Fix server setup safety and docker tools - #6
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31d2eb2217
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| OS_TYPE="" | ||
|
|
||
| SSHD_CONFIG="/etc/ssh/sshd_config" | ||
| SSHD_MANAGED_CONFIG="/etc/ssh/sshd_config.d/99-linux-setup.conf" |
There was a problem hiding this comment.
On hosts that already have an earlier /etc/ssh/sshd_config.d/*.conf snippet setting Port or password authentication (for example distro/cloud 50-*.conf files), this 99-... file is read after them, and sshd_config(5) says “for each keyword, the first obtained value will be used.” In that environment the values written by options 3/4 are ignored, verify_ssh_* rolls the change back, and those SSH menu actions become unusable; the managed snippet needs to sort before existing defaults or otherwise remove/override conflicting earlier snippets.
Useful? React with 👍 / 👎.
| echo "# Managed by linux-setup.sh" | ||
| echo "# Do not edit manually unless you stop using the script." | ||
| if [ -n "$final_port" ]; then | ||
| echo "Port $final_port" |
There was a problem hiding this comment.
After option 4 succeeds, the new SSH port is now written only to /etc/ssh/sshd_config.d/99-linux-setup.conf, but configure_fail2ban.sh:get_ssh_port still greps only /etc/ssh/sshd_config and falls back to 22. If a user changes SSH to a non-22 port and then configures Fail2ban from this toolbox, the generated jail protects the wrong port and leaves the actual SSH listener unprotected.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR hardens a Linux server bootstrap toolkit by making SSH/DNS/sysctl changes safer for remote hosts and by improving Docker helper scripts (safer argument handling + container selection/completion).
Changes:
- Harden SSH configuration changes using an sshd drop-in file, plus validation/rollback logic.
- Make DNS and swap operations safer for remote servers (avoid network restarts; safer swap removal flow).
- Improve Docker helper scripts (remove
eval, add argument-based container selection and shell completion).
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| set_dns_via_dhclient.sh | Adds environment checks and avoids automatic network restarts; provides manual apply guidance. |
| server-setup.sh | Introduces sshd drop-in management + validation/rollback, safer swap removal, and Docker install arg handling. |
| README.md | Fixes command examples / markdown formatting for install URLs. |
| optimize_kernel_parameters.sh | Validates inputs and adds rollback when sysctl -p fails; updates tcp_moderate_rcvbuf setting. |
| manage_xanmod_kernel.sh | Minor debug output adjustment. |
| docker_tools/docker_utils.sh | Adds compose runner + container resolution helpers (but compose detection needs fixing). |
| docker_tools/docker_aliases.sh | Replaces aliases with functions for dlogs/dexec and adds completion. |
| docker_tools/dlogs.sh | Supports optional container arg (name or index) instead of always prompting. |
| docker_tools/dexec.sh | Supports optional container arg (name or index) instead of always prompting. |
| docker_tools/dcstats.sh | Adds ShellCheck suppression for sourced globals. |
| docker_tools/dcrestart.sh | Adds ShellCheck suppression for sourced globals; minor formatting. |
| docker_tools/dcps.sh | Adds ShellCheck suppression for sourced globals. |
| docker_tools/dclogs.sh | Adds ShellCheck suppression for sourced globals. |
| docker_tools/dc.sh | Removes eval and runs compose command safely with preserved argv boundaries. |
| configure_fail2ban.sh | Moves SSH jail config into jail.d drop-in file and adjusts related messaging/backup behavior. |
| add_docker_tools.sh | Updates generated aliases to functions and adds completion for container names. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "正在修改 SSH 端口为 $new_port..." | ||
| # 备份配置文件 | ||
| cp "$sshd_config" "${sshd_config}.bak" | ||
| # 修改或添加 Port 配置 | ||
| if grep -q "^\s*Port" "$sshd_config"; then | ||
| sed -i "s/^\s*Port.*/Port $new_port/" "$sshd_config" | ||
| else | ||
| echo "Port $new_port" >>"$sshd_config" | ||
| backup_dir=$(backup_ssh_state) | ||
| ensure_sshd_dropin_include | ||
| write_ssh_managed_config "$new_port" "keep" |
| if [ -f /etc/fstab ]; then | ||
| tmp_fstab=$(mktemp) | ||
| awk -v target="$item" '$1 != target {print}' /etc/fstab >"$tmp_fstab" | ||
| mv "$tmp_fstab" /etc/fstab | ||
| fi |
| local ban_time_seconds=$((ban_time_hours * 3600)) | ||
| local jail_local="/etc/fail2ban/jail.local" | ||
| local jail_local="/etc/fail2ban/jail.d/sshd-linux-setup.local" | ||
| local custom_comment="# SSH protection configured by fail2ban.sh script" | ||
| local log_path=$(detect_ssh_log_path) | ||
| local os_type=$(get_os_info) | ||
| local log_path | ||
| log_path=$(detect_ssh_log_path) |
| ensure_sshd_dropin_include() { | ||
| if head -n 1 "$SSHD_CONFIG" | grep -Eiq '^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config\.d/\*\.conf'; then | ||
| return 0 | ||
| fi | ||
|
|
||
| echo "正在将 sshd_config drop-in Include 放到文件顶部，确保脚本管理的配置优先生效。" | ||
| sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' "$SSHD_CONFIG" | ||
| } |
| run_docker_compose() { | ||
| if [ "$compose_cmd" = "docker compose" ]; then | ||
| docker compose "$@" | ||
| else | ||
| docker-compose "$@" |
|
@copilot review代码 |
Summary
Verification