Admin: Created page with "= Shell Installer Scripts = Self-contained Bash installers for VPS setup. All Telegram-aware scripts read credentials from /etc/telegram.conf (owner root:root, permissions 600). Scripts that require it interactively prompt for missing values during execution; install-shutdown-notify.sh is the exception and performs a hard abort if the file is absent. Remote execution pattern (all scripts):

 curl -s https://coolsc..."

2026-07-28T17:07:10Z

Created page with "= Shell Installer Scripts = Self-contained Bash installers for VPS setup. All Telegram-aware scripts read credentials from <code>/etc/telegram.conf</code> (owner <code>root:root</code>, permissions <code>600</code>). Scripts that require it interactively prompt for missing values during execution; <code>install-shutdown-notify.sh</code> is the exception and performs a hard abort if the file is absent. Remote execution pattern (all scripts): <pre> curl -s https://coolsc..."

New page

= Shell Installer Scripts =

Self-contained Bash installers for VPS setup. All Telegram-aware scripts read credentials from <code>/etc/telegram.conf</code> (owner <code>root:root</code>, permissions <code>600</code>). Scripts that require it interactively prompt for missing values during execution; <code>install-shutdown-notify.sh</code> is the exception and performs a hard abort if the file is absent.

Remote execution pattern (all scripts):
<pre>
curl -s https://coolscript.net/download/shell/<script-name>.sh | sudo bash
</pre>
'''Security:''' piping curl to bash executes unreviewed remote code — only use against URLs you control.

__TOC__

----

= install-sudo.sh =

; '''Run on VPS'''
: <pre>su -c 'curl -s https://coolscript.net/download/shell/install-sudo.sh | bash'</pre>

Installs <code>sudo</code> (if missing) and adds a target non-root user to the <code>sudo</code> group. This is required first on Debian systems that start without <code>sudo</code> preinstalled. No Telegram dependency.

'''Root required.''' Run as root (for example: <code>su -</code>) before executing. You can pass a username as the first script argument; if omitted, the script uses <code>$SUDO_USER</code> or prompts.

== Installation Flow ==

<pre>
[ run as root ] ──► detect target user (arg / $SUDO_USER / prompt)
│
▼
user exists?
├── NO → abort
└── YES → continue
│
▼
sudo installed?
├── YES → skip install
└── NO → apt update && apt install sudo
│
▼
user in sudo group?
├── YES → skip
└── NO → usermod -aG sudo <user>
</pre>

== Notes ==

* Required first step for minimal Debian images that do not include <code>sudo</code>
* Group change applies on next login session

----

= install-telegram-ssh-alert.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-telegram-ssh-alert.sh | sudo bash</pre>

Hooks a Telegram alert into the PAM SSH stack so every successful SSH login sends a message. Uses <code>pam_exec</code> with the <code>optional</code> keyword — alert failure never blocks login. The installer is idempotent (checks for existing PAM line before appending).

== /etc/telegram.conf ==

'''Must exist and contain valid non-empty values.''' If absent or incomplete the installer pauses and prompts interactively — credentials can be entered inline during <code>curl | bash</code> execution.

<pre>
# Telegram Alert Configuration
TELEGRAM_CHAT_ID="-1xxx"
TELEGRAM_BOT_TOKEN="53xxxxx"
</pre>

<code>TELEGRAM_CHAT_ID</code>: negative values are group/channel IDs. <code>TELEGRAM_BOT_TOKEN</code>: issued by <code>@BotFather</code>. Permissions applied automatically; to reapply manually:
<pre>
chown root:root /etc/telegram.conf && chmod 600 /etc/telegram.conf
</pre>

== Alert Script ==

Written to <code>/usr/local/bin/telegram-ssh-alert.sh</code>. Fires only on <code>PAM_TYPE=open_session</code>; ignores auth failures and session close. Sent asynchronously (<code>curl ... &</code>) — zero login latency impact.

{| class="wikitable"
! Variable !! Source !! Content
|-
| <code>PAM_USER</code> || PAM || Logged-in username
|-
| <code>PAM_RHOST</code> || PAM || Remote client IP
|-
| <code>hostname</code> || syscall || VPS hostname
|-
| <code>date</code> || syscall || Timestamp <code>YYYY-MM-DD HH:MM:SS</code>
|}

Message format (HTML parse mode):
<pre>
🚨 SSH Access Alert
───────────────
👤 User: testuser
🖥️ Host: my-vps-hostname
🌐 IP Address: 203.0.113.42
⏰ Time: 2026-07-27 14:35:00
───────────────
</pre>

API call:
<pre>
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
-d "chat_id=${TELEGRAM_CHAT_ID}" \
-d "parse_mode=HTML" \
-d "text=${MESSAGE}" > /dev/null 2>&1 &
</pre>

== PAM Line ==

<pre>
session optional pam_exec.so /usr/local/bin/telegram-ssh-alert.sh
</pre>

== Installation Flow ==

<pre>
[ curl | bash ] ──► root check
│
▼
/etc/telegram.conf exists?
├── YES → variables non-empty? ──► YES → continue
│ └── NO → prompt
└── NO → prompt
│
▼
Write + chmod +x /usr/local/bin/telegram-ssh-alert.sh
│
▼
PAM line in /etc/pam.d/sshd?
├── YES → skip
└── NO → append
│
▼
Live test: PAM_TYPE=open_session PAM_USER=InstallerTest PAM_RHOST=127.0.0.1
</pre>

== Files ==

{| class="wikitable"
! File !! Perm !! Role
|-
| <code>/etc/telegram.conf</code> || 600 || Credentials — must be valid
|-
| <code>/usr/local/bin/telegram-ssh-alert.sh</code> || +x || PAM-invoked alert script
|-
| <code>/etc/pam.d/sshd</code> || — || PAM config (one line appended)
|}

== Troubleshooting ==

{| class="wikitable"
! Symptom !! Cause !! Fix
|-
| No notification on login || <code>/etc/telegram.conf</code> missing or placeholder values || Recreate from template; rerun installer
|-
| Login blocked || PAM line uses <code>required</code> instead of <code>optional</code> || Edit <code>/etc/pam.d/sshd</code> to use <code>optional</code>
|-
| Test works, live SSH does not || PAM cannot read config (wrong permissions) || <code>chmod 600 /etc/telegram.conf</code>, owner must be <code>root</code>
|-
| <code>curl: command not found</code> || curl absent || <code>apt install curl</code> / <code>yum install curl</code>
|-
| Duplicate PAM entries || Installer run multiple times || Remove duplicate lines from <code>/etc/pam.d/sshd</code>
|}

----

= install-boot-notify.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-boot-notify.sh | sudo bash</pre>

Installs a systemd one-shot service (<code>After=network-online.target</code>) that sends hostname, local IP, public IP (<code>ifconfig.me</code>), and timestamp to Telegram on every boot.

'''Root required.''' Interactive — prompts for credentials if <code>/etc/telegram.conf</code> is absent or incomplete (same flow as SSH alert installer). Config file created with <code>chmod 600</code> automatically.

== Files ==

{| class="wikitable"
! File !! Perm !! Role
|-
| <code>/usr/local/bin/telegram-boot-notify.sh</code> || 700 || Notification script
|-
| <code>/etc/systemd/system/telegram-boot-notify.service</code> || — || Systemd unit (enabled automatically)
|-
| <code>/etc/telegram.conf</code> || 600 || Credentials — created if absent
|}

== Systemd Unit ==

<pre>
[Unit]
Description=Send Telegram notification with IP address on startup
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/telegram-boot-notify.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
</pre>

<code>RemainAfterExit=yes</code> keeps the unit active after script exit so <code>systemctl status</code> shows the last run result.

== Notification ==

<pre>
🚀 Server Boot Notification

🖥 Host: my-vps-hostname
📅 Date & Time: 2026-07-27 09:00:00 UTC

📡 IP Addresses:
• Local IP: 10.0.0.5
• Public IP: 203.0.113.42
</pre>

Uses Markdown parse mode. Local IP via <code>ip route get 1.1.1.1</code>; public IP via <code>curl ifconfig.me</code> (10 s timeout, falls back to "Unavailable").

----

= install-shutdown-notify.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-shutdown-notify.sh | sudo bash</pre>

Installs a systemd service that fires a Telegram notification on shutdown or reboot. Detects event type by inspecting active systemd jobs at stop time.

'''Root required.''' '''<code>/etc/telegram.conf</code> must already exist with valid values — this script performs a hard abort if missing or empty. It does not prompt interactively.'''

Validate before running:
<pre>
source /etc/telegram.conf && echo "$TELEGRAM_BOT_TOKEN" && echo "$TELEGRAM_CHAT_ID"
</pre>

== Files ==

{| class="wikitable"
! File !! Perm !! Role
|-
| <code>/usr/local/bin/telegram-shutdown-notify.sh</code> || 700 || Notification script
|-
| <code>/etc/systemd/system/telegram-shutdown-notify.service</code> || — || Systemd unit (enabled automatically)
|}

== Systemd Unit ==

<pre>
[Unit]
Description=Send Telegram notification on system shutdown or reboot
DefaultDependencies=no
After=network-online.target time-sync.target
Requires=network-online.target

[Service]
Type=oneshot
ExecStart=/bin/true
ExecStop=/usr/local/bin/telegram-shutdown-notify.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
</pre>

The notification runs from <code>ExecStop</code> — triggered when systemd stops the unit during shutdown, while the network is still up. <code>DefaultDependencies=no</code> prevents default shutdown ordering from running the unit too late.

== Event Detection ==

{| class="wikitable"
! Detected job !! Message label
|-
| <code>reboot.target</code> starting || Rebooting 🔄
|-
| <code>poweroff.target</code> / <code>halt.target</code> starting || Shutting Down 🛑
|-
| None matched || Stopping / Shutting Down 🛑
|}

== Notification ==

<pre>
🛑 Server Event: Shutting Down 🛑

🖥 Host: my-vps-hostname
📅 Date & Time: 2026-07-27 23:59:00 UTC
⏱ Uptime before event: up 3 days, 4 hours, 12 minutes
</pre>

----

= install-clean-shutdown.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-clean-shutdown.sh | sudo bash</pre>

Installs a udev rule that triggers <code>shutdown -h now</code> when a USB stick with the filesystem label <code>RASPI-CLEAN-SHUTDOWN</code> is inserted. Designed for Raspberry Pi but works on any udev-based Linux system. No Telegram dependency.

Primarily used on Raspberry Pi hosts for clean power-off without keyboard/network access.

'''Root required.''' If the script or rule already exists the installer asks before overwriting; declining skips that component without aborting.

== Files ==

{| class="wikitable"
! File !! Role
|-
| <code>/usr/local/bin/usb-clean-shutdown.sh</code> || Logs via <code>logger -t raspi-shutdown</code> then calls <code>shutdown -h now</code>
|-
| <code>/etc/udev/rules.d/90-raspi-shutdown.rules</code> || udev rule — watches block devices for the label
|}

== udev Rule ==

<pre>
ACTION=="add", SUBSYSTEM=="block", ENV{ID_FS_LABEL}=="RASPI-CLEAN-SHUTDOWN", RUN+="/usr/local/bin/usb-clean-shutdown.sh"
</pre>

Fires on <code>ACTION==add</code> (insert), <code>SUBSYSTEM==block</code>, label match is case-sensitive.

== Prepare the USB Stick ==

<pre>
# FAT32
mkfs.vfat -n RASPI-CLEAN-SHUTDOWN /dev/sdX

# ext4
mkfs.ext4 -L RASPI-CLEAN-SHUTDOWN /dev/sdX
</pre>

Verify the label before use: <code>lsblk -o NAME,LABEL</code>. Confirm syslog entry after trigger: <code>journalctl -t raspi-shutdown</code>.

----

= install-fzf.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-fzf.sh | bash</pre>

Installs <code>fzf</code> via <code>apt-get</code> and appends the keybinding source line to <code>~/.bashrc</code>. Idempotent — skips append if the line is already present. No root required (uses <code>sudo</code> internally for apt). No Telegram dependency.

Apply after install: <code>source ~/.bashrc</code>

== Keybindings ==

{| class="wikitable"
! Key !! Action
|-
| Ctrl+R || Fuzzy search shell history
|-
| Ctrl+T || Fuzzy-find file, paste path to prompt
|-
| Alt+C || Fuzzy-find directory and <code>cd</code> into it
|}

The installer auto-detects the keybindings file from three standard paths (<code>/usr/share/doc/fzf/examples/</code>, <code>/usr/share/fzf/</code>, <code>/usr/share/doc/fzf/</code>). Exits with an error if none exist — this can occur on non-Debian distributions.

----

= install-prompt.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-prompt.sh | bash</pre>

Sets a colourful <code>PS1</code> prompt in <code>~/.bashrc</code>. No root required. No Telegram dependency. Idempotent — checks for ANSI codes <code>01;31m</code> and <code>01;35m</code> before appending.

Apply after install: <code>source ~/.bashrc</code>

== Prompt ==

<pre>
user@hostname /current/directory $
</pre>

{| class="wikitable"
! Element !! Colour
|-
| <code>\u</code> (user) || Bold red <code>01;31m</code>
|-
| <code>\h</code> (host) || Bold cyan <code>01;36m</code>
|-
| <code>\w</code> (path) || Bold yellow <code>01;33m</code>
|-
| <code>$</code> || Bold magenta <code>01;35m</code>
|}

----

= install-neofetch.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-neofetch.sh | sudo bash</pre>

Installs <code>neowofetch</code> via <code>apt</code> and creates a global profile trigger at <code>/etc/profile.d/neowofetch-ssh.sh</code> that automatically runs <code>neowofetch</code> for any user logging in via SSH. No Telegram dependency.

Apply immediately without rebooting: open a new SSH session.

== Files ==

{| class="wikitable"
! File !! Perm !! Role
|-
| <code>/etc/profile.d/neowofetch-ssh.sh</code> || 644 || Global profile trigger — runs <code>neowofetch</code> on SSH login
|}

== Profile Trigger ==

<pre>
# Auto-run neowofetch on SSH login for all users
if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ]; then
# Run only if standard output is a TTY and NOT running under sudo/sudo -i
if [ -t 1 ] && [ -z "$SUDO_USER" ]; then
neowofetch
fi
fi
</pre>

Conditions for execution:
* <code>SSH_CLIENT</code> or <code>SSH_TTY</code> is set — real SSH session
* stdout is a TTY (<code>-t 1</code>) — suppresses output in non-interactive contexts (e.g., <code>scp</code>, automated scripts)
* <code>SUDO_USER</code> is unset — does not fire again for <code>sudo -i</code> shells inside an existing session

----

= install-core-tools.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-core-tools.sh | sudo bash</pre>

Installs a comprehensive set of development, networking, and shell utility packages via <code>apt</code> in a single pass. No Telegram dependency.

== Packages ==

{| class="wikitable"
! Group !! Packages
|-
| Build tools || <code>build-essential</code>, <code>gdb</code>, <code>valgrind</code>, <code>cmake</code>, <code>ninja-build</code>, <code>pkg-config</code>
|-
| Version control || <code>git</code>, <code>git-lfs</code>
|-
| Python || <code>python3</code>, <code>python3-pip</code>, <code>python3-venv</code>
|-
| Dev libraries || <code>libssl-dev</code>, <code>libffi-dev</code>, <code>zlib1g-dev</code>
|-
| Network (config) || <code>iproute2</code>, <code>net-tools</code>, <code>iputils-ping</code>, <code>traceroute</code>, <code>mtr-tiny</code>, <code>dnsutils</code>
|-
| Network (probe) || <code>curl</code>, <code>wget</code>, <code>nmap</code>, <code>tcpdump</code>, <code>socat</code>, <code>netcat-openbsd</code>
|-
| Network (monitor) || <code>iftop</code>, <code>nload</code>
|-
| Shell utilities || <code>htop</code>, <code>jq</code>, <code>tree</code>, <code>tmux</code>
|}

----

= install-docker.sh =

; '''Run on VPS'''
: <pre>curl -s https://coolscript.net/download/shell/install-docker.sh | sudo bash</pre>

Installs Docker CE from the official Docker apt repository using the distro's GPG key. Adds the invoking user to the <code>docker</code> group. No Telegram dependency.

'''Root required.''' Group membership takes effect after logout/login or <code>newgrp docker</code>.

== Installation Flow ==

<pre>
[ curl | bash ] ──► Install prerequisites (ca-certificates, curl)
│
▼
Add Docker GPG key → /etc/apt/keyrings/docker.asc
│
▼
Add apt source → /etc/apt/sources.list.d/docker.list
│
▼
apt update && install docker-ce, docker-ce-cli, containerd.io,
docker-buildx-plugin, docker-compose-plugin
│
▼
usermod -aG docker $USER
</pre>

== Files ==

{| class="wikitable"
! File !! Role
|-
| <code>/etc/apt/keyrings/docker.asc</code> || Docker signing key (<code>chmod a+r</code>)
|-
| <code>/etc/apt/sources.list.d/docker.list</code> || Docker apt repository entry
|}

== Packages Installed ==

{| class="wikitable"
! Package !! Role
|-
| <code>docker-ce</code> || Docker daemon
|-
| <code>docker-ce-cli</code> || <code>docker</code> CLI
|-
| <code>containerd.io</code> || Container runtime
|-
| <code>docker-buildx-plugin</code> || Multi-platform image builds
|-
| <code>docker-compose-plugin</code> || <code>docker compose</code> subcommand
|}

----

= Summary =

{| class="wikitable"
! Script !! Root !! /etc/telegram.conf !! Mechanism !! Interactive !! curl install
|-
| <code>install-sudo.sh</code> || Yes (must run as root) || Not used || apt sudo install + <code>usermod -aG sudo</code> || Yes — may prompt for username || <code>su -c 'curl -s https://coolscript.net/download/shell/install-sudo.sh | bash -s username'</code>
|-
| <code>install-prompt.sh</code> || No || Not used || <code>~/.bashrc</code> PS1 || No || <code>curl -s https://coolscript.net/download/shell/install-prompt.sh | bash</code>
|-
| <code>install-fzf.sh</code> || No (sudo inside) || Not used || apt + <code>~/.bashrc</code> || No || <code>curl -s https://coolscript.net/download/shell/install-fzf.sh | bash</code>
|-
| <code>install-core-tools.sh</code> || Yes (sudo inside) || Not used || apt bulk install || No || <code>curl -s https://coolscript.net/download/shell/install-core-tools.sh | sudo bash</code>
|-
| <code>install-docker.sh</code> || Yes || Not used || Official Docker apt repo + GPG key || No || <code>curl -s https://coolscript.net/download/shell/install-docker.sh | sudo bash</code>
|-
| <code>install-telegram-ssh-alert.sh</code> || Yes || Creates if missing || PAM <code>pam_exec optional</code> || Yes — credential prompt || <code>curl -s https://coolscript.net/download/shell/install-telegram-ssh-alert.sh | sudo bash</code>
|-
| <code>install-boot-notify.sh</code> || Yes || Creates if missing || systemd one-shot || Yes — credential prompt || <code>curl -s https://coolscript.net/download/shell/install-boot-notify.sh | sudo bash</code>
|-
| <code>install-shutdown-notify.sh</code> || Yes || '''Must exist''' (hard abort) || systemd <code>ExecStop</code> || No || <code>curl -s https://coolscript.net/download/shell/install-shutdown-notify.sh | sudo bash</code>
|-
| <code>install-clean-shutdown.sh</code> || Yes || Not used || udev block rule for Raspberry || Yes — overwrite prompt || <code>curl -s https://coolscript.net/download/shell/install-clean-shutdown.sh | sudo bash</code>
|-
| <code>install-neofetch.sh</code> || Yes (sudo inside) || Not used || <code>/etc/profile.d</code> global trigger || No || <code>curl -s https://coolscript.net/download/shell/install-neofetch.sh | sudo bash</code>
|}

== Recommended Installation Order ==

# <code>install-sudo.sh</code> — required first on Debian images where <code>sudo</code> is not installed
# <code>install-prompt.sh</code>
# <code>install-fzf.sh</code>
# <code>install-core-tools.sh</code> — standalone, no ordering constraint
# <code>install-docker.sh</code> — standalone, no ordering constraint
# <code>create /etc/telegram.conf</code> — add TELEGRAM_CHAT_ID and TELEGRAM_BOT_TOKEN
# <code>install-telegram-ssh-alert.sh</code> — creates <code>/etc/telegram.conf</code> interactively
# <code>install-boot-notify.sh</code> — reuses or creates <code>/etc/telegram.conf</code>
# <code>install-shutdown-notify.sh</code> — requires <code>/etc/telegram.conf</code> to already exist
# <code>install-clean-shutdown.sh</code> — standalone, no ordering constraint
# <code>install-neofetch.sh</code> — standalone, no ordering constraint

Shell installer scripts - Revision history