Replace echo -e with printf for portable ANSI banners

dash (Debian's /bin/sh) doesn't support echo's -e flag: it prints "-e" literally as text before processing the rest of the string's backslash escapes. Every script's colored banner was affected. printf's escape handling is POSIX-mandated and behaves identically under dash and bash, so swap all 90 echo -e calls for printf, appending the trailing \n that echo used to add implicitly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Fix installer bugs: broken root checks, PHP version mismatches, dead paths
2026-09-04 09:35:02 +02:00 · 2026-09-04 09:28:08 +02:00 · 2026-09-04 09:16:51 +02:00 · 2026-06-02 16:55:33 +02:00 · 2025-03-13 21:43:02 +01:00 · 2024-07-29 12:15:04 +02:00
42 changed files with 6132 additions and 223 deletions
@@ -53,7 +53,7 @@ server {

 	# pass PHP scripts to FastCGI server
 	location ~ \.php$ {
-		fastcgi_pass unix:/run/php/php7.0-fpm.sock;
+		fastcgi_pass unix:/run/php/PHP_FPM_SOCK;
 		fastcgi_index index.php;
 		include fastcgi_params;
 		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -1,25 +1,26 @@
 #!/bin/bash

-echo "updating drupal 8"
+echo "updating drupal"
 echo "Switching to project docroot."
 cd ./public_html
 echo ""
 echo "Pulling down latest code."
 git pull --ff-only origin prod
+git submodule update --init --recursive
 echo ""
 echo "Clearing drush caches."
-drush cache-clear drush
+vendor/bin/drush cache-clear drush
 echo ""
 echo "Composer install."
 composer install --no-dev
 echo ""
 echo "Running database updates."
-drush updb -y
+vendor/bin/drush updb -y
 echo ""
 echo "Importing configuration."
-drush config-import -y
+vendor/bin/drush config-import -y
 echo ""
 echo "Clearing caches."
-drush cr
+vendor/bin/drush cr
 echo ""
 echo "Deployment complete."
@@ -89,7 +89,7 @@ server {
      #fastcgi_param DOCUMENT_ROOT /var/www/enfrancais.fr/api;
      # fastcgi_buffer_size 16k;
      # fastcgi_buffers 4 16k;
-      fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+      fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
@@ -116,7 +116,7 @@ server {
    fastcgi_intercept_errors on;
    # fastcgi_buffer_size 16k;
    # fastcgi_buffers 4 16k;
-    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.1-fpm.sock;
  }
  # Fighting with Styles? This little gem is amazing.
  # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
@@ -92,7 +92,7 @@ server {
    fastcgi_intercept_errors on;
    # fastcgi_buffer_size 16k;
    # fastcgi_buffers 4 16k;
-    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
  }
  # Fighting with Styles? This little gem is amazing.
  # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
@@ -0,0 +1,5 @@
+[Definition]
+
+failregex = FastCGI sent in stderr: "Primary script unknown" .*, client: <HOST>, server: .*
+
+ignoreregex =
@@ -0,0 +1,7 @@
+[nginx-badbots]
+
+enabled  = true
+port     = http,https
+filter   = <FILTER>
+logpath  = <LOGPATH>
+maxretry = 2
@@ -2,7 +2,7 @@ server {
  listen 80;
  location /phpmyadmin {
    # server_name phpmyadmin.idroot.net;
-    root /var/www/phpmyadmin;
+    root /var/www/html;

    index  index.php;

@@ -22,7 +22,7 @@ server {
    }

    location ~ \.php$ {
-      fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+      fastcgi_pass unix:/run/php/PHP_FPM_SOCK;
      fastcgi_index index.php;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -48,7 +48,7 @@ server {

  location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.1-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -24,7 +24,7 @@ server {

  location ~ \.php$ {
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.1-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -5,7 +5,7 @@ ConditionPathExists=/usr/local/sbin/urbackupclientbackend
 [Service]
 Type=forking
 ExecStart=/usr/local/sbin/urbackupclientbackend -d
-PIDFile = /var/run/urbackup_srv.pid
+PIDFile = /run/urbackup_srv.pid
 TimeoutSec=0

 [Install]
@@ -1,7 +1,8 @@
 #!/bin/bash

 # update bare repos
-git --git-dir=git-repositories/DOMAIN.git fetch origin prod:prod
+echo "Updating bare repos"
+su -c "git --git-dir=git-repositories/DOMAIN.git fetch origin prod:prod" USER
 # deploy prod
 cd www/DOMAIN/
-./deploy.sh
+su -c "./deploy.sh" USER
@@ -0,0 +1 @@
+UserParameter=linux.system.name.version,(lsb_release -d > dev/null 2>&1) && lsb_release -d || (cat /etc/centos-release > /dev/null > /dev/null 2>&1 && cat /etc/centos-release || cat /etc/redhat-release)
@@ -4,14 +4,14 @@

 # TODO check if root

-echo -e '\033[35m
+printf '\033[35m
   __  _______ __________
  / / / / ___// ____/ __ \
 / / / /\__ \/ __/ / /_/ /
 / /_/ /___/ / /___/ _, _/
 \____//____/_____/_/ |_|
-\033[0m'
-echo -e "\033[35;1mCreate new user (you will be asked a user name and a password) \033[0m"
+\033[0m\n'
+printf "\033[35;1mCreate new user (you will be asked a user name and a password) \033[0m\n"
 sleep 3
 while [ "$user" = "" ]
 do
@@ -34,14 +34,14 @@ mkdir /home/$user/backups

 chmod -w /home/"$user"

-echo -e '\033[35m
+printf '\033[35m
        __               __
 _   __/ /_  ____  _____/ /_
 | | / / __ \/ __ \/ ___/ __/
 | |/ / / / / /_/ (__  ) /_
 |___/_/ /_/\____/____/\__/
-\033[0m'
-echo -e "\033[35;1mVHOST install \033[0m"
+\033[0m\n'
+printf "\033[35;1mVHOST install \033[0m\n"

 while [ "$_host_name" = "" ]
 do
@@ -75,20 +75,20 @@ ln -s /home/"$user"/logs /var/www/"$_host_name"/logs
 # a2ensite "$_host_name".conf
 #restart apache
 # service apache2 restart
-echo -e "\033[92;1mvhost $_host_name configured\033[Om"
+printf "\033[92;1mvhost $_host_name configured\033[Om\n"


 # todo add mysql user and database

-echo -e '\033[35m
+printf '\033[35m
    __  ___                 __
   /  |/  /_  ___________ _/ /
  / /|_/ / / / / ___/ __ `/ /
 / /  / / /_/ (__  ) /_/ / /
 /_/  /_/\__, /____/\__, /_/
       /____/        /_/
-\033[0m'
-echo -e "\033[35;1mMysql database \033[0m"
+\033[0m\n'
+printf "\033[35;1mMysql database \033[0m\n"

 while [ "$_dbname" = "" ]
 do
@@ -111,7 +111,7 @@ do
  echo -n "confirm password"
  read passwdb
  if [ "$passwda" = "$passwdb" ]; then
-    $_pswd=$passwda
+    _pswd=$passwda
    passok=1
  else
    echo "pass words don't match, please try again"
@@ -119,8 +119,10 @@ do
 done

 if [ "$passok" = 1 ]; then
+  # TODO: not implemented yet, run manually for now:
  # mysql> create user '$_dbname'@'localhost' identified by '$_pswd';
  # mysql> create database $_dbname;
  # mysql> grant all privileges on esadhar_eval.* to 'esadhar_eval'@'localhost';
  # mysql> flush privileges;
+  :
 fi
@@ -1,22 +1,22 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
    ___         __           __  __          __      __
   /   | __  __/ /_____     / / / /___  ____/ /___ _/ /____
  / /| |/ / / / __/ __ \   / / / / __ \/ __  / __ `/ __/ _ \
 / ___ / /_/ / /_/ /_/ /  / /_/ / /_/ / /_/ / /_/ / /_/  __/
 /_/  |_\__,_/\__/\____/   \____/ .___/\__,_/\__,_/\__/\___/
                              /_/
-\033[0m'
+\033[0m\n'
 # https://www.howtoforge.com/how-to-configure-automatic-updates-on-debian-wheezy
 # https://www.bisolweb.com/tutoriels/serveur-vps-ovh-partie-5-installation-apticron/

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi

-echo -e "\033[35;1mInstalling apticron \033[0m"
+printf "\033[35;1mInstalling apticron \033[0m\n"
 apt-get --yes install apticron

 sleep 3
@@ -27,4 +27,4 @@ sed -i -r "s/EMAIL=\"root\"/EMAIL=\"$email\"/g" /etc/apticron/apticron.conf
 # sed -i -r "s/# DIFF_ONLY=\"1\"/DIFF_ONLY=\"1\"/g" /etc/apticron/apticron.conf
 sed -i -r "s/# NOTIFY_NEW=\"0\"/NOTIFY_NEW=\"0\"/g" /etc/apticron/apticron.conf

-echo -e "\033[92;1mApticron installed and configured\033[0m"
+printf "\033[92;1mApticron installed and configured\033[0m\n"
@@ -1,22 +1,22 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
    ____        __     _______ __
   / __ \____  / /_   / ____(_) /__  _____
  / / / / __ \/ __/  / /_  / / / _ \/ ___/
 / /_/ / /_/ / /_   / __/ / / /  __(__  )
 /_____/\____/\__/  /_/   /_/_/\___/____/
-\033[0m'
+\033[0m\n'
 #installing better prompt and some goodies
-echo -e "\033[35;1mInstalling shell prompt for current user $USER \033[0m"
+printf "\033[35;1mInstalling shell prompt for current user $USER \033[0m\n"
 sleep 2
 # get the current position
 _cwd="$(pwd)"
 # go to user home
 cd
-echo "cloning https://figureslibres.io/gogs/bachir/dotfiles-server.git"
-git clone https://figureslibres.io/gogs/bachir/dotfiles-server.git ~/.dotfiles-server && cd ~/.dotfiles-server && ./install.sh && cd ~
+echo "cloning https://figureslibres.io/gitea/bachir/dotfiles-server.git"
+git clone https://figureslibres.io/gitea/bachir/dotfiles-server.git ~/.dotfiles-server && cd ~/.dotfiles-server && ./install.sh && cd ~
 source ~/.bashrc
 # return to working directory
 cd "$_cwd"
-echo -e "\033[92;1mDot files installed for $USER\033[0m"
+printf "\033[92;1mDot files installed for $USER\033[0m\n"
@@ -1,15 +1,15 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
    __  ______    ______
   /  |/  /   |  /  _/ /
  / /|_/ / /| |  / // /
 / /  / / ___ |_/ // /___
 /_/  /_/_/  |_/___/_____/
-\033[0m'
-echo -e "\033[35;1mEnable mail sending for php \033[0m"
+\033[0m\n'
+printf "\033[35;1mEnable mail sending for php \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -29,7 +29,7 @@ fi
 # http://www.sycha.com/lamp-setup-debian-linux-apache-mysql-php#anchor13
 sleep 2
 apt-get --yes install exim4
-echo -e "\033[35;1mConfiguring EXIM4 \033[0m"
+printf "\033[35;1mConfiguring EXIM4 \033[0m\n"
 while [ "$configexim" != "y" ] && [ "$configexim" != "n" ]
 do
  echo -n "Should we configure exim4 ? [y|n] "
@@ -48,7 +48,7 @@ systemctl restart exim4

 # dkim spf
 # https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
-echo -e "\033[35;1mConfiguring DKIM \033[0m"
+printf "\033[35;1mConfiguring DKIM \033[0m\n"
 while [ "$installdkim" != "y" ] && [ "$installdkim" != "n" ]
 do
  echo -n "Should we install dkim for exim4 ? [y|n] "
@@ -2,16 +2,16 @@

 # TODO check if root

-echo -e '\033[35m
+printf '\033[35m
    ______      _ _____   __
   / ____/___ _(_) /__ \ / /_  ____ _____
  / /_  / __ `/ / /__/ // __ \/ __ `/ __ \
 / __/ / /_/ / / // __// /_/ / /_/ / / / /
 /_/    \__,_/_/_//____/_.___/\__,_/_/ /_/
-\033[0m'
-echo -e "\033[35;1mInstalling fall2ban \033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling fall2ban \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -23,4 +23,4 @@ cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
 touch /var/log/auth.log
 systemctl enable fail2ban
 systemctl restart fail2ban
-echo -e "\033[92;1mfail2ban installed and configured\033[Om"
+printf "\033[92;1mfail2ban installed and configured\033[Om\n"
@@ -2,16 +2,16 @@

 # TODO check if root

-echo -e '\033[35m
+printf '\033[35m
    ______________  _______       _____    __    __
   / ____/  _/ __ \/ ____/ |     / /   |  / /   / /
  / /_   / // /_/ / __/  | | /| / / /| | / /   / /
 / __/ _/ // _, _/ /___  | |/ |/ / ___ |/ /___/ /___
 /_/   /___/_/ |_/_____/  |__/|__/_/  |_/_____/_____/
-\033[0m'
-echo -e "\033[35;1mInstalling ufw and setup firewall (allowing only ssh and http) \033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling ufw and setup firewall (allowing only ssh and http) \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -26,4 +26,4 @@ ufw allow https

 ufw enable
 ufw status verbose
-echo -e "\033[92;1mufw installed and firwall configured\033[Om"
+printf "\033[92;1mufw installed and firwall configured\033[Om\n"
@@ -1,16 +1,16 @@
 #!/bin/sh


-echo -e '\033[35m
+printf '\033[35m
  ______ _______ _____
 |  ____|__   __|  __ \
 | |__     | |  | |__) |
 |  __|    | |  |  ___/
 | |       | |  | |
 |_|       |_|  |_|
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]
+if [ "$(id -u)" -ne 0 ]
  then echo "Please run as root"
  exit
 fi
@@ -4,14 +4,14 @@
 # get the current position
 _cwd="$(pwd)"

-echo -e '\033[35m
+printf '\033[35m
   _______ __
  / ____(_) /_
 / / __/ / __/
 / /_/ / / /_
 \____/_/\__/
-\033[0m'
-echo -e "\033[35;1mCreate new git barre repos and deploy script\033[0m"
+\033[0m\n'
+printf "\033[35;1mCreate new git barre repos and deploy script\033[0m\n"
 echo "Git barre repo will be installed in chosen user home directory"
 echo "git prod repos will be installed in public_html directory of provided domain, the domain have to exists as shortcut in chosen user/www before running this script. Please run first vhost.sh script and say yes to the question create a shortcut !"

@@ -110,13 +110,13 @@ if [ "$vh" = "yes" ]; then
  cd /home/"$user"/git-repositories/"$_domain".git/hooks/
  chmod +x post-receive # pre-receive

-  # setup git repo on site folder
-  cd /home/"$user"/www/"$_domain"/app
-  git init
-  # link to the bare repo
-  git remote add origin /home/"$user"/git-repositories/"$_domain".git
+  echo "setup git repo on site folder"
+  cd /home/"$user"/www/"$_domain"/public_html
+  su -c "git init" $user
+  echo "link to the bare repo"
+  su -c "git remote add origin /home/$user/git-repositories/$_domain.git" $user
+  chown -R "$user":"$user" /home/"$user"/www/"$_domain"

-  chown -R "$user":"$user" /home/"$user"/www/"$_domain"/app

  cd "$_cwd"
  # done
@@ -2,16 +2,16 @@

 # TODO check if root

-echo -e '\033[35m
+printf '\033[35m
    __                    __       __
   / /______  ____  _____/ /______/ /
  / //_/ __ \/ __ \/ ___/ //_/ __  /
 / ,< / / / / /_/ / /__/ ,< / /_/ /
 /_/|_/_/ /_/\____/\___/_/|_|\__,_/
-\033[0m'
-echo -e "\033[35;1mInstalling knockd to control ssh port opening\033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling knockd to control ssh port opening\033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -50,7 +50,7 @@ Alias=knockd.service" >> /lib/systemd/system/knockd.service
 systemctl enable knockd
 systemctl start knockd

-echo -e "\033[92;1mknockd installed and configured\033[Om"
-echo -e "\033[92;1mplease note this sequence for future ssh knocking\033[Om"
+printf "\033[92;1mknockd installed and configured\033[Om\n"
+printf "\033[92;1mplease note this sequence for future ssh knocking\033[Om\n"
 echo "$sq"
 sleep 3
@@ -1,16 +1,16 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
    __
   / /__  ____ ___  ____
  / / _ \/ __ `__ \/ __ \
 / /  __/ / / / / / /_/ /
 /_/\___/_/ /_/ /_/ .___/
                /_/
-\033[0m'
-echo -e "\033[35;1mLEMP server (Nginx Mysql Php-fpm) \033[0m"
+\033[0m\n'
+printf "\033[35;1mLEMP server (Nginx Mysql Php-fpm) \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -29,27 +29,48 @@ fi

 sleep 2

-echo -e '\033[35m
+printf '\033[35m
    ____  __  ______
   / __ \/ / / / __ \
  / /_/ / /_/ / /_/ /
 / ____/ __  / ____/
 /_/   /_/ /_/_/
-\033[0m'
-echo -e "\033[35;1mInstalling PHP 7.3 \033[0m"
+\033[0m\n'
+
+printf "\033[35;1mInstalling SURY \033[0m\n"
 sleep 3

+apt-get --yes install ca-certificates apt-transport-https software-properties-common curl lsb-release
+curl -sSL https://packages.sury.org/php/README.txt | bash -x
+apt-get update && apt-get --yes upgrade
+
+printf "\033[35;1mInstalling PHP \033[0m\n"
+sleep 3
+
+
+
 # mv: cannot stat '/etc/php/7.0/fpm/php.ini': No such file or directory
 # cp: cannot create regular file '/etc/php/7.0/fpm/php.ini': No such file or directory
 # Configuring PHP
 # Failed to enable unit: Unit file php7.0-fpm.service does not exist.
 # Failed to start php7.0-fpm.service: Unit php7.0-fpm.service not found.

-apt-get --yes install php7.3-fpm php7.3-mysql php7.3-opcache php7.3-curl php7.3-mbstring php7.3-zip php7.3-xml php7.3-gd php-memcached php7.3-imagick php7.3-apcu
-# php7.3-mcrypt  ??
+# apt-get --yes install php7.4-fpm php7.4-mysql php7.4-opcache php7.4-curl php7.4-mbstring php7.4-zip php7.4-xml php7.4-gd php-memcached php7.4-imagick php7.4-apcu
+# php7.4-mcrypt  ??

-mv /etc/php/7.3/fpm/php.ini /etc/php/7.3/fpm/php.ini.back
-cp "$_assets"/php-fpm.ini /etc/php/7.3/fpm/php.ini
+# apt-get --yes install php8.1-fpm php8.1-mysql php8.1-opcache php8.1-curl php8.1-mbstring php8.1-zip php8.1-xml php8.1-gd php8.1-memcached php8.1-imagick php8.1-apcu php8.1-redis php8.1-bz2 php8.1-bcmath
+
+# apt-get --yes install php8.2-fpm php8.2-mysql php8.2-opcache php8.2-curl php8.2-mbstring php8.2-zip php8.2-xml php8.2-gd php-memcached php8.2-imagick php8.2-apcu php8.2-redis php8.2-bz2 php8.2-bcmath
+
+# apt-get --yes install php8.3-fpm php8.3-mysql php8.3-opcache php8.3-curl php8.3-mbstring php8.3-zip php8.3-xml php8.3-gd php8.3-memcached php8.3-imagick php8.3-apcu php8.3-redis php8.3-bz2 php8.3-bcmath
+
+PHP_VERSION="8.4"
+
+apt-get --yes install php${PHP_VERSION}-fpm php${PHP_VERSION}-mysql php${PHP_VERSION}-opcache php${PHP_VERSION}-curl php${PHP_VERSION}-mbstring php${PHP_VERSION}-zip php${PHP_VERSION}-xml php${PHP_VERSION}-gd php${PHP_VERSION}-memcached php${PHP_VERSION}-imagick php${PHP_VERSION}-apcu php${PHP_VERSION}-redis php${PHP_VERSION}-bz2 php${PHP_VERSION}-bcmath
+
+
+mv /etc/php/${PHP_VERSION}/fpm/php.ini /etc/php/${PHP_VERSION}/fpm/php.ini.back
+cp "$_assets"/php${PHP_VERSION}-fpm.ini /etc/php/${PHP_VERSION}/fpm/php.ini

 echo "Configuring PHP"

@@ -57,8 +78,8 @@ mkdir /var/log/php
 chown www-data /var/log/php
 cp "$_assets"/logrotate-php /etc/logrotate.d/php

-systemctl enable php7.3-fpm
-systemctl start php7.3-fpm
+systemctl enable php${PHP_VERSION}-fpm
+systemctl start php${PHP_VERSION}-fpm

 # echo "Installing memecached"
 # replaced by redis
@@ -67,25 +88,26 @@ systemctl start php7.3-fpm
 #
 # systemctl start memcached

-echo -e "\033[92;1mphp installed\033[Om"
+printf "\033[92;1mphp installed\033[Om\n"

-echo -e '\033[35m
+printf '\033[35m
    _   __      _
   / | / /___ _(_)___  _  __
  /  |/ / __ `/ / __ \| |/_/
 / /|  / /_/ / / / / />  <
 /_/ |_/\__, /_/_/ /_/_/|_|
      /____/
-\033[0m'
-echo -e "\033[35;1mInstalling Nginx \033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling Nginx \033[0m\n"
 sleep 3
 apt-get --yes install nginx
 mv /etc/nginx/sites-available/default /etc/nginx/sites-available/default.ori
 cp "$_assets"/default.nginxconf /etc/nginx/sites-available/default
+sed -i "s/PHP_FPM_SOCK/php${PHP_VERSION}-fpm.sock/g" /etc/nginx/sites-available/default

 systemctl enable nginx
 systemctl restart nginx
-echo -e "\033[92;1mNginx installed\033[Om"
+printf "\033[92;1mNginx installed\033[Om\n"



@@ -97,34 +119,37 @@ read installmysql
 done
 if [ "$installmysql" = "yes" ]; then

-  echo -e '\033[35m
+  printf '\033[35m
      __  ___                 __
     /  |/  /_  ___________ _/ /
    / /|_/ / / / / ___/ __ `/ /
   / /  / / /_/ (__  ) /_/ / /
  /_/  /_/\__, /____/\__, /_/
         /____/        /_/
-  \033[0m'
-  echo -e "\033[35;1minstalling Mysql \033[0m"
+  \033[0m\n'
+  printf "\033[35;1minstalling Mysql \033[0m\n"
  sleep 3
  apt-get --yes install mariadb-server
  mysql_secure_installation

  cp "$_assets"/mysql/innodb-file-per-table.cnf /etc/mysql/conf.d/

+  # you may increase memory
+  # innodb_buffer_pool_size = 1024M
+
  systemctl enable mariadb.service
  systemctl restart mariadb.service
-  echo -e "\033[92;1mmysql installed\033[Om"
+  printf "\033[92;1mmysql installed\033[Om\n"

-  echo -e '\033[35m
+  printf '\033[35m
             __          __  ___      ___       __          _
      ____  / /_  ____  /  |/  /_  __/   | ____/ /___ ___  (_)___
     / __ \/ __ \/ __ \/ /|_/ / / / / /| |/ __  / __ `__ \/ / __ \
    / /_/ / / / / /_/ / /  / / /_/ / ___ / /_/ / / / / / / / / / /
   / .___/_/ /_/ .___/_/  /_/\__, /_/  |_\__,_/_/ /_/ /_/_/_/ /_/
  /_/         /_/           /____/
-  \033[0m'
-  echo -e "\033[35;1mInstalling phpMyAdmin \033[0m"
+  \033[0m\n'
+  printf "\033[35;1mInstalling phpMyAdmin \033[0m\n"
  ##### Building dependency tree
  ##### Reading state information... Done
  ##### Package phpmyadmin is not available, but is referred to by another package.
@@ -136,39 +161,40 @@ if [ "$installmysql" = "yes" ]; then
  ##### Try 'cp --help' for more information.

  # TODO no pma package available :(
-  # apt-get --yes install phpmyadmin
-  # ln -s /usr/share/phpmyadmin /var/www/html/
-  # cp "$_assets"/nginx-phpmyadmin.conf > /etc/nginx/sites-available/phpmyadmin.conf
-  # ln -s /etc/nginx/sites-available/phpmyadmin.conf /etc/nginx/sites-enabled/phpmyadmin.conf
-  # echo -e "\033[92;1mphpMyAdmin installed\033[Om"
-  # echo -e "\033[92;1mYou can access it at yourip/phpmyadmin\033[Om"
+  apt-get --yes install phpmyadmin
+  ln -s /usr/share/phpmyadmin /var/www/html/
+  cp "$_assets"/nginx-phpmyadmin.conf /etc/nginx/sites-available/phpmyadmin.conf
+  sed -i "s/PHP_FPM_SOCK/php${PHP_VERSION}-fpm.sock/g" /etc/nginx/sites-available/phpmyadmin.conf
+    
+  printf "\033[92;1mphpMyAdmin installed\033[Om\n"
+  printf "\033[92;1mYou can access it at yourip/phpmyadmin\033[Om\n"

  # install from source
-  apt-get --yes install php-{mbstring,zip,gd,xml,pear,gettext,cgi}
-  cd /var/www/html/
-  wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.zip
-  unzip phpMyAdmin-latest-all-languages.zip
-  mv phpMyAdmin-*-all-languages pma
-  rm phpMyAdmin-latest-all-languages.zip
-  # cp "$_assets"/nginx-phpmyadmin.conf > /etc/nginx/sites-available/phpmyadmin.conf
-  # ln -s /etc/nginx/sites-available/phpmyadmin.conf /etc/nginx/sites-enabled/phpmyadmin.conf
-  echo -e "\033[92;1mphpMyAdmin installed\033[Om"
-  echo -e "\033[92;1mYou can access it at yourip/pma\033[Om"
+  # apt-get --yes install php-{mbstring,zip,gd,xml,pear,gettext,cgi}
+  # cd /var/www/html/
+  # wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.zip
+  # unzip phpMyAdmin-latest-all-languages.zip
+  # mv phpMyAdmin-*-all-languages pma
+  # rm phpMyAdmin-latest-all-languages.zip
+  # # cp "$_assets"/nginx-phpmyadmin.conf > /etc/nginx/sites-available/phpmyadmin.conf
+  # # ln -s /etc/nginx/sites-available/phpmyadmin.conf /etc/nginx/sites-enabled/phpmyadmin.conf
+  # printf "\033[92;1mphpMyAdmin installed\033[Om\n"
+  # printf "\033[92;1mYou can access it at yourip/pma\033[Om\n"
 fi




-echo -e '\033[35m
+printf '\033[35m
    ____           ___
   / __ \___  ____/ (_)____
  / /_/ / _ \/ __  / / ___/
 / _, _/  __/ /_/ / (__  )
 /_/ |_|\___/\__,_/_/____/
-\033[0m'
-echo -e "\033[35;1mInstalling Redis \033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling Redis \033[0m\n"
 sleep 3
-apt-get --yes install redis-server php-redis
+apt-get --yes install redis-server php${PHP_VERSION}-redis

 # TODO set maxmemory=2gb
 # TODO set maxmemory-policy=volatile-lru
@@ -182,37 +208,35 @@ apt-get --yes install redis-server php-redis

 systemctl enable redis-server
 systemctl restart redis-server
-systemctl restart php7.3-fpm
-echo -e "\033[92;1mRedis installed\033[Om"
+systemctl restart php${PHP_VERSION}-fpm
+printf "\033[92;1mRedis installed\033[Om\n"

-echo -e '\033[35m
+printf '\033[35m
   ______
  / ____/___  ____ ___  ____  ____  ________  _____
 / /   / __ \/ __ `__ \/ __ \/ __ \/ ___/ _ \/ ___/
 / /___/ /_/ / / / / / / /_/ / /_/ (__  )  __/ /
 \____/\____/_/ /_/ /_/ .___/\____/____/\___/_/
                    /_/
-\033[0m'
-echo -e "\033[35;1mInstalling Composer \033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling Composer \033[0m\n"
 sleep 3
 export COMPOSER_HOME=/usr/local/composer
 curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

-echo -e "\033[92;1mComposer installed\033[Om"
+printf "\033[92;1mComposer installed\033[Om\n"


-echo -e '\033[35m
+printf '\033[35m
    ____                  __
   / __ \_______  _______/ /_
  / / / / ___/ / / / ___/ __ \
 / /_/ / /  / /_/ (__  ) / / /
 /_____/_/   \__,_/____/_/ /_/
-\033[0m'
-echo -e "\033[35;1mInstalling Drush and DrupalConsole\033[0m"
+\033[0m\n'
+printf "\033[35;1mInstalling Drush\033[0m\n"
 sleep 3
-curl https://drupalconsole.com/installer -L -o /usr/local/bin/drupal
-chmod +x /usr/local/bin/drupal
 # curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
 wget -O /usr/local/bin/drush https://github.com/drush-ops/drush-launcher/releases/latest/download/drush.phar
 chmod +x /usr/local/bin/drush
-echo -e "\033[92;1mDrush and DrupalConsoleinstalled\033[Om"
+printf "\033[92;1mDrush\033[Om\n"
@@ -1,15 +1,15 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
    __  ____
   /  |/  (_)_________
  / /|_/ / / ___/ ___/
 / /  / / (__  ) /__
 /_/  /_/_/____/\___/

-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -28,4 +28,4 @@ apt-get --yes install tmux etckeeper needrestart htop lynx unzip nfs-common



-echo -e "\033[92;1mMisc done \033[Om"
+printf "\033[92;1mMisc done \033[Om\n"
@@ -1,15 +1,18 @@
 #!/bin/sh

-echo -e '
+printf '
     _ _      _   _
  __| | |__  | | | |___ ___ _ _
 / _` |  _ \ | |_| (_-</ -_)  _|
 \__,_|_.__/  \___//__/\___|_|
-'
+\n'

-echo -e "Create new mysql db and user (you will be asked a db name and a password)"
+printf "Create new mysql db and user (you will be asked a db name and a password)\n"

-. bin/checkroot.sh
+if [ "$(id -u)" -ne 0 ]; then
+  echo "Please run as root"
+  exit
+fi

 sleep 3

@@ -1,14 +1,14 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
  __  __               _   ___          _
 |  \/  |_  _ ___ __ _| | | _ ) __ _ __| |___  _ _ __ ___
 | |\/| | || (_-</ _  | | | _ \/ _  / _| / / || |  _ (_-<
 |_|  |_|\_, /__/\__, |_| |___/\__,_\__|_\_\\_,_| .__/__/
         |__/       |_|                         |_|
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+printf '\033[35m
+        __     
+ _ __  / _|___ 
+|  _ \| |_/ __|
+| | | |  _\__ \
+|_| |_|_| |___/
+                
+\033[0m\n'
+printf "\033[35;1mLEMP server (Nginx Mysql Php-fpm) \033[0m\n"
+
+
+apt install nfs-kernel-server
+vim /etc/exports 
+mkdir /home/proxmox-backup
+mkdir /home/urbackup
+
+ufw allow from 37.187.134.71 to any port nfs
+ufw allow from 37.187.134.71 to any port 111
+ufw allow proto udp from 37.187.134.71 to any port 32764:32769
+ufw allow proto tcp from 37.187.134.71 to any port 32764:32769
+
+ufw allow from 37.187.93.155 to any port nfs
+ufw allow from 37.187.93.155 to any port 111
+ufw allow proto udp from 37.187.93.155 to any port 32764:32769
+ufw allow proto tcp from 37.187.93.155 to any port 32764:32769
+
+ufw allow from 37.187.128.147 to any port nfs
+ufw allow from 37.187.128.147 to any port 111
+ufw allow proto udp from 37.187.128.147 to any port 32764:32769
+ufw allow proto tcp from 37.187.128.147 to any port 32764:32769
+
+
+ufw allow from 94.23.8.104 to any port nfs
+ufw allow from 94.23.8.104 to any port 111
+ufw allow proto udp from 94.23.8.104 to any port 32764:32769
+ufw allow proto tcp from 94.23.8.104 to any port 32764:32769
+
+systemctl restart nfs-server
+systemctl enable nfs-server
+
+vim /etc/ufw/user.rules
+
@@ -1,6 +1,6 @@
 #!/bin/bash

-echo -e "\033[35;1mInstalling PHP 7.4 \033[0m"
+printf "\033[35;1mInstalling PHP 7.4 \033[0m\n"
 apt-get -y install lsb-release apt-transport-https ca-certificates
 wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
 echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list
@@ -13,4 +13,4 @@ cp "$_assets"/php7.4-fpm.ini /etc/php/7.4/fpm/php.ini
 systemctl enable php7.4-fpm
 systemctl start php7.4-fpm

-echo -e "\033[92;1mphp7.4-fpm installed\033[O"
+printf "\033[92;1mphp7.4-fpm installed\033[O\n"
@@ -1,14 +1,14 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
  ___        _                ___  ___  _      ___          _
 | _ \___ __| |_ __ _ _ _ ___/ __|/ _ \| |    | _ ) __ _ __| |___  _ _ __
 |  _/ _ (_-<  _/ _. | ._/ -_)__ \ (_) | |__  | _ \/ _. / _| / / || | ._ \
 |_| \___/__/\__\__, |_| \___|___/\__\_\____| |___/\__,_\__|_\_\\_,_| .__/
                |___/                                               |_|
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -1,21 +1,26 @@
 #!/bin/sh


-echo -e '\033[35m
+printf '\033[35m
   __________ __  __
  / ___/ ___// / / /
  \__ \\__ \/ /_/ /
 ___/ /__/ / __  /
 /____/____/_/ /_/
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi

-sed -i 's/PermitRootLogin\ yes/PermitRootLogin no/g' /etc/ssh/sshd_config
-sed -i 's/PermitEmptyPasswords\ yes/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
-sed -i 's/Protocol\ [0-9]/Protocol 2/g' /etc/ssh/sshd_config
+# sed -i 's/PermitRootLogin\ yes/PermitRootLogin no/g' /etc/ssh/sshd_config
+# sed -i 's/PermitEmptyPasswords\ yes/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
+# sed -i 's/Protocol\ [0-9]/Protocol 2/g' /etc/ssh/sshd_config
+
+touch /etc/ssh/sshd_config.d/custom.conf
+echo "PermitRootLogin no" >> /etc/ssh/sshd_config.d/custom.conf
+echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config.d/custom.conf
+
 systemctl reload ssh
-echo -e "\033[92;1mSSH secured\033[Om"
+printf "\033[92;1mSSH secured\033[Om\n"
@@ -2,15 +2,15 @@

 # TODO check if root

-echo -e '\033[35m
+printf '\033[35m
   __  ______  __________  ___    ____  ______
  / / / / __ \/ ____/ __ \/   |  / __ \/ ____/
 / / / / /_/ / / __/ /_/ / /| | / / / / __/
 / /_/ / ____/ /_/ / _, _/ ___ |/ /_/ / /___
 \____/_/    \____/_/ |_/_/  |_/_____/_____/
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -1,15 +1,15 @@
 #!/bin/sh


-echo -e '\033[35m
+printf '\033[35m
  _   _     _             _                ___ _    _         _
 | | | |_ _| |__  __ _ __| |___  _ _ __   / __| |  (_)___ _ _| |_
 | |_| |  _|  _ \/ _` / _| / / || |  _ \ | (__| |__| / -_)   \  _|
  \___/|_| |_.__/\__,_\__|_\_\\_,_| .__/  \___|____|_\___|_||_\__|
                                  |_|
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -39,15 +39,17 @@ apt install build-essential "g++" "libcrypto++-dev" libz-dev -y

 # Download the UrBackup client source files and extract them
 # wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
-wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.11/urbackup-client-2.4.11.0.tar.gz
-
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.11/urbackup-client-2.4.11.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.20/urbackup-client-2.5.20.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.20/urbackup-client-2.5.24.0.tar.gz
+wget -P /tmp/ https://hndl.urbackup.org/Client/2.5.25/urbackup-client-2.5.25.0.tar.gz
 cd /tmp
-# tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
-tar xzf /tmp/urbackup-client-2.4.11.0.tar.gz
+
+tar xzf /tmp/urbackup-client-2.5.25.0.tar.gz

 # Build the UrBackup client and install it
 # cd /tmp/urbackup-client-2.3.4.0
-cd /tmp/urbackup-client-2.4.11.0
+cd /tmp/urbackup-client-2.5.25.0
 ./configure --enable-headless
 make -j4
 make install
@@ -70,7 +72,8 @@ internet_mode_enabled=true
 internet_image_backups_def=false
 default_dirs_def=/etc;var/www;/var/backups/mysql
 startup_backup_delay_def=3
-computername=$_computername" > /usr/local/var/urbackup/data/settings.cfg
+computername=$_computername" > /etc/default/urbackupclient
+# /usr/local/var/urbackup/data/settings.cfg

 # firewall
 ufw allow from "$_ip" to any port 35621
@@ -78,7 +81,7 @@ ufw allow from "$_ip" to any port 35622
 ufw allow from "$_ip" to any port 35623

 # install and enable systemd service
-cp "$_assets"/urbackup.service /etc/systemd/system/
+cp "$_assets"/urbackup.service /etc/systemd/system/urbackup.service
 chmod a+x /etc/systemd/system/urbackup.service

 systemctl --system daemon-reload
@@ -1,15 +1,15 @@
 #!/bin/sh

-echo -e '\033[35m
+printf '\033[35m
   __  _______ __________
  / / / / ___// ____/ __ \
 / / / /\__ \/ __/ / /_/ /
 / /_/ /___/ / /___/ _, _/
 \____//____/_____/_/ |_|
-\033[0m'
-echo -e "\033[35;1mCreate new user (you will be asked a user name and a password) \033[0m"
+\033[0m\n'
+printf "\033[35;1mCreate new user (you will be asked a user name and a password) \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -43,4 +43,4 @@ groupadd admin
 usermod -a -G admin "$user"
 # allow admin group to su
 dpkg-statoverride --update --add root admin 4750 /bin/su
-echo -e "\033[92;1muser $user configured\033[Om"
+printf "\033[92;1muser $user configured\033[Om\n"
@@ -1,12 +1,12 @@

-echo -e '\033[35m
+printf '\033[35m
        __               __
 _   __/ /_  ____  _____/ /_
 | | / / __ \/ __ \/ ___/ __/
 | |/ / / / / /_/ (__  ) /_
 |___/_/ /_/\____/____/\__/
-\033[0m'
-echo -e "\033[35;1mNginx VHOST install \033[0m"
+\033[0m\n'
+printf "\033[35;1mNginx VHOST install \033[0m\n"
 while [ "$vh" != "y" ] && [ "$vh" != "n" ]
 do
  echo -n "Should we install a vhost? [y|n] "
@@ -53,7 +53,7 @@ if [ "$vh" = "y" ]; then
  _letsencrypt=""
  while [ "$_letsencrypt" != "yes" ] && [ "$_letsencrypt" != "no" ]
  do
-    echo -e "\033[35;1mLet's encrypt \033[0m"
+    printf "\033[35;1mLet's encrypt \033[0m\n"
    echo "Let's encrypt needs a public registered domain name with proper DNS records ( A records or CNAME records for subdomains pointing to your server)."
    echo -n "Should we install let's encrypt certificate with $_domain? [yes|no] "
    read _letsencrypt
@@ -106,6 +106,16 @@ if [ "$vh" = "y" ]; then
  chmod -R g+w /var/www/"$_domain"/
  chmod -R g+r /var/www/"$_domain"/

+  #set fail2ban for vhost
+  # https://stackoverflow.com/a/65552146
+  cp "$_assets/fail2ban/jail.d/nginx-badbots.conf" "/etc/fail2ban/jail.d/nginx-badbots-$_domain.conf"
+  sed -i -r "s/\[nginx-badbots\]/\[nginx-badbots-$_domain\]/g" "/etc/fail2ban/jail.d/nginx-badbots-$_domain.conf"
+  sed -i -r "s/<FILTER>/\[nginx-badbots-$_domain\]/g" "/etc/fail2ban/jail.d/nginx-badbots-$_domain.conf"
+  sed -i -r "s/<LOGPATH>/\/var\/www\/$_domain\/log\/error.log/g" "/etc/fail2ban/jail.d/nginx-badbots-$_domain.conf"
+
+  cp "$_assets/fail2ban/filter.d/nginx-badbots.conf" "/etc/fail2ban/filter.d/nginx-badbots-$_domain.conf"
+  sed -i -r "s/<HOST>/$_domain/g" "/etc/fail2ban/filter.d/nginx-badbots-$_domain.conf"
+


  # create a shortcut to the site
@@ -152,7 +162,7 @@ if [ "$vh" = "y" ]; then

  # restart nginx
  systemctl restart nginx
-  echo -e "\033[92;1mvhost $_domain configured \033[Om"
+  printf "\033[92;1mvhost $_domain configured \033[Om\n"
 else
  echo "Vhost installation aborted"
 fi
@@ -5,12 +5,12 @@
 # get the current position
 _cwd="$(pwd)"

-echo -e '\033[35m
+printf '\033[35m
 __      __   _    _  _          _
 \ \    / /__| |__| || |___  ___| |__
  \ \/\/ / -_) `_ \ __ / _ \/ _ \ / /
   \_/\_/\___|_.__/_||_\___/\___/_\_\
-\033[0m'
+\033[0m\n'

 # check for assets folder
 _assets="$_cwd/assets"
@@ -90,10 +90,11 @@ apt-get install webhook
 git --git-dir=/home/"$user"/git-repositories/"$_domain.git" remote add origin "$_remote"

 # hook deploy script
-cp -f "$_assets"/webhook-deploy.sh /home/"$user"/webhook_deploy_"$_id".sh
-sed -i -r "s/DOMAIN/$_domain/g" /home/"$user"/webhook_deploy_"$_domain".sh
-chowm $user:$user /home/"$user"/webhook_deploy_"$_id".sh
-chmod +x /home/"$user"/webhook_deploy_"$_id".sh
+cp -f "$_assets"/webhook-deploy.sh /home/"$user"/webhook-deploy-"$_id".sh
+sed -i -r "s/DOMAIN/$_domain/g" /home/"$user"/webhook-deploy-"$_id".sh
+sed -i -r "s/USER/$user/g" /home/"$user"/webhook-deploy-"$_id".sh
+chown $user:$user /home/"$user"/webhook-deploy-"$_id".sh
+chmod +x /home/"$user"/webhook-deploy-"$_id".sh

 # remove git bare repos hook
 mv /home/"$user"/git-repositories/"$_domain".git/hooks/post-receive /home/"$user"/git-repositories/"$_domain".git/hooks/post-receive.back
@@ -116,4 +117,6 @@ systemctl restart webhook

 ufw allow 9000

+echo "webhook done"
+echo "you can configure your webhook trigger with the following url :"
 echo "http://$_domain:9000/hooks/deploy_app_$_id"
@@ -1,15 +1,15 @@
 #!/bin/sh


-echo -e '\033[35m
+printf '\033[35m
 _____         __    __    _
 /__  /  ____ _/ /_  / /_  (_)  __
  / /  / __ `/ __ \/ __ \/ / |/_/
 / /__/ /_/ / /_/ / /_/ / />  <
 /____/\__,_/_.___/_.___/_/_/|_|
-\033[0m'
+\033[0m\n'

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -26,12 +26,9 @@ if [ ! -d "$_assets" ]; then
  fi
 fi

-# not necessary anymore zabbix-agent 4 is in apt
-# https://packages.debian.org/fr/buster/zabbix-agent
-# TODO downgrade zabbix-agent to 3.4

-wget -P /tmp/ http://repo.zabbix.com/zabbix/3.4/debian/pool/main/z/zabbix-release/zabbix-release_3.4-1+stretch_all.deb
-dpkg -i /tmp/zabbix-release_3.4-1+stretch_all.deb
+wget -P /tmp/ wget https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
+dpkg -i /tmp/zabbix-release_6.4-1+debian12_all.deb

 apt-get update -y

@@ -44,8 +41,6 @@ echo -n "Please provide the zabbix-server's ip : "
 read _ip
 echo -n "Please provide the hostname of this agent : "
 read _host_name
-echo -n "Please provide the mysql root password : "
-read _root_mysql_passwd

 _agent_conf_d="/etc/zabbix/zabbix_agentd.d" # for debian 8
 if [ ! -d "$_agent_conf_d" ]; then
@@ -57,6 +52,10 @@ sed -i "s#Server=127.0.0.1#Server=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#ServerActive=127.0.0.1#ServerActive=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#Hostname=Zabbix server#Hostname=$_host_name#g" /etc/zabbix/zabbix_agentd.conf

+
+# todo ask if LXC container, if yes install this script
+# https://github.com/kvaps/zabbix-linux-container-template
+
 # APT
 # check for debian security updates
 # not working : https://www.osso.nl/blog/zabbix-counting-security-updates
@@ -68,6 +67,14 @@ cp "$_assets"/zabbix/apt.conf "$_agent_conf_d"/
 # MYSQL
 # https://serverfault.com/questions/737018/zabbix-user-parameter-mysql-status-setting-home
 # create zabbix user home
+
+echo -n "monitor mysql? [Y|n] "
+read yn
+yn=${yn:-y}
+if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
+  echo -n "Please provide the mysql root password : "
+  read _root_mysql_passwd
+
  mkdir /var/lib/zabbix
  # generate random password for zabbix mysql user
  _passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c12)"
@@ -80,15 +87,24 @@ mysql -uroot -p"$_root_mysql_passwd" -e "CREATE USER 'zabbix' IDENTIFIED BY '$_p
  mysql -uroot -p"$_root_mysql_passwd" -e "GRANT USAGE ON *.* TO 'zabbix'@'localhost' IDENTIFIED BY '$_passwd';"
  # add zabbix-agent parameter
  cp "$_assets"/zabbix/userparameter_mysql.conf "$_agent_conf_d"/
+fi
+

 # NGINX
 # https://github.com/sfuerte/zbx-nginx
 # nginxconf already included in default.nginxconf asset
+
+echo -n "Monitor nginx? [Y|n] "
+read yn
+yn=${yn:-y}
+if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
  sed -i "s/# allow CURRENT-SERVER-IP/allow $_cur_ip/g" /etc/nginx/sites-available/default
  cp "$_assets"/zabbix/userparameter_nginx.conf "$_agent_conf_d"/
  mkdir /etc/zabbix/zabbix_agentd.scripts
  cp "$_assets"/zabbix/scripts/nginx-stat.py /etc/zabbix/zabbix_agentd.scripts/
  chmod +x /etc/zabbix/zabbix_agentd.scripts/nginx-stat.py
+fi
+

 echo -n "This is box is a proxmox CT? [Y|n] "
 read yn
@@ -100,6 +116,8 @@ fi
 # SYSTEMD
 # https://github.com/MogiePete/zabbix-systemd-service-monitoring
 cp "$_assets"/zabbix/userparameter_systemd_services.conf "$_agent_conf_d"/
+# https://www.zabbix.com/forum/zabbix-cookbook/23024-monitor-the-version-of-centos-debian-ubuntu?p=386466#post386466
+cp "$_assets"/zabbix/userparameter_linux_name_version.conf "$_agent_conf_d"/

 # disble unused system units
 systemctl disable rsync
@@ -116,6 +134,6 @@ ufw allow from "$_ip" to any port 22
 systemctl restart zabbix-agent
 systemctl enable zabbix-agent

-echo -e "\033[92;1mZabbix-agent installed and configured, please add the host $_host_name in your zabbix-server \033[Om"
-echo -e "\033[92;1mAnd import requested templates in assets/zabbix/templates/ \033[Om"
-echo -e "\033[92;1mzabbix user mysql password is $_passwd \033[Om"
+printf "\033[92;1mZabbix-agent installed and configured, please add the host $_host_name in your zabbix-server \033[Om\n"
+printf "\033[92;1mAnd import requested templates in assets/zabbix/templates/ \033[Om\n"
+printf "\033[92;1mzabbix user mysql password is $_passwd \033[Om\n"
@@ -5,17 +5,17 @@
 # http://web-74.com/blog/reseaux/gerer-le-deploiement-facilement-avec-git/
 #

-echo -e '\033[35m
+printf '\033[35m
    ____       __    _                _____
   / __ \___  / /_  (_)___ _____     / ___/___  ______   _____  _____
  / / / / _ \/ __ \/ / __ `/ __ \    \__ \/ _ \/ ___/ | / / _ \/ ___/
 / /_/ /  __/ /_/ / / /_/ / / / /   ___/ /  __/ /   | |/ /  __/ /
 /_____/\___/_.___/_/\__,_/_/ /_/   /____/\___/_/    |___/\___/_/

-\033[0m'
-echo -e "\033[35;1mThis script has been tested only on Linux Debian 10 \033[0m"
+\033[0m\n'
+printf "\033[35;1mThis script has been tested only on Linux Debian 10 \033[0m\n"

-if [ "$EUID" -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
  echo "Please run as root"
  exit
 fi
@@ -78,6 +78,7 @@ do
  read _install_vhost
 done
 if [ "$_install_vhost" = "yes" ]; then
+  # TODO bug vhost.sh file does not exists ...
  . bin/vhost.sh
 else
  echo 'no vhost installed'
@@ -110,13 +111,13 @@ fi

 # . bin/autoupdate.sh

-# echo -e '\033[35m
+# printf '\033[35m
 #   ______________  _______
 #  /_  __/ ____/  |/  / __ \
 #   / / / __/ / /|_/ / /_/ /
 #  / / / /___/ /  / / ____/
 # /_/ /_____/_/  /_/_/
-# \033[0m'
+# \033[0m\n'
 # function check_tmp_secured {

 #   temp1=`grep -w "/var/tempFS /tmp ext3 loop,nosuid,noexec,rw 0 0" /etc/fstab | wc -l`
@@ -157,14 +158,14 @@ fi
 #   # Remove old tmp dir
 #   rm -rf /var/tmpbackup

-#   echo -e "\033[35;1m /tmp and /var/tmp secured using tmpfs. \033[0m"
+#   printf "\033[35;1m /tmp and /var/tmp secured using tmpfs. \033[0m\n"
 # } # End function secure_tmp_tmpfs

 # check_tmp_secured
 # if [ $? = 0  ]; then
 #     secure_tmp_tmpfs
 # else
-#     echo -e "\033[35;1mFunction canceled. /tmp already secured. \033[0m"
+#     printf "\033[35;1mFunction canceled. /tmp already secured. \033[0m\n"
 # fi

 # TODO add warning message on ssh connection if system needs updates
@@ -173,11 +174,11 @@ fi



-echo -e '\033[35m
+printf '\033[35m
                  __
  ___  ____  ____/ /
 / _ \/ __ \/ __  /
 /  __/ / / / /_/ /
 \___/_/ /_/\__,_/
-\033[0m'
-echo -e "\033[35;1m* * script done * * \033[0m"
+\033[0m\n'
+printf "\033[35;1m* * script done * * \033[0m\n"
@@ -0,0 +1,4 @@
+UserParameter=ct.memory.size[*],free -b | awk 'NR==2 {total=$ 2; used=($ 3+$ 5); pused=(($ 3+$ 5)*100/$ 2); free=$ 4; pfree=($ 4*100/$ 2); shared=$ 5; buffers=$ 6; cached=$ 6; available=$ 7; pavailable=($ 7*100/$ 2); if("$1" == "") {printf("%.0f", total )} else {printf("%.0f", $1 "" )} }'
+UserParameter=ct.swap.size[*],free -b | awk 'NR==3 {total=$ 2; used=$ 3; free=$ 4; pfree=($ 4*100/$ 2); pused=($ 3*100/$ 2); if("$1" == "") {printf("%.0f", free )} else {printf("%.0f", $1 "" )} }'
+UserParameter=ct.cpu.load[*],cut -d" " -f1-3 /proc/loadavg | awk -F'[, ]+' '{avg1=$(NF-2); avg5=$(NF-1); avg15=$(NF)}{print $2/'$(nproc)'}'
+UserParameter=ct.uptime,cut -d"." -f1 /proc/uptime
@@ -1,4 +1,4 @@
-# Install LEMP web server and secure it on debian 10
+# Install LEMP web server and secure it on debian 12

 Fail2ban, Ufw, Proftpd, Knockd, Nginx, Mariadb, php7.0-fpm, redis, vhosts, git barre repos, zabbix-agent, dotfiles and more

@@ -32,6 +32,23 @@ chmod a+x install.sh

 ```

+5 steps
+
+* misc.sh
+* dotfliles.sh
+* user.sh
+* ssh.sh
+* firewall.sh
+* fail2ban.sh
+* email.sh
+* lemp.sh
+* mysqlbackup.sh
+* vhost.sh
+* gitbarrerepos.sh
+* webhook.sh
+* urbackup.sh
+* zabbix.sh
+* 

 ## ref
 http://www.debian.org/doc/manuals/securing-debian-howto/
Author	SHA1	Message	Date
bachirandClaude Sonnet 5	2e3ec7883f	Replace echo -e with printf for portable ANSI banners dash (Debian's /bin/sh) doesn't support echo's -e flag: it prints "-e" literally as text before processing the rest of the string's backslash escapes. Every script's colored banner was affected. printf's escape handling is POSIX-mandated and behaves identically under dash and bash, so swap all 90 echo -e calls for printf, appending the trailing \n that echo used to add implicitly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-04 09:35:02 +02:00
bachirandClaude Sonnet 5	7ff4df1173	Fix installer bugs: broken root checks, PHP version mismatches, dead paths - Replace $EUID with $(id -u) for root checks across all bin/*.sh and install.sh: dash (Debian's /bin/sh) never sets $EUID, so the check was silently broken everywhere. - lemp.sh: make apt-get upgrade non-interactive (--yes), align the Redis PHP module and php-fpm restart with $PHP_VERSION instead of a hardcoded 8.1, and template the nginx PHP-FPM socket path via a PHP_FPM_SOCK placeholder substituted at install time. - nginx-phpmyadmin.conf: fix docroot to match the actual phpMyAdmin symlink location created by lemp.sh. - mysql-db.sh: inline the root check instead of sourcing the nonexistent bin/checkroot.sh. - webhook.sh: fix chowm typo (chown). - urbackup.sh: copy the systemd unit from assets/ instead of a relative path to a file that doesn't exist in the repo. - _addUserSite.sh: fix invalid `$var=value` assignment and an empty if-block that was a POSIX sh syntax error. Also carries over pending fixes to deploy-drupal.sh (drush now invoked via vendor/bin/drush) and gitbarrerepos.sh (comment cleanup). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-04 09:28:08 +02:00
bachir	5b11d25859	changed dotfiles repos from gogs to gitea	2026-09-04 09:16:51 +02:00
bachir	d4cfa267de	deb13 & changed php version	2026-06-02 16:55:33 +02:00
bachir	207a05f75b	some updates	2025-03-13 21:43:02 +01:00
bachir	308b65e7be	drupal deploy git submodul init fix	2024-07-29 12:15:04 +02:00
bachir	6efc4fba23	lemp php8.1 fix, drupal deploy git submodul init fix	2024-07-29 12:06:35 +02:00
bachir	47b88ae300	lemp and gitbarerepos	2023-12-21 09:53:56 +01:00
bachir	8863d1ef79	updtaed urbackup client	2023-12-21 09:53:17 +01:00
bachir	f6cfa57db6	somme options on zabbix-agent install	2023-11-26 18:09:20 +01:00
bachir	cdcb034b6b	improved webhook install, mysql comment innodb_buffer_pool_size	2023-11-26 17:59:15 +01:00
bachir	62c03fc009	somme options on zabbix-agent install	2023-11-26 17:57:29 +01:00
bachir	015307986d	fixed webhook-deploy install	2023-11-20 15:39:06 +01:00
bachir	c409589eab	misc fixes	2023-11-19 11:04:50 +01:00
bachir	0cc2b94c7e	updated sshd config	2023-11-18 11:26:36 +01:00
bachir	de547cc2dd	Merge branch 'master' into deb12	2023-11-02 11:18:37 +01:00
bachir	a8ea6b53bc	zabbix bug fix	2023-10-17 21:46:38 +02:00
bachir	300402a38f	updated zabbix	2023-10-17 21:42:08 +02:00
bachir	fd9e202d49	updated zabbix	2023-10-17 21:39:30 +02:00
bachir	8ecaf8d78a	reverted php to 8.1, fixed nginx-badbots	2023-10-09 11:09:50 +02:00
bachir	2c3682bf4c	fixed gitbarrerepos bug	2023-07-01 12:12:06 +02:00
bachir	692584ff8a	fixed gitbarrerepos bug	2023-07-01 12:10:19 +02:00
bachir	5c163b3ea2	updated urbackup client version	2023-07-01 10:47:11 +02:00
bachir	cb915edc33	fixed php version on nginx conf files	2023-06-30 12:31:39 +02:00
bachir	00c9aa6cd2	updated php in lemp to php8.2	2023-06-30 12:22:52 +02:00
bachir	665aaabe48	updated php in lemp to php8.2	2023-06-30 12:19:53 +02:00
bachir	a96789a9ed	updated php in lemp to php8.2	2023-06-30 12:18:43 +02:00
bachir	f317ded417	updated php in lemp to php8.2	2023-06-30 12:17:04 +02:00
bachir	418f2e5583	deb12	2023-06-30 11:49:51 +02:00
bachir	4b3ccb3fff	added nginx-badbots fail2ban rule https://stackoverflow.com/a/65552146	2023-03-31 11:27:55 +02:00
bachir	d2380db06b	misc	2023-03-31 11:16:46 +02:00
bachir	af5d1b1404	fixed urbackup settings file path	2022-10-18 10:02:54 +02:00
bachir	3503f954be	urbackup is now using coming from source systemd service	2022-10-16 21:57:16 +02:00
bachir	d2e30fc62f	updated urbackup client	2022-10-16 21:33:29 +02:00
bachir	1272de1add	updated php version	2021-11-08 15:53:04 +01:00
				`@@ -0,0 +1 @@`
				`UserParameter=linux.system.name.version,(lsb_release -d > dev/null 2>&1) && lsb_release -d \|\| (cat /etc/centos-release > /dev/null > /dev/null 2>&1 && cat /etc/centos-release \|\| cat /etc/redhat-release)`