57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
beszel
Beszel monitoring hub behind Caddy. Agents push metrics to the hub; OIDC sign-in is configured in the admin UI after first deploy.
Required .env values
| Variable | Notes |
|---|---|
BESZEL_DOMAIN |
Public hostname (e.g. monitoring.example.com). |
ACME_EMAIL |
Let's Encrypt registration email. |
USER_CREATION |
true lets OIDC auto-create accounts on first login. |
See .env.example for image tags.
Deploy
./automations.sh # Deploy on this host → deploy: beszel
Or build + run the self-contained artifact:
./build.sh
scp deploy.sh root@host:
ssh root@host 'bash deploy.sh'
# non-interactive:
# BESZEL_DOMAIN=monitoring.example.com ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
Unattended provisioning: cloud-init.yml.
Notes
- No Anubis PoW gate here — it would break agent connections.
- For OIDC login, point Beszel at your pocket-id in the admin UI.
- DNS for
BESZEL_DOMAINmust resolve to the host and 80/443 be reachable before deploy.