Overview

Setting up a fresh Linux VPS or dedicated server on Debian 12 often involves repetitive, manual steps: provisioning non-root administrative users, generating and hardening SSH key access, tuning firewall rules, setting up intrusion prevention, and configuring container runtimes. Performing these configurations manually is prone to human oversight, security misconfigurations, or inadvertent lockouts.

debian-bootstrap is an idempotent, automated server provisioning and hardening toolkit tailored for production Debian 12 environments. It guarantees reproducible, secure baselines across any cloud provider.

---

Idempotent, Multi-Stage Execution

Every provisioning stage adheres to strict idempotency rules: before executing any modification, the toolkit queries the current system state. If a configuration parameter or security rule already matches the declared target state, the stage reports UNCHANGED and proceeds without touching the system.

Provisioning Stages:

1. System User and Privilege Separation: Creates dedicated sudo-enabled operations accounts and disables default passwords.
2. Hardened SSH Daemon: Disables root login (PermitRootLogin no), enforces public-key authentication only (PasswordAuthentication no), pins protocol versions, and validates configuration syntax with sshd -t before reloading.
3. UFW Firewall Rules: Implements default-deny incoming policies, permitting only strictly required ports (22, 80, 443).
4. Intrusion Prevention (Fail2ban): Automatically configures jails to detect and ban malicious brute-force attempts targeting SSH and web proxies.
5. Unattended Security Updates: Enables automatic installation of critical security patches via Debian’s native package manager without requiring manual interventions.
6. Official Docker Engine Setup: Provisions the official upstream Docker CE repository and sets up systemd service daemons with live restore enabled.
7. Virtual Memory (Swap) Tuning: Creates dynamic, secure swapfiles with optimized vm.swappiness and vfs_cache_pressure kernel parameters.
8. Time Synchronization: Configures systemd-timesyncd or Chrony against NTP server pools to ensure sub-millisecond clock accuracy for database clustering.

---

Safety and Simulation (--dry-run)

Accidental lockouts during remote server provisioning can be catastrophic. debian-bootstrap provides a first-class --dry-run simulation mode:

sudo ./bootstrap.sh --dry-run

During simulation, the tool inspects existing files, tests proposed system commands, prints the precise diffs that would be applied to /etc/ssh/sshd_config or /etc/ufw/, and generates comprehensive audit logs in logs/bootstrap-<timestamp>.log.