Scripts

One command to see the distro, kernel, CPU, memory, disk, network interfaces and common service states. Read-only, changes nothing.

• system
• readonly

Installs Docker and Compose with the official script and writes in mainland mirror accelerators. Asks before reinstalling.

• docker
• install

Switches congestion control to BBR and the queueing discipline to fq via sysctl.d. Exits early on kernels below 4.9.

• network
• tuning

Creates a swap file of the given size at /swapfile, adds it to fstab for boot, and lowers swappiness to 10.

• memory
• tuning

Disables root login and password auth, tightens retries and the auth window. Refuses to run without an SSH key, and rolls back if sshd -t fails.

• security
• ssh

Packs a directory into a timestamped tar.gz, excluding node_modules, .git, caches and dist. No root needed.

• backup
• ops

Deploys the Komari monitor using the NJU mirror, with data persisted at /opt/komari/data. Requires Docker first.

• monitor
• docker

Stops services, removes systemd units, cleans directories and leftover processes, then verifies itself. Handles random-suffixed names.

• ops
• cleanup

Refreshes package sources, upgrades installed packages and drops unused dependencies. Warns about a pending reboot instead of taking one.

• update
• system

Defaults to Asia/Shanghai and turns on NTP sync. Pass a zone name to change it, for example UTC.

• system
• time

Denies inbound by default, allows outbound, and opens only SSH plus 80/443. Allows SSH before enabling, so you are not locked out.

• security
• network

Installs, starts and enables Nginx on boot. If it is already installed it exits without touching your configuration.

• web
• install

Uses the certbot nginx plugin to rewrite the config, set up the renewal timer and redirect http to https. The domain must already point here.

• web
• tls

Clears apt caches, unused dependencies, journal logs, stale /tmp files and dangling Docker images. Leaves /home and your app directories alone.

• ops
• disk

Lists listening ports with their processes; pass a port number to narrow it down. Read-only, no root needed.

• network
• readonly

Installs a chosen major version from the official NodeSource repository (22 LTS by default). Asks before overwriting an existing install.

• runtime
• install

Sets up an sshd jail that bans an address for an hour after five failures within ten minutes. Pairs well with the firewall script.

• security
• install

Writes a public key into the given user authorized_keys and fixes the permissions. The key arrives as an argument, never from standard input.

• security
• ssh

Creates a user with sudo rights and optionally installs a public key for it. Detects whether the admin group is called sudo or wheel.

• security
• ops

Raises nofile to 65535 and lifts file-max plus the connection backlogs. Busy services tend to hit exactly these three walls.

• tuning
• system

Scans the usual certificate directories and can check a live domain, reporting days left. Read-only.

• tls
• readonly

Shows the configured resolvers, whether a domain resolves, whether public DNS is reachable, and the outbound IP. Read-only.

• network
• readonly

Lists every user crontab, /etc/cron.d and the systemd timers. For finding out what runs at 3am. Read-only, but needs root.

• ops
• readonly