xosna/Ubuntu-24.04-LXC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ubuntu-lxc.sh aktualisiert

Browse Source
This commit is contained in:
RolandS
2026-05-26 16:05:17 +02:00
parent 096077c65d
commit 0655b914af
1 changed files with 301 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-lxc.sh
+301 -136
View File
@@ -1,6 +1,6 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# ============================================================================== # ==============================================================================
# Proxmox LXC: Ubuntu Server LTS (minimal, sauber, produktionsbereit) # Proxmox LXC: Ubuntu Server 26.04 LTS
# Aufruf auf dem PVE-Host: # Aufruf auf dem PVE-Host:
# bash <(curl -fsSL https://your-host/ubuntu-lxc.sh) # bash <(curl -fsSL https://your-host/ubuntu-lxc.sh)
# ============================================================================== # ==============================================================================
@@ -22,18 +22,17 @@ command -v pct &>/dev/null || error "'pct' nicht gefunden – läuft das Skrip
command -v pvesh &>/dev/null || error "'pvesh' nicht gefunden – läuft das Skript auf einem PVE-Host?" command -v pvesh &>/dev/null || error "'pvesh' nicht gefunden – läuft das Skript auf einem PVE-Host?"
# ══════════════════════════════════════════════════════════════════════════════ # ══════════════════════════════════════════════════════════════════════════════
echo -e "\n${BOLD}╔══════════════════════════════════════════════════╗${NC}" echo -e "\n${BOLD}╔══════════════════════════════════════════════════════════╗${NC}"
echo -e "${BOLD}║ Proxmox LXC – Ubuntu LTS Installer ║${NC}" echo -e "${BOLD}║ Proxmox LXC – Ubuntu Server 26.04 LTS Installer ║${NC}"
echo -e "${BOLD}╚══════════════════════════════════════════════════╝${NC}\n" echo -e "${BOLD}╚══════════════════════════════════════════════════════════╝${NC}\n"
# ── Standardwerte ────────────────────────────────────────────────────────────── # ── Standardwerte ──────────────────────────────────────────────────────────────
DEFAULT_CTID=$(pvesh get /cluster/nextid) DEFAULT_CTID=$(pvesh get /cluster/nextid)
DEFAULT_HOSTNAME="ubuntu" DEFAULT_HOSTNAME="ubuntu-server"
DEFAULT_PASSWORD="ChangeMe123!" DEFAULT_DISK=8 # GB (Ubuntu braucht mehr als Debian)
DEFAULT_DISK=4 # GB DEFAULT_RAM=1024 # MB
DEFAULT_RAM=1024 # MB (Ubuntu LTS empfohlen)
DEFAULT_SWAP=512 # MB DEFAULT_SWAP=512 # MB
DEFAULT_CORES=1 DEFAULT_CORES=2
DEFAULT_BRIDGE="vmbr0" DEFAULT_BRIDGE="vmbr0"
DEFAULT_IP="dhcp" DEFAULT_IP="dhcp"
DEFAULT_GW="" DEFAULT_GW=""
@@ -53,6 +52,23 @@ ask_yn() {
[[ "${yn:-$default}" =~ ^[Jj1Yy] ]] [[ "${yn:-$default}" =~ ^[Jj1Yy] ]]
} }
ask_password() {
local prompt="$1" var_name="$2"
local pw1 pw2
while true; do
echo -ne "${BOLD}${prompt}${NC}: "
read -rs pw1; echo ""
echo -ne "${BOLD}Passwort bestätigen${NC}: "
read -rs pw2; echo ""
if [[ "$pw1" != "$pw2" ]]; then
warn "Passwörter stimmen nicht überein – bitte erneut eingeben."
else
printf -v "$var_name" '%s' "$pw1"
break
fi
done
}
# ── Storage-Auswahl (dynamisch) ──────────────────────────────────────────────── # ── Storage-Auswahl (dynamisch) ────────────────────────────────────────────────
select_storage() { select_storage() {
echo -e "${CYAN}── Storage-Auswahl ──────────────────────────────────────────${NC}" echo -e "${CYAN}── Storage-Auswahl ──────────────────────────────────────────${NC}"
@@ -128,21 +144,87 @@ select_storage() {
echo "" echo ""
} }
# ── Ubuntu-Template auswählen ──────────────────────────────────────────────────
select_ubuntu_template() {
echo -e "${CYAN}── Ubuntu-Template ──────────────────────────────────────────${NC}"
echo -e " Verfügbare Ubuntu-Templates:\n"
# Alle Ubuntu-Templates aus PVE-Datenbank holen (lokal heruntergeladen + verfügbar)
mapfile -t AVAIL < <(
pveam available --section system 2>/dev/null \
| awk '/ubuntu/ {print $2}' | sort -V
)
mapfile -t LOCAL < <(
pveam list local 2>/dev/null \
| awk '/ubuntu/ {print $1}' | sort -V
)
if [[ ${#AVAIL[@]} -eq 0 ]]; then
warn "Keine Ubuntu-Templates in der PVE-Datenbank. Versuche 'pveam update'."
UBUNTU_TEMPLATE=""
return
fi
local i=1
local -a TNAMES=()
local default_idx=1
printf " ${BOLD}%-4s %-55s %-12s${NC}\n" "Nr." "Template" "Status"
echo -e " ──────────────────────────────────────────────────────────────────"
for t in "${AVAIL[@]}"; do
local status="${YELLOW}verfügbar${NC}"
local bold_start="" bold_end=""
# Prüfen ob lokal vorhanden
for l in "${LOCAL[@]}"; do
if [[ "$l" == *"$t"* ]]; then
status="${GREEN}lokal vorhanden${NC}"
break
fi
done
# 26.04 als Default vormerken
if [[ "$t" == *"26.04"* ]]; then
default_idx=$i
bold_start="${BOLD}"
bold_end="${NC}"
fi
printf " ${BOLD}%-4s${NC} ${bold_start}%-55s${bold_end} " "[$i]" "$t"
echo -e "$status"
TNAMES+=("$t")
(( i++ ))
done
echo ""
while true; do
echo -ne "${BOLD}Auswahl (Nummer eingeben)${NC} [${YELLOW}${default_idx}${NC}]: "
read -r sel
sel="${sel:-$default_idx}"
if [[ "$sel" =~ ^[0-9]+$ ]] && (( sel >= 1 && sel <= ${#TNAMES[@]} )); then
UBUNTU_TEMPLATE="${TNAMES[$((sel-1))]}"
success "Template gewählt: ${BOLD}${UBUNTU_TEMPLATE}${NC}"
break
else
warn "Ungültige Eingabe."
fi
done
echo ""
}
# ══════════════════════════════════════════════════════════════════════════════ # ══════════════════════════════════════════════════════════════════════════════
# KONFIGURATION # KONFIGURATION
# ══════════════════════════════════════════════════════════════════════════════ # ══════════════════════════════════════════════════════════════════════════════
echo -e "${CYAN}── Container-Grundkonfiguration ─────────────────────────────${NC}" echo -e "${CYAN}── Container-Grundkonfiguration ─────────────────────────────${NC}"
ask "Container-ID" "$DEFAULT_CTID" CTID ask "Container-ID" "$DEFAULT_CTID" CTID
ask "Hostname" "$DEFAULT_HOSTNAME" HOSTNAME ask "Hostname" "$DEFAULT_HOSTNAME" HOSTNAME
ask "Root-Passwort" "$DEFAULT_PASSWORD" PASSWORD ask_password "Root-Passwort" PASSWORD
echo "" echo ""
select_storage select_storage
ask "Disk-Größe (GB)" "$DEFAULT_DISK" DISK ask "Disk-Größe (GB)" "$DEFAULT_DISK" DISK
ask "RAM (MB)" "$DEFAULT_RAM" RAM ask "RAM (MB)" "$DEFAULT_RAM" RAM
ask "Swap (MB)" "$DEFAULT_SWAP" SWAP ask "Swap (MB)" "$DEFAULT_SWAP" SWAP
ask "CPU-Kerne" "$DEFAULT_CORES" CORES ask "CPU-Kerne" "$DEFAULT_CORES" CORES
ask "Netzwerk-Bridge" "$DEFAULT_BRIDGE" BRIDGE ask "Netzwerk-Bridge" "$DEFAULT_BRIDGE" BRIDGE
echo "" echo ""
echo -e "${CYAN}── Netzwerk ──────────────────────────────────────────────────${NC}" echo -e "${CYAN}── Netzwerk ──────────────────────────────────────────────────${NC}"
@@ -161,6 +243,31 @@ else
UNPRIVILEGED=0 UNPRIVILEGED=0
fi fi
echo ""
echo -e "${CYAN}── Zeitzone ──────────────────────────────────────────────────${NC}"
ask "Zeitzone" "Europe/Berlin" TIMEZONE
echo ""
echo -e "${CYAN}── Ubuntu-spezifische Einstellungen ──────────────────────────${NC}"
if ask_yn "Unattended-Upgrades aktivieren? (automatische Sicherheitsupdates)" "j"; then
ENABLE_UNATTENDED=true
else
ENABLE_UNATTENDED=false
fi
if ask_yn "Snap-Dienst deaktivieren? (spart Ressourcen im LXC)" "j"; then
DISABLE_SNAP=true
else
DISABLE_SNAP=false
fi
if ask_yn "Ubuntu Pro / ESM Werbemeldungen deaktivieren?" "j"; then
DISABLE_PRO_MOTD=true
else
DISABLE_PRO_MOTD=false
fi
echo "" echo ""
echo -e "${CYAN}── Optionale Pakete ──────────────────────────────────────────${NC}" echo -e "${CYAN}── Optionale Pakete ──────────────────────────────────────────${NC}"
echo -e " Wähle zusätzliche Pakete die installiert werden sollen:\n" echo -e " Wähle zusätzliche Pakete die installiert werden sollen:\n"
@@ -183,7 +290,7 @@ else
INSTALL_EDITORS=false INSTALL_EDITORS=false
fi fi
if ask_yn "ufw (Firewall, deaktiviert)" "n"; then if ask_yn "ufw (Firewall, vorkonfiguriert aber deaktiviert)" "n"; then
INSTALL_UFW=true INSTALL_UFW=true
else else
INSTALL_UFW=false INSTALL_UFW=false
@@ -201,10 +308,6 @@ else
INSTALL_FAIL2BAN=false INSTALL_FAIL2BAN=false
fi fi
echo ""
echo -e "${CYAN}── Zeitzone ──────────────────────────────────────────────────${NC}"
ask "Zeitzone" "Europe/Berlin" TIMEZONE
echo "" echo ""
echo -e "${CYAN}── SSH-Zugriff ───────────────────────────────────────────────${NC}" echo -e "${CYAN}── SSH-Zugriff ───────────────────────────────────────────────${NC}"
if ask_yn "SSH-Root-Login von externen Terminals aktivieren?" "j"; then if ask_yn "SSH-Root-Login von externen Terminals aktivieren?" "j"; then
@@ -241,25 +344,33 @@ else
SSH_AUTH="password" SSH_AUTH="password"
fi fi
echo ""
echo -e "${CYAN}── Template-Auswahl ──────────────────────────────────────────${NC}"
select_ubuntu_template
# ── Zusammenfassung ──────────────────────────────────────────────────────────── # ── Zusammenfassung ────────────────────────────────────────────────────────────
echo "" echo ""
echo -e "${BOLD}╔══════════════════ Zusammenfassung ════════════════════╗${NC}" echo -e "${BOLD}╔══════════════════════ Zusammenfassung ════════════════════════╗${NC}"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Container-ID:" "$CTID" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Container-ID:" "$CTID"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Hostname:" "$HOSTNAME" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Hostname:" "$HOSTNAME"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Storage:" "$STORAGE" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Template:" "$UBUNTU_TEMPLATE"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Disk / RAM / Swap:" "${DISK} GB / ${RAM} MB / ${SWAP} MB" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Storage:" "$STORAGE"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "CPU-Kerne:" "$CORES" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Disk / RAM / Swap:" "${DISK} GB / ${RAM} MB / ${SWAP} MB"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Netzwerk:" "$IP_ADDR" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "CPU-Kerne:" "$CORES"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Zeitzone:" "$TIMEZONE" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Netzwerk:" "$IP_ADDR"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Unprivilegiert:" "$( [[ $UNPRIVILEGED -eq 1 ]] && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Zeitzone:" "$TIMEZONE"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Basis-Tools:" "$( $INSTALL_BASETOOLS && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Unprivilegiert:" "$( [[ $UNPRIVILEGED -eq 1 ]] && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Monitoring-Tools:" "$( $INSTALL_MONITORING && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Unattended-Upgrades:" "$( $ENABLE_UNATTENDED && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Editoren:" "$( $INSTALL_EDITORS && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Snap deaktiviert:" "$( $DISABLE_SNAP && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "UFW Firewall:" "$( $INSTALL_UFW && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Ubuntu-Pro-MOTD aus:" "$( $DISABLE_PRO_MOTD && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Cron/Logrotate:" "$( $INSTALL_CRON && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Basis-Tools:" "$( $INSTALL_BASETOOLS && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "fail2ban:" "$( $INSTALL_FAIL2BAN && echo "Ja" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Monitoring-Tools:" "$( $INSTALL_MONITORING && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-22s %-26s ${BOLD}║${NC}\n" "Root-SSH:" "$( $ENABLE_ROOT_SSH && echo "Ja (Port ${SSH_PORT}, ${SSH_AUTH})" || echo "Nein" )" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Editoren:" "$( $INSTALL_EDITORS && echo "Ja" || echo "Nein" )"
echo -e "${BOLD}╚═══════════════════════════════════════════════════════╝${NC}" printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "UFW Firewall:" "$( $INSTALL_UFW && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Cron/Logrotate:" "$( $INSTALL_CRON && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "fail2ban:" "$( $INSTALL_FAIL2BAN && echo "Ja" || echo "Nein" )"
printf "${BOLD}║${NC} %-26s %-28s ${BOLD}║${NC}\n" "Root-SSH:" "$( $ENABLE_ROOT_SSH && echo "Ja (Port ${SSH_PORT}, ${SSH_AUTH})" || echo "Nein" )"
echo -e "${BOLD}╚═══════════════════════════════════════════════════════════════╝${NC}"
echo "" echo ""
ask_yn "Jetzt installieren?" "j" || { echo "Abgebrochen."; exit 0; } ask_yn "Jetzt installieren?" "j" || { echo "Abgebrochen."; exit 0; }
@@ -267,21 +378,18 @@ ask_yn "Jetzt installieren?" "j" || { echo "Abgebrochen."; exit 0; }
# INSTALLATION # INSTALLATION
# ══════════════════════════════════════════════════════════════════════════════ # ══════════════════════════════════════════════════════════════════════════════
# ── Ubuntu-Template herunterladen ────────────────────────────────────────────── # ── Template herunterladen falls nötig ────────────────────────────────────────
info "Suche aktuelles Ubuntu-LXC-Template …" info "Prüfe Template: ${UBUNTU_TEMPLATE} …"
TEMPLATE_STORAGE="local" TEMPLATE_STORAGE="local"
TEMPLATE=$(pveam available --section system | awk '/ubuntu-24\.04/ {print $2}' | sort -V | tail -1) DOWNLOADED=$(pveam list "$TEMPLATE_STORAGE" 2>/dev/null | awk '{print $1}' | grep -F "$UBUNTU_TEMPLATE" || true)
[[ -z "$TEMPLATE" ]] && error "Kein Ubuntu-LTS-Template gefunden. Bitte 'pveam update' ausführen!"
DOWNLOADED=$(pveam list "$TEMPLATE_STORAGE" 2>/dev/null | awk '{print $1}' | grep -F "$TEMPLATE" || true)
if [[ -z "$DOWNLOADED" ]]; then if [[ -z "$DOWNLOADED" ]]; then
info "Lade Template herunter: $TEMPLATE" info "Lade Template herunter …"
pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" pveam download "$TEMPLATE_STORAGE" "$UBUNTU_TEMPLATE"
success "Template geladen." success "Template heruntergeladen."
else else
success "Template bereits vorhanden: $TEMPLATE" success "Template bereits vorhanden."
fi fi
TEMPLATE_PATH="${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" TEMPLATE_PATH="${TEMPLATE_STORAGE}:vztmpl/${UBUNTU_TEMPLATE}"
# ── LXC-Container erstellen ──────────────────────────────────────────────────── # ── LXC-Container erstellen ────────────────────────────────────────────────────
info "Erstelle LXC-Container $CTID …" info "Erstelle LXC-Container $CTID …"
@@ -313,20 +421,28 @@ success "Container $CTID erstellt."
# ── Container starten ────────────────────────────────────────────────────────── # ── Container starten ──────────────────────────────────────────────────────────
info "Starte Container …" info "Starte Container …"
pct start "$CTID" pct start "$CTID"
sleep 5 sleep 6
# ── Hilfsfunktion ────────────────────────────────────────────────────────────── # ── Hilfsfunktion ──────────────────────────────────────────────────────────────
lxc_exec() { pct exec "$CTID" -- bash -c "$*"; } lxc_exec() { pct exec "$CTID" -- bash -c "$*"; }
# ── Ubuntu-spezifisch: DEBIAN_FRONTEND nichtinteraktiv setzen ─────────────────
lxc_exec "echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections 2>/dev/null || true"
# ── System aktualisieren ─────────────────────────────────────────────────────── # ── System aktualisieren ───────────────────────────────────────────────────────
info "System aktualisieren …" info "System aktualisieren (apt update & upgrade) …"
lxc_exec "apt-get update -qq && apt-get upgrade -y -qq" lxc_exec "
lxc_exec "apt-get install -y -qq ca-certificates locales" export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get upgrade -y -qq -o Dpkg::Options::='--force-confold'
apt-get install -y -qq ca-certificates locales
"
success "System aktuell." success "System aktuell."
# ── Zeitzone setzen ──────────────────────────────────────────────────────────── # ── Zeitzone setzen ────────────────────────────────────────────────────────────
info "Zeitzone setzen: ${TIMEZONE} …" info "Zeitzone setzen: ${TIMEZONE} …"
lxc_exec " lxc_exec "
export DEBIAN_FRONTEND=noninteractive
ln -sf /usr/share/zoneinfo/${TIMEZONE} /etc/localtime ln -sf /usr/share/zoneinfo/${TIMEZONE} /etc/localtime
echo '${TIMEZONE}' > /etc/timezone echo '${TIMEZONE}' > /etc/timezone
dpkg-reconfigure -f noninteractive tzdata 2>/dev/null || true dpkg-reconfigure -f noninteractive tzdata 2>/dev/null || true
@@ -334,44 +450,88 @@ dpkg-reconfigure -f noninteractive tzdata 2>/dev/null || true
success "Zeitzone gesetzt." success "Zeitzone gesetzt."
# ── Locale konfigurieren ─────────────────────────────────────────────────────── # ── Locale konfigurieren ───────────────────────────────────────────────────────
info "Locale konfigurieren (de_DE.UTF-8 + en_US.UTF-8) …" info "Locale konfigurieren …"
lxc_exec " lxc_exec "
sed -i 's/^# *de_DE.UTF-8/de_DE.UTF-8/' /etc/locale.gen export DEBIAN_FRONTEND=noninteractive
sed -i 's/^# *en_US.UTF-8/en_US.UTF-8/' /etc/locale.gen sed -i 's/^# *de_DE.UTF-8/de_DE.UTF-8/' /etc/locale.gen 2>/dev/null || true
locale-gen 2>/dev/null sed -i 's/^# *en_US.UTF-8/en_US.UTF-8/' /etc/locale.gen 2>/dev/null || true
update-locale LANG=de_DE.UTF-8 LC_MESSAGES=en_US.UTF-8 locale-gen 2>/dev/null || true
" 2>/dev/null || warn "Locale-Konfiguration übersprungen." update-locale LANG=de_DE.UTF-8 LC_MESSAGES=en_US.UTF-8 2>/dev/null || true
" 2>/dev/null
success "Locale konfiguriert." success "Locale konfiguriert."
# ── Snap deaktivieren (Ubuntu-spezifisch) ─────────────────────────────────────
if $DISABLE_SNAP; then
info "Snap deaktivieren …"
lxc_exec "
# Snap läuft in LXC oft nicht korrekt und kostet Ressourcen
systemctl stop snapd 2>/dev/null || true
systemctl disable snapd 2>/dev/null || true
systemctl mask snapd 2>/dev/null || true
apt-get purge -y -qq snapd 2>/dev/null || true
rm -rf /snap /var/snap /var/lib/snapd /var/cache/snapd ~/snap 2>/dev/null || true
# Snap-APT-Pin setzen damit er nicht neu installiert wird
cat > /etc/apt/preferences.d/no-snapd << 'SNAP_PIN'
Package: snapd
Pin: release a=*
Pin-Priority: -10
SNAP_PIN
" 2>/dev/null
success "Snap deaktiviert und gesperrt."
fi
# ── Ubuntu Pro / ESM MOTD-Werbung deaktivieren ────────────────────────────────
if $DISABLE_PRO_MOTD; then
info "Ubuntu Pro MOTD-Meldungen deaktivieren …"
lxc_exec "
# MOTD-Skripte die Ubuntu Pro bewerben deaktivieren
chmod -x /etc/update-motd.d/10-help-text 2>/dev/null || true
chmod -x /etc/update-motd.d/50-motd-news 2>/dev/null || true
chmod -x /etc/update-motd.d/88-esm-announce 2>/dev/null || true
chmod -x /etc/update-motd.d/91-contract-ua-esm-status 2>/dev/null || true
chmod -x /etc/update-motd.d/95-hwe-eol 2>/dev/null || true
# pro config falls vorhanden
command -v pro &>/dev/null && pro config set motd=false 2>/dev/null || true
" 2>/dev/null
success "Ubuntu Pro MOTD deaktiviert."
fi
# ── Unattended-Upgrades konfigurieren ─────────────────────────────────────────
if $ENABLE_UNATTENDED; then
info "Unattended-Upgrades (automatische Sicherheitsupdates) konfigurieren …"
lxc_exec "
export DEBIAN_FRONTEND=noninteractive
apt-get install -y -qq unattended-upgrades update-notifier-common
cat > /etc/apt/apt.conf.d/20auto-upgrades << 'AUTO'
APT::Periodic::Update-Package-Lists \"1\";
APT::Periodic::Unattended-Upgrade \"1\";
APT::Periodic::AutocleanInterval \"7\";
APT::Periodic::Download-Upgradeable-Packages \"1\";
AUTO
# Nur Security-Updates automatisch einspielen
sed -i 's|//\s*\"\${distro_id}:\${distro_codename}-security\";|\"\${distro_id}:\${distro_codename}-security\";|' \
/etc/apt/apt.conf.d/50unattended-upgrades 2>/dev/null || true
systemctl enable unattended-upgrades --now 2>/dev/null || true
"
success "Unattended-Upgrades aktiv (nur Security-Updates)."
fi
# ── Optionale Pakete installieren ────────────────────────────────────────────── # ── Optionale Pakete installieren ──────────────────────────────────────────────
PKGS=() PKGS=()
$INSTALL_BASETOOLS && PKGS+=(curl wget git)
if $INSTALL_BASETOOLS; then $INSTALL_MONITORING && PKGS+=(htop ncdu tree net-tools iputils-ping)
PKGS+=(curl wget git) $INSTALL_EDITORS && PKGS+=(vim nano)
fi $INSTALL_CRON && PKGS+=(cron logrotate)
if $INSTALL_MONITORING; then $INSTALL_FAIL2BAN && PKGS+=(fail2ban)
PKGS+=(htop ncdu tree net-tools iputils-ping) $INSTALL_UFW && PKGS+=(ufw)
fi
if $INSTALL_EDITORS; then
PKGS+=(vim nano)
fi
if $INSTALL_CRON; then
PKGS+=(cron logrotate)
fi
if $INSTALL_FAIL2BAN; then
PKGS+=(fail2ban)
fi
if $INSTALL_UFW; then
PKGS+=(ufw)
fi
if [[ ${#PKGS[@]} -gt 0 ]]; then if [[ ${#PKGS[@]} -gt 0 ]]; then
info "Installiere optionale Pakete: ${PKGS[*]} …" info "Installiere optionale Pakete: ${PKGS[*]} …"
lxc_exec "apt-get install -y -qq ${PKGS[*]}" lxc_exec "export DEBIAN_FRONTEND=noninteractive && apt-get install -y -qq ${PKGS[*]}"
success "Pakete installiert." success "Pakete installiert."
fi fi
# ── fail2ban konfigurieren (falls installiert) ───────────────────────────────── # ── fail2ban konfigurieren ─────────────────────────────────────────────────────
if $INSTALL_FAIL2BAN; then if $INSTALL_FAIL2BAN; then
info "fail2ban konfigurieren …" info "fail2ban konfigurieren …"
lxc_exec " lxc_exec "
@@ -385,19 +545,19 @@ backend = systemd
[sshd] [sshd]
enabled = true enabled = true
F2B F2B
systemctl enable fail2ban --now systemctl enable fail2ban --now 2>/dev/null || true
" "
success "fail2ban aktiv (SSH-Schutz: 5 Versuche / 10 Min → 1h Ban)." success "fail2ban aktiv (SSH-Schutz: 5 Versuche / 10 Min → 1h Ban)."
fi fi
# ── UFW konfigurieren (falls installiert) ────────────────────────────────────── # ── UFW konfigurieren ──────────────────────────────────────────────────────────
if $INSTALL_UFW; then if $INSTALL_UFW; then
info "UFW vorbereiten (deaktiviert, SSH freigegeben) …" info "UFW vorkonfigurieren (deaktiviert, SSH freigegeben) …"
lxc_exec " lxc_exec "
ufw default deny incoming ufw default deny incoming
ufw default allow outgoing ufw default allow outgoing
ufw allow ${SSH_PORT}/tcp comment 'SSH' ufw allow ${SSH_PORT}/tcp comment 'SSH'
# ufw enable ← bewusst nicht aktiviert; bitte manuell nach Prüfung aktivieren # Bewusst nicht aktiviert – bitte manuell mit 'ufw enable' aktivieren
" "
success "UFW konfiguriert (noch deaktiviert – mit 'ufw enable' aktivieren)." success "UFW konfiguriert (noch deaktiviert – mit 'ufw enable' aktivieren)."
fi fi
@@ -405,35 +565,33 @@ fi
# ── SSH vollständig konfigurieren ───────────────────────────────────────────── # ── SSH vollständig konfigurieren ─────────────────────────────────────────────
if $ENABLE_ROOT_SSH; then if $ENABLE_ROOT_SSH; then
info "Installiere und konfiguriere SSH-Server …" info "Installiere und konfiguriere SSH-Server …"
lxc_exec "apt-get install -y -qq openssh-server" lxc_exec "export DEBIAN_FRONTEND=noninteractive && apt-get install -y -qq openssh-server"
# Ubuntu 22.04+ nutzt /etc/ssh/sshd_config.d/ – wir schreiben eine Override-Datei
lxc_exec " lxc_exec "
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config mkdir -p /etc/ssh/sshd_config.d
grep -q '^PermitRootLogin' /etc/ssh/sshd_config || echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config cat > /etc/ssh/sshd_config.d/99-proxmox-lxc.conf << SSHCFG
sed -i 's/^#*Port .*/Port ${SSH_PORT}/' /etc/ssh/sshd_config PermitRootLogin yes
grep -q '^Port ' /etc/ssh/sshd_config || echo 'Port ${SSH_PORT}' >> /etc/ssh/sshd_config Port ${SSH_PORT}
SSHCFG
" "
if [[ "$SSH_AUTH" == "password" ]]; then if [[ "$SSH_AUTH" == "password" ]]; then
lxc_exec " lxc_exec "
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
grep -q '^PasswordAuthentication' /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config echo 'PubkeyAuthentication no' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication no/' /etc/ssh/sshd_config
" "
elif [[ "$SSH_AUTH" == "key" ]]; then elif [[ "$SSH_AUTH" == "key" ]]; then
lxc_exec " lxc_exec "
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
grep -q '^PubkeyAuthentication' /etc/ssh/sshd_config || echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
mkdir -p /root/.ssh && chmod 700 /root/.ssh mkdir -p /root/.ssh && chmod 700 /root/.ssh
echo '${SSH_PUBKEY}' >> /root/.ssh/authorized_keys echo '${SSH_PUBKEY}' >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys
" "
else else
lxc_exec " lxc_exec "
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
grep -q '^PasswordAuthentication' /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config.d/99-proxmox-lxc.conf
sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
grep -q '^PubkeyAuthentication' /etc/ssh/sshd_config || echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
mkdir -p /root/.ssh && chmod 700 /root/.ssh mkdir -p /root/.ssh && chmod 700 /root/.ssh
echo '${SSH_PUBKEY}' >> /root/.ssh/authorized_keys echo '${SSH_PUBKEY}' >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys
@@ -453,36 +611,19 @@ chmod 600 /root/.ssh/authorized_keys
fi fi
# ── Proxmox Hinweise-Panel setzen (Markdown) ────────────────────────────────── # ── Proxmox Hinweise-Panel setzen (Markdown) ──────────────────────────────────
info "Setze Proxmox-Hinweise (Notes) für Container $CTID …" info "Setze Proxmox-Hinweise (Notes) …"
sleep 2 sleep 2
NOTES_IP=$(pct exec "$CTID" -- hostname -I 2>/dev/null | awk '{print $1}' || echo "") NOTES_IP=$(pct exec "$CTID" -- hostname -I 2>/dev/null | awk '{print $1}' || echo "")
[[ -z "$NOTES_IP" ]] && NOTES_IP="n/a (DHCP – bitte in Konsole prüfen)" [[ -z "$NOTES_IP" ]] && NOTES_IP="n/a (DHCP – bitte in Konsole prüfen)"
# Ubuntu-Version ermitteln UBUNTU_VER=$(pct exec "$CTID" -- bash -c ". /etc/os-release && echo \$VERSION" 2>/dev/null || echo "Ubuntu 26.04 LTS")
UBUNTU_VER=$(pct exec "$CTID" -- bash -c ". /etc/os-release && echo \$VERSION" 2>/dev/null || echo "Ubuntu")
# SSH-Befehl
SSH_LINE="" SSH_LINE=""
if $ENABLE_ROOT_SSH; then if $ENABLE_ROOT_SSH; then
if [[ "$SSH_PORT" == "22" ]]; then [[ "$SSH_PORT" == "22" ]] && SSH_LINE="ssh root@${NOTES_IP}" \
SSH_LINE="ssh root@${NOTES_IP}" || SSH_LINE="ssh root@${NOTES_IP} -p ${SSH_PORT}"
else
SSH_LINE="ssh root@${NOTES_IP} -p ${SSH_PORT}"
fi
fi fi
# Badges + Info als Markdown
NOTE="[![Ubuntu](https://img.shields.io/badge/${UBUNTU_VER// /%20}-A81D33?style=for-the-badge&logo=ubuntu&logoColor=white)](https://ubuntu.com)"
NOTE+=$'\n\n'
NOTE+="---"$'\n\n'
NOTE+="**🌐 IP-Adresse:** \`${NOTES_IP}\`"$'\n\n'
if $ENABLE_ROOT_SSH; then
NOTE+="**🔑 SSH:** \`${SSH_LINE}\`"$'\n\n'
fi
# Installierte optionale Pakete auflisten
INSTALLED_LIST="" INSTALLED_LIST=""
$INSTALL_BASETOOLS && INSTALLED_LIST+="curl wget git " $INSTALL_BASETOOLS && INSTALLED_LIST+="curl wget git "
$INSTALL_MONITORING && INSTALLED_LIST+="htop ncdu net-tools " $INSTALL_MONITORING && INSTALLED_LIST+="htop ncdu net-tools "
@@ -490,14 +631,26 @@ $INSTALL_EDITORS && INSTALLED_LIST+="vim nano "
$INSTALL_CRON && INSTALLED_LIST+="cron logrotate " $INSTALL_CRON && INSTALLED_LIST+="cron logrotate "
$INSTALL_FAIL2BAN && INSTALLED_LIST+="fail2ban " $INSTALL_FAIL2BAN && INSTALLED_LIST+="fail2ban "
$INSTALL_UFW && INSTALLED_LIST+="ufw " $INSTALL_UFW && INSTALLED_LIST+="ufw "
$ENABLE_UNATTENDED && INSTALLED_LIST+="unattended-upgrades "
NOTE="[![Ubuntu](https://img.shields.io/badge/Ubuntu%2026.04%20LTS-E95420?style=for-the-badge&logo=ubuntu&logoColor=white)](https://ubuntu.com/server)"
NOTE+=$'\n\n'
NOTE+="---"$'\n\n'
NOTE+="**🌐 IP-Adresse:** \`${NOTES_IP}\`"$'\n\n'
if $ENABLE_ROOT_SSH; then
NOTE+="**🔑 SSH:** \`${SSH_LINE}\`"$'\n\n'
fi
if [[ -n "$INSTALLED_LIST" ]]; then if [[ -n "$INSTALLED_LIST" ]]; then
NOTE+="**📦 Pakete:** \`${INSTALLED_LIST% }\`"$'\n\n' NOTE+="**📦 Pakete:** \`${INSTALLED_LIST% }\`"$'\n\n'
fi fi
NOTE+="**🕐 Zeitzone:** ${TIMEZONE}"$'\n\n' NOTE+="**🕐 Zeitzone:** ${TIMEZONE}"$'\n\n'
$DISABLE_SNAP && NOTE+="**🚫 Snap:** deaktiviert"$'\n\n'
$ENABLE_UNATTENDED && NOTE+="**🔒 Auto-Updates:** aktiv (Security)"$'\n\n'
NOTE+="---"$'\n\n' NOTE+="---"$'\n\n'
NOTE+="Installiert mit [gitea.vourx.com](https://gitea.vourx.com)" NOTE+="Installiert mit [gitea.vourx.com](https://gitea.vourx.com)"
NOTE+=" | [Ubuntu Docs](https://ubuntu.com/server/docs)" NOTE+=" | [Ubuntu Server Docs](https://ubuntu.com/server/docs)"
NOTE+=" | [Ubuntu Packages](https://packages.ubuntu.com)" NOTE+=" | [Ubuntu Packages](https://packages.ubuntu.com)"
pvesh set /nodes/$(hostname)/lxc/${CTID}/config --description "${NOTE}" 2>/dev/null \ pvesh set /nodes/$(hostname)/lxc/${CTID}/config --description "${NOTE}" 2>/dev/null \
@@ -506,38 +659,50 @@ pvesh set /nodes/$(hostname)/lxc/${CTID}/config --description "${NOTE}" 2>/dev/n
# ── System aufräumen ─────────────────────────────────────────────────────────── # ── System aufräumen ───────────────────────────────────────────────────────────
info "System aufräumen …" info "System aufräumen …"
lxc_exec "apt-get autoremove -y -qq && apt-get autoclean -qq" lxc_exec "
export DEBIAN_FRONTEND=noninteractive
apt-get autoremove -y -qq
apt-get autoclean -qq
"
success "Fertig aufgeräumt." success "Fertig aufgeräumt."
# ── Abschluss ────────────────────────────────────────────────────────────────── # ── Abschluss ──────────────────────────────────────────────────────────────────
CONTAINER_IP=$(pct exec "$CTID" -- hostname -I 2>/dev/null | awk '{print $1}' || echo "unbekannt") CONTAINER_IP=$(pct exec "$CTID" -- hostname -I 2>/dev/null | awk '{print $1}' || echo "unbekannt")
echo "" echo ""
echo -e "${BOLD}${GREEN}╔══════════════════════════════════════════════════════╗${NC}" echo -e "${BOLD}${GREEN}╔══════════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║${NC} ${BOLD}Installation abgeschlossen!${NC}" echo -e "${GREEN}║${NC} ${BOLD}Installation abgeschlossen!${NC}"
echo -e "${BOLD}${GREEN}╠══════════════════════════════════════════════════════╣${NC}" echo -e "${BOLD}${GREEN}╠══════════════════════════════════════════════════════════╣${NC}"
echo -e "${GREEN}║${NC}" echo -e "${GREEN}║${NC}"
printf "${GREEN}║${NC} %-20s ${BOLD}%s${NC}\n" "Container-ID:" "$CTID" printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Container-ID:" "$CTID"
printf "${GREEN}║${NC} %-20s ${BOLD}%s${NC}\n" "Hostname:" "$HOSTNAME" printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Hostname:" "$HOSTNAME"
printf "${GREEN}║${NC} %-20s ${BOLD}%s${NC}\n" "IP-Adresse:" "$CONTAINER_IP" printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "IP-Adresse:" "$CONTAINER_IP"
printf "${GREEN}║${NC} %-20s ${BOLD}%s${NC}\n" "Zeitzone:" "$TIMEZONE" printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Template:" "$UBUNTU_TEMPLATE"
printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Zeitzone:" "$TIMEZONE"
echo -e "${GREEN}║${NC}" echo -e "${GREEN}║${NC}"
if $ENABLE_UNATTENDED; then
printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Auto-Updates:" "aktiv (nur Security)"
fi
if $DISABLE_SNAP; then
printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Snap:" "deaktiviert & gesperrt"
fi
if $ENABLE_ROOT_SSH; then if $ENABLE_ROOT_SSH; then
echo -e "${GREEN}║${NC} ${CYAN}── SSH-Verbindung ────────────────────────────────${NC}" echo -e "${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${CYAN}── SSH-Verbindung ──────────────────────────────────────${NC}"
if [[ "$SSH_PORT" == "22" ]]; then if [[ "$SSH_PORT" == "22" ]]; then
printf "${GREEN}║${NC} ${BOLD}ssh root@%s${NC}\n" "$CONTAINER_IP" printf "${GREEN}║${NC} ${BOLD}ssh root@%s${NC}\n" "$CONTAINER_IP"
else else
printf "${GREEN}║${NC} ${BOLD}ssh root@%s -p %s${NC}\n" "$CONTAINER_IP" "$SSH_PORT" printf "${GREEN}║${NC} ${BOLD}ssh root@%s -p %s${NC}\n" "$CONTAINER_IP" "$SSH_PORT"
fi fi
printf "${GREEN}║${NC} %-20s ${BOLD}%s${NC}\n" "Auth-Methode:" "$SSH_AUTH" printf "${GREEN}║${NC} %-22s ${BOLD}%s${NC}\n" "Auth-Methode:" "$SSH_AUTH"
echo -e "${GREEN}║${NC}"
fi fi
if $INSTALL_UFW; then if $INSTALL_UFW; then
echo -e "${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${YELLOW}🔒 UFW installiert aber noch nicht aktiv.${NC}" echo -e "${GREEN}║${NC} ${YELLOW}🔒 UFW installiert aber noch nicht aktiv.${NC}"
echo -e "${GREEN}║${NC} ${YELLOW} Im Container mit 'ufw enable' aktivieren.${NC}" echo -e "${GREEN}║${NC} ${YELLOW} Im Container mit 'ufw enable' aktivieren.${NC}"
echo -e "${GREEN}║${NC}"
fi fi
echo -e "${GREEN}║${NC}"
echo -e "${GREEN}║${NC} ${YELLOW}⚠ Root-Passwort nach erstem Login bitte ändern!${NC}" echo -e "${GREEN}║${NC} ${YELLOW}⚠ Root-Passwort nach erstem Login bitte ändern!${NC}"
echo -e "${GREEN}║${NC}" echo -e "${GREEN}║${NC}"
echo -e "${BOLD}${GREEN}╚══════════════════════════════════════════════════════╝${NC}" echo -e "${BOLD}${GREEN}╚══════════════════════════════════════════════════════════╝${NC}"
echo "" echo ""