled through `etc/apt/apt.conf.d/20auto-upgrades`; and the **sshd drop-in** `etc/ssh/sshd_config.d/20-hardening.conf` (`PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`), checked with `sshd -t` and removed again if sshd rejects it, then `reload ssh`. Authentication methods, port and user lists are left as they are.
+14. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
+15. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
 
 ### Packages installed (apt)
 
-- **Build / VCS / C dev**: `vim git git-lfs git-filter-repo gcc make pkg-config dkms valgrind shellcheck`
+- **Build / VCS / C dev**: `vim git git-lfs git-filter-repo gitleaks gcc make pkg-config dkms valgrind shellcheck gh`
 - **Net / security / transport**: `curl gnupg ca-certificates apt-transport-https net-tools openssh-server cifs-utils lftp ftp`
 - **Shell tooling**: `unzip tree tmux fzf dtach`
 - **Runtimes**: `nodejs python3-pip pipx php-cli`
+- **Web stack (local WordPress/LAMP)**: `mariadb-server imagemagick php-mysql php-gd php-imagick php-mbstring php-xml php-intl php-curl` (unversioned `php-*` metapackages, so they follow the distro's PHP)
 - **Media / doc CLI**: `ffmpeg weasyprint poppler-utils qpdf webp libavif-bin`
 - **Docker**: `docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin` (via Docker's repo)
+- **Desktop / GPU**: `ubuntu-desktop-minimal` (always, Linux) + the distro-recommended NVIDIA driver via `ubuntu-drivers install` (only when an NVIDIA GPU is detected)
 - **Remote access**: `gnome-remote-desktop openssl` (apt) + `code-server` (via its vendor install script, not apt) — RDP remote login + browser VS Code
 - **pipx**: `PyMuPDF` (`pymupdf`), `Markdown` (`markdown_py`)
+- **Security baseline (Linux, always)**: `fail2ban nftables unattended-upgrades`
 - **Optional (end-of-install offer, Linux)**: `earlyoom`
 
 The script is re-runnable: each run re-backs up to `~/Oldconfig` (overwriting the previous backup), re-clones plugins, skips Docker if already installed, and re-deploys the `bin/` scripts.

etc/apt/apt.conf.d/20auto-upgrades

@@ -0,0 +1,4 @@
+// Automatic security updates, deployed by install.sh. Same content as
+// `dpkg-reconfigure -plow unattended-upgrades` writes, without the prompt.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";

etc/fail2ban/jail.d/local.conf

@@ -0,0 +1,20 @@
+# fail2ban local settings, deployed by install.sh. Debian's defaults-debian.conf
+# enables the sshd jail; this file decides how it bans.
+[DEFAULT]
+# Never ban loopback or the private LAN ranges: five typos from the LAN must not
+# lock the admin out for an hour. Trade-off: a compromised LAN host is never banned.
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+bantime  = 1h
+findtime = 10m
+maxretry = 5
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
+[sshd]
+enabled = true
+# Read the journal directly: works with or without /var/log/auth.log (rsyslog).
+backend = systemd
+journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
+# Ban the offender on every port, so the port sshd listens on is irrelevant. The
+# previous server's jail banned port 22 only while sshd listened on 337.
+banaction = %(banaction_allports)s

etc/ssh/sshd_config.d/20-hardening.conf

@@ -0,0 +1,5 @@
+# sshd hardening, deployed by install.sh. Only settings that cannot lock anyone
+# out: authentication methods, ports and user lists are left to the host.
+PermitRootLogin no
+MaxAuthTries 3
+LoginGraceTime 20

install.sh

@@ -27,6 +27,25 @@ install_docker() {
 	sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 }
 
+# NVIDIA driver: only when an NVIDIA GPU is on the PCI bus (vendor id 10de), so the
+# script stays hardware-agnostic elsewhere. ubuntu-drivers picks the driver the distro
+# recommends for the card (595-open on the RTX 3060 Ti this was written on) instead of
+# pinning a version that ages. Idempotent: a no-op when the recommended driver is in.
+# The driver loads at the next reboot. Ubuntu-only (ubuntu-drivers-common).
+install_nvidia_driver() {
+	if ! command -v ubuntu-drivers >/dev/null 2>&1; then
+		echo "ubuntu-drivers not found — skipping NVIDIA driver" >&2
+		return 0
+	fi
+	if [ -z "$(lspci -d 10de: 2>/dev/null)" ]; then
+		echo "No NVIDIA GPU detected — skipping NVIDIA driver"
+		return 0
+	fi
+	echo "NVIDIA GPU detected — installing the recommended driver"
+	sudo ubuntu-drivers install
+	echo "NVIDIA driver loads at the next reboot."
+}
+
 # RDP "gate" credentials: a shared username/password that unlocks the GDM
 # login screen (each user then logs into GDM with his own account). Required —
 # without it the RDP server rejects every connection (mstsc error 0x904). It is
@@ -141,6 +160,46 @@ install_cloudpex() {
 	bash "$SCRIPT_DIR/cloudpex/install.sh"
 }
 
+# fail2ban: bans an IP on every port after repeated SSH failures. The sshd jail
+# reads the journal (works with or without /var/log/auth.log) and bans all ports,
+# so the port sshd listens on does not matter — the previous server's jail only
+# banned port 22 while sshd listened on 337. Private LAN ranges are never banned.
+# nftables is the ban backend. Idempotent: config overwritten, service restarted.
+install_fail2ban() {
+	echo "Installing fail2ban (sshd jail, all-ports ban)"
+	sudo apt-get install -y fail2ban nftables
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/fail2ban/jail.d/local.conf" \
+		/etc/fail2ban/jail.d/local.conf
+	sudo systemctl enable fail2ban
+	sudo systemctl restart fail2ban
+}
+
+# Automatic security updates: the file dpkg-reconfigure would write, deployed
+# directly so the install stays non-interactive. Idempotent.
+install_unattended_upgrades() {
+	echo "Enabling unattended security upgrades"
+	sudo apt-get install -y unattended-upgrades
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/apt/apt.conf.d/20auto-upgrades" \
+		/etc/apt/apt.conf.d/20auto-upgrades
+}
+
+# sshd hardening drop-in (PermitRootLogin, MaxAuthTries, LoginGraceTime): only
+# settings that cannot lock anyone out; authentication methods stay untouched.
+# Validated with sshd -t before the reload. A rejected file is removed rather than
+# left in place, so sshd keeps starting on the next boot; the install goes on and
+# the warning tells you.
+harden_sshd() {
+	echo "Deploying sshd hardening drop-in"
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/ssh/sshd_config.d/20-hardening.conf" \
+		/etc/ssh/sshd_config.d/20-hardening.conf
+	if ! sudo sshd -t; then
+		sudo rm -f /etc/ssh/sshd_config.d/20-hardening.conf
+		echo "sshd rejected 20-hardening.conf — removed, sshd config unchanged" >&2
+		return 0
+	fi
+	sudo systemctl reload ssh
+}
+
 # Yes/no prompt for the optional system changes offered at the end of the install.
 # Declines (returns 1) when no terminal is attached (curl | bash), so an offer is
 # skipped with a hint instead of blocking; re-run ./install.sh from a terminal to
@@ -219,14 +278,18 @@ if command -v apt-get >/dev/null 2>&1; then
 	sudo apt-get update
 	sudo apt-get upgrade -y
 
-	# Build + version control + C dev tooling.
+	# Build + version control + C dev tooling (gitleaks backs the pre-commit hook).
+	# Web stack: MariaDB + PHP modules for local WordPress/LAMP work; the php-* metapackages
+	# follow the distro's PHP version instead of pinning php8.x-*.
 	sudo apt-get install -y \
-		vim git git-lfs git-filter-repo gcc make pkg-config dkms valgrind shellcheck \
+		vim git git-lfs git-filter-repo gitleaks gcc make pkg-config dkms valgrind shellcheck \
 		curl gnupg ca-certificates apt-transport-https \
 		unzip tree tmux fzf dtach net-tools \
 		openssh-server cifs-utils lftp ftp \
 		nodejs python3-pip pipx php-cli \
-		ffmpeg weasyprint poppler-utils qpdf webp libavif-bin gh
+		ffmpeg weasyprint poppler-utils qpdf webp libavif-bin gh \
+		mariadb-server imagemagick \
+		php-mysql php-gd php-imagick php-mbstring php-xml php-intl php-curl
 
 	# Docker (separate repo).
 	install_docker
@@ -237,14 +300,26 @@ if command -v apt-get >/dev/null 2>&1; then
 	fi
 	sudo systemctl enable --now "code-server@$USER"
 
+	# GNOME desktop (GDM + Shell): the RDP remote login below needs a GNOME session
+	# to hand out; a bare server install has none. Ubuntu-only metapackage.
+	sudo apt-get install -y ubuntu-desktop-minimal
+
 	# Remote desktop (gnome-remote-desktop — see the function header for why not xrdp).
 	setup_remote_desktop
 
+	# NVIDIA driver, only when an NVIDIA GPU is present.
+	install_nvidia_driver
+
 	# Low-disk login warning (system-wide profile.d snippet).
 	install_disk_warning
 
 	# On-demand NAS mount helper (cloudpex/).
 	install_cloudpex
+
+	# Security baseline: brute-force bans, automatic security updates, sshd limits.
+	install_fail2ban
+	install_unattended_upgrades
+	harden_sshd
 else
 	echo "apt-get not found — skipping system packages (install vim/git manually)."
 fi