01 / SERVER ESSENTIALS

Start with a useful foundation.

For a fresh Debian, Ubuntu, RHEL-family, or Alpine VPS. Eight essentials by default. Opt in to a sudo user, key-only SSH, a firewall, security updates, swap, and a time zone, each with lockout checks.

New machine, not reinstalled yet? Consider reinstalling a clean official system first. Coming from the reinstall page selects the system for you.

01 Choose your tools→02 Review the commands→03 Run in your own terminal

Your essentials

Requires root or a user with sudo. Package names are translated for the system you choose.

Server system

Debian / UbuntuRocky / Alma / CentOSAlpine

Debian 12/13, Ubuntu 22.04–26.04; Rocky / AlmaLinux 8–10, CentOS Stream 9/10, RHEL (dnf, some tools from EPEL); Alpine 3.x (apk + OpenRC). The script checks the host first and stops on a mismatch.

Package manager (Debian / Ubuntu only)

aptnala

apt ships with your system. Choosing nala installs it through apt first. RHEL-family systems use dnf; Alpine uses apk.

Base

sudoLets a later normal user run commands as root. Leave Run as on root while you are still root.curlDownload files and call HTTP APIs.wgetDownload a URL into a file.gitClone and update repositories.ca-certificatesTrust public HTTPS certificates.gnupgCheck signatures on repository keys.

Session and sync

tmuxKeep a shell session after you disconnect.screenAnother detachable terminal session.rsyncCopy directories and keep them in sync.

Files and JSON

jqFilter and print JSON.zstdCompress and decompress .zst files.zipPack files into a zip archive.unzipUnpack zip archives.treeShow a directory as a tree.neovimA terminal text editor.

Network

dnsutilsdig and nslookup.net-toolsifconfig, netstat, and route.lsofSee which process holds a file or a port.tracerouteShow the hops to a host.mtrTrace a route and keep measuring it.

Meters

htopA process and CPU viewer.btopCPU, memory, disk, and network in one view.iftopWatch bandwidth by connection.iotopWatch which process is using the disk.

Create a sudo userLog in as a normal user and sudo when needed. You will set its password (for sudo) while the script runs.SSH public keyPaste ~/.ssh/id_ed25519.pub from your computer (the public key, never the private one). No key yet? Run ssh-keygen -t ed25519 locally. Added for the new user, or for root when no user is created.Turn off SSH password loginKeys only, which stops most brute-force attempts. Runs last, checks that the user has a key, and validates with sshd -t.Enable a firewall (UFW / firewalld)Reads the port sshd actually uses and allows it before enabling. UFW on Debian, Ubuntu, and Alpine; firewalld on RHEL-family systems.Install security updates automaticallyunattended-upgrades on Debian and Ubuntu, dnf-automatic on RHEL-family systems. Checks daily and never reboots. Not available on Alpine.

Optional system settings

Time zoneAffects log timestamps and scheduled jobs.Swap fileRecommended for 1–2 GB machines so Docker workloads are not killed when memory runs out. Skipped when swap exists.Upgrade system packagesfull-upgrade may remove packages. Does not reboot automatically.Add ll and tailfAppends the aliases to ~/.bashrc when the ll line is missing.HostnamePassed to hostnamectl. Letters, digits, and hyphens only.Run nala fetchInteractive. It ranks mirrors and rewrites apt sources after you confirm one.

Output & execution identity

How to use it

PasteScript

Paste mode stops on errors inside a subshell, preserving your SSH session. Script mode is for reviewing and saving a file.

Run as

rootsudo

A fresh reinstall is root, so the default commands have no sudo. Choose sudo when you are a normal user and sudo is already installed.

YOUR SETUP / GENERATED COMMANDS

bootstrap.txt

1(2set -eu3. /etc/os-release4case "$ID" in debian|ubuntu) ;; *) echo "This script is for Debian or Ubuntu." >&2; exit 1 ;; esac5apt-get update6apt-get install -y curl ca-certificates gnupg git tmux rsync jq htop7)

Generated here, executed by you. Check the target host, take a snapshot, and run one block at a time.

Ready? Find your next tool →