server.conf.example

# Example configuration for root-ubuntu.sh.
#
# Copy to /etc/cli-tools/server.conf on the box, and give it 0600 if you put
# any credentials in it:
#
#   install -d -m 0755 /etc/cli-tools
#   install -m 0600 server.conf.example /etc/cli-tools/server.conf
#
# KEY=value, one per line, # for comments. Surrounding quotes are stripped, so
# quote anything with a space in it.
#
# The file is READ, not sourced: nothing in it is executed, and $(...) or
# backticks stay literal text rather than running as root. It is deliberately
# not JSON either, because the script runs before apt has installed jq and a
# bootstrap that cannot read its own config until it has installed a parser has
# a hole in it.
#
# The environment wins over this file, so a one-off run can override any line
# here without editing it. Everything is optional; a box with no config file at
# all still provisions.

# ── the box ──────────────────────────────────────────────────────────────────

# Per-user pages are served at https://$WEB_DOMAIN/~user and
# https://user.$WEB_DOMAIN, and dev apps at https://<app>.<user>.$WEB_DOMAIN.
#WEB_DOMAIN=dev.example.com

# Each account's address is <login>@$MAIL_DOMAIN on the landing page.
#MAIL_DOMAIN=example.com

# Port to open in ufw. Change it here if sshd is not on 22, or the firewall
# will happily lock you out of the box you are provisioning.
#SSH_PORT=22

# A box with no swap has no slack: the kernel's only answer to a memory spike
# is the OOM killer, and what it picks is whatever was biggest. A swapfile is
# created only when the box has no swap at all, so a machine that already has
# a swap partition or zram is left exactly as it is. Set 0 to never make one.
#SWAP_SIZE=2G
#SWAP_FILE=/swapfile

# 60, the kernel default, treats swap as another tier of memory and pages out
# things that are still being used. 10 keeps it as the safety net it is for.
#SWAPPINESS=10

# ── accounts ─────────────────────────────────────────────────────────────────

# Groups new accounts land in when nothing is passed on the command line.
#DEFAULT_GROUPS=sudo,admin

# ── dotfiles (optional) ──────────────────────────────────────────────────────

# The shell/editor/tmux/irssi config to install into every account. It is not
# in this repository and cannot be: a dotfiles tree carries ssh config,
# known_hosts and sometimes keys, and cli-tools is public.
#
# With none of these set the box still gets everything else -- packages,
# firewall, accounts, zsh, oh-my-zsh, mise, moshcode, nginx, TLS -- and each
# account keeps whatever dotfiles it already had.
#DOTFILES_REPO=git@github.com:example/dotfiles.git

# Or point at a checkout that is already on the box, instead of cloning.
#DOTFILES_DIR=/root/dotfiles

# Where a pasted public key is filed so re-runs and rebuilds keep working.
# Defaults to $DOTFILES_DIR/ssh-keys, or /var/lib/profullstack/ssh-keys when
# there is no dotfiles checkout.
#KEYS_DIR=/etc/cli-tools/ssh-keys

# ── TLS ──────────────────────────────────────────────────────────────────────

# Where Let's Encrypt sends expiry warnings. There is no default: a public
# script must not ship somebody's address. Certificates issue without one --
# you just do not get the reminder mail.
#ACME_EMAIL=ops@example.com

# A wildcard certificate needs a DNS-01 challenge, which needs API access to
# whoever hosts the zone. Without either pair below the box still gets a
# certificate, but only for names that already resolve to it, and per-user dev
# app wildcards (*.<user>.$WEB_DOMAIN) are not possible at all.
#
# Keep this file 0600 if you put these here. Better still, pass them in the
# environment for the one run that issues the certificate and leave them out of
# the file entirely -- renewal does not need them again.
#PORKBUN_API_KEY=
#PORKBUN_SECRET_API_KEY=

# ...or, for a zone at Cloudflare instead:
#CLOUDFLARE_API_TOKEN=

# ── confinement ──────────────────────────────────────────────────────────────

# These boxes are multi-tenant, and the root VPSes we sell hand a customer an
# account rather than the root password. So every account that is not an admin
# is confined by default, with nothing to remember:
#
#   home 0700         nobody walks into anybody else's ~/.config
#   /proc hidepid     `ps -ef` shows you your own processes and no one else's
#   slice caps        one runaway build is not everybody's outage
#   pam limits        a fork bomb is stopped in the fork
#   ssh forwarding    ssh -L to your own app yes, ssh -R relay no
#
# root and anyone in CONFINE_EXEMPT_GROUPS are exempt -- explicitly, by uid,
# because the account you fix a wedged box with must not be subject to the cap
# that is wedging it. `root-ubuntu.sh confine` prints what is confined here and
# what is not.
#
# It never takes sudo away from an account that already has it: demoting a live
# sudoer unattended is how you lose a box. `confine` names them and leaves that
# to you (`root-ubuntu.sh groups rm <user> sudo`).
#CONFINE=1

# Who counts as an admin, and so is not confined.
#CONFINE_EXEMPT_GROUPS=sudo,admin

# The group that carries the confinement. Recomputed every run from the line
# above, so a promotion or demotion converges without being told twice.
#CONFINE_GROUP=confined

# The mode every human home is set to, and the umask new accounts get. Setting
# the home closes the path; the umask stops new files being born world-readable
# behind it. Neither fixes the mode of a file that is already there.
#CONFINE_HOME_MODE=0700
#CONFINE_UMASK=027

# hidepid needs a group whose members still see every process -- admins go in
# it automatically. Add a monitoring agent's unit to CONFINE_PROC_UNITS if it
# reads /proc as a non-root user; polkit already does and is handled.
#CONFINE_HIDEPID=1
#CONFINE_PROC_GROUP=proc
#CONFINE_PROC_UNITS=polkit.service

# Per-account resource caps on the systemd user slice. Memory and tasks are
# hard ceilings because their failure mode is the whole box. CPU is only a
# weight -- it bites under contention and gets out of the way when the box is
# idle -- so set CONFINE_CPU_QUOTA (e.g. 200%) only if you want a real ceiling
# and are willing to throttle a build on an otherwise empty machine.
#CONFINE_MEMORY_HIGH=35%
#CONFINE_MEMORY_MAX=50%
#CONFINE_TASKS_MAX=4096
#CONFINE_CPU_WEIGHT=100
#CONFINE_CPU_QUOTA=

# PAM limits, which bite at login rather than in the cgroup.
#CONFINE_NPROC=4096
#CONFINE_NOFILE=16384
#CONFINE_MAXLOGINS=20

# local -- ssh -L to their own app works, ssh -R relays do not. The relay is
# the one that matters: it turns the box into an open proxy under our IP.
# no -- no forwarding at all. yes -- off, this box is a jump host on purpose.
#CONFINE_SSH_FORWARDING=local
#CONFINE_SSH=1

# ── tailscale ────────────────────────────────────────────────────────────────

# Joins the tailnet unattended. Without it the script prints the command to run
# by hand, which is the right answer for a box you are sitting in front of.
#TS_AUTHKEY=
#TS_HOSTNAME=

# ── the landing page ─────────────────────────────────────────────────────────

# The team blog is one account's userdir rather than its own vhost, so the
# landing page has to be told whose. Unset means no blog section at all, which
# beats a link to a 404.
#BLOG_USER=
#BLOG_TITLE=the team blog

# ── sponsor ad ───────────────────────────────────────────────────────────────

# Off unless a slot id is set, and there is deliberately no default one: an ad
# slot is an account, so a shared default would bill every box that ever ran
# this script to whoever owned that slot.
#SPONSOR_AD_SLOT=