A collection of interactive, fully user-configurable scripts for provisioning and hardening Linux dedicated servers.
Fully interactive Pterodactyl Panel and Wings installer for Debian, Ubuntu, RHEL, Rocky Linux, and AlmaLinux.
What it does:
- Detects the OS and installs the correct packages
- Configures MariaDB (local or remote) with randomly generated credentials
- Installs Redis, PHP-FPM, Caddy (replaces nginx), and optionally Docker
- Downloads and installs the Pterodactyl Panel from the target directory
- Runs migrations and seeds the database
- Creates the first admin user, location, and node with random credentials
- Generates a Caddyfile with automatic HTTPS for both the Panel URL and the Wings FQDN
- Optionally installs Wings and Docker on the same host
- Sets up the queue worker systemd service and cron scheduler
- Saves generated credentials to
pterodactyl-credentials.txtin the script directory
Usage:
sudo ./install-pterodactyl.shInteractive dedicated server firewall hardening script with ipsum scanner blocking.
What it does:
- Detects the OS and installs iptables, ipset, and persistence tools
- Downloads the ipsum blocklist and populates an ipset
- Blocks all IPs from the ipsum scanner/bruteforce database via iptables
- Offers preset port configurations:
- Basic web — 80, 443
- Game servers — Minecraft, Valheim, ARK, Rust, Source engine, DayZ, 7 Days to Die, Factorio, Satisfactory, Project Zomboid, FiveM
- Voice — TeamSpeak, Mumble
- All of the above
- Custom — select ports manually
- Each port can be restricted to specific source IPs/CIDR
- SSH hardening: key-only authentication, root login prohibited, password auth disabled
- Auto-generates an ED25519 SSH key pair for root if none exists
- Applies kernel hardening via sysctl (reverse path filtering, source route disable, syncookies, ICMP flood protection, disabled unused modules)
- Saves iptables rules persistently and configures daily ipsum blocklist auto-updates
Usage:
sudo ./secure-server.shInteractive WireGuard VPN setup with SSH restricted to the server's public IP only.
What it does:
- Installs WireGuard on Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
- Generates server and client key pairs
- Creates a WireGuard interface with configurable VPN subnet
- Generates per-client configuration files
- Configures iptables to allow VPN traffic and restrict SSH to the server's public IP only
- Enables IP forwarding and NAT for VPN clients
- Persists firewall rules across reboots
Usage:
sudo ./vpn-setup.shInteractive Pelican.dev installer (native PHP, no Docker) for Debian, Ubuntu, RHEL, Rocky Linux, and AlmaLinux.
What it does:
- Detects the OS and installs PHP-FPM, MariaDB, Redis, Caddy, and Composer
- Downloads the latest Pelican Panel release to
/var/www/pelican - Configures the
.env, database, and application settings - Runs migrations and seeds the database
- Creates the first admin user with random credentials
- Configures Caddy with automatic HTTPS for the Panel domain
- Sets up the queue worker systemd service and cron scheduler
- Optionally installs Wings on the same host
- Sets up a daily auto-updater via
/etc/cron.daily/pelican-update - Saves generated credentials to
pelican-credentials.txtin the script directory
Usage:
sudo ./install-pelican.shBoth install-pterodactyl.sh and install-pelican.sh configure daily auto-updaters:
- Pterodactyl:
/etc/cron.daily/pterodactyl-update - Pelican:
/etc/cron.daily/pelican-update
Each updater:
- Checks GitHub for the latest release
- Downloads and extracts the new release
- Preserves
.envandstorage/(user uploads, logs, cache) - Reinstalls composer dependencies
- Runs database migrations
- Clears caches and restarts the queue worker
- Root access
- Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
curl,openssl- Internet connectivity for package and image downloads
After running any installer, credentials are saved to the script directory:
/root/scripts/pterodactyl-credentials.txt(Pterodactyl)/root/scripts/pelican-credentials.txt(Pelican)
Both files are created with chmod 600 and contain admin passwords, database passwords, and connection details.
- The Pterodactyl Panel directory defaults to
/var/www/pterodactylbut can be changed interactively - Existing
.envfiles are backed up before modification - Existing Caddy configurations are backed up before replacement
- Wings is installed on the same host by default but can be skipped for remote node setups
- The ipsum blocklist is updated daily via cron
- Pelican uses a native PHP installation (no Docker) with Caddy as the web server
- Pelican Wings is a separate binary that connects to the Panel via the configured domain
- Both installers include daily auto-updaters that preserve config and user data
Interactive WireGuard VPN setup with SSH restricted to the server's public IP only.
What it does:
- Installs WireGuard on Debian, Ubuntu, RHEL, Rocky Linux, or AlmaLinux
- Generates server and client key pairs
- Creates a WireGuard interface with configurable VPN subnet
- Generates per-client configuration files
- Configures iptables to allow VPN traffic and restrict SSH to the server's public IP only
- Enables IP forwarding and NAT for VPN clients
- Persists firewall rules across reboots
Usage:
sudo ./vpn-setup.shInteractive GRE tunnel setup for BuyVM DDoS-filtered VPS.
What it does:
- Creates a GRE tunnel between a BuyVM VPS (unfiltered IP) and a remote destination server
- Supports two modes:
- Basic — general-purpose GRE tunnel for any traffic
- Docker/Pterodactyl — DDoS-protected game servers with proper routing, NAT, and DNS configuration
- Configures NAT to masquerade traffic through the BuyVM DDoS-filtered IP
- Forwards specified ports (or all ports) over the GRE tunnel
- Configures source routing on the remote server for proper return traffic
- Supports optional SSH-based remote server configuration
- Persists the tunnel across reboots via
/etc/rc.local - Tests the tunnel with ping after setup
Usage:
sudo ./gre-tunnel.sh