vps-bootstraplisted

# Fresh Linux VPS Bootstrap & Security Hardening ## Overview A battle-tested initialization and security baseline suite for new Linux VPS nodes (Debian/Ubuntu/AlmaLinux). It automates **hardware & network benchmarking, BBR+FQ TCP acceleration, UFW firewall rules, Fail2ban brute-force protection, SSH key authentication enforcement, and system package updates**. ## When to Use & When NOT to Use ### When to Use - Initializing a brand-new VPS instance right after purchase/reinstall. - Establishing standard security baselines on exposed cloud VMs. - Auditing CPU speed, disk I/O, swap, and three-network routing quality. ### When NOT to Use - Managing container-internal virtual filesystems where kernel tuning (BBR/Swap) is restricted by host hypervisors. - Production systems with active complex iptables routing that could be overwritten by naive UFW enable. ## Standard Initialization Pipeline ```bash # 1. Update packages & install essential tools apt-get update && apt-get install -y ufw fail2ban curl wget git htop jq iotop # 2. Enable BBR + FQ TCP Congestion Control cat << 'EOF' >> /etc/sysctl.conf net.core.default_qdisc = fq net.ipv4.tcp_congestion_control = bbr EOF sysctl -p # 3. Configure UFW Firewall (Never lock out SSH!) ufw default deny incoming ufw default allow outgoing ufw allow 22/tcp comment 'SSH Port' ufw allow 80/tcp comment 'HTTP' ufw allow 443/tcp comment 'HTTPS' ufw --force enable # 4. Configure Fail2ban for SSH Protection cat << 'EOF' > /etc/fail2ban/jail.