Hands-on guides, automation scripts, and CI/CD pipelines for Linux servers, Windows workstations, and the plumbing in between.
Hands-on guides and automation scripts for Linux firewalls and WireGuard VPN access to Windows.
Complete guide to firewalld on Fedora — zones, services, rich rules, and the mental model behind trust levels. From first rule to production lockdown.
UFW from scratch — ordered rules, default policies, logging, and when to drop down to iptables. Straightforward firewall management without the ceremony.
Bash script that automates WireGuard server install on Fedora: key generation, wg0.conf creation, firewalld rules, and systemd service bring-up. Supports --add-peer.
Remote access VPN from Windows to a Fedora host, with SSH locked to the tunnel. Full walk-through from server config to Windows client — plus a concise quick-reference.
Ubuntu server + Windows client setup with UFW rules and SSH bound to the VPN subnet. Includes both the complete guide and a quick-start variant for fast rebuilds.
One-shot Bash hardening pass: AIDE, auditd, fail2ban, SELinux enforcing, USBGuard, password quality, SSH lockdown, and firewalld baseline. Idempotent and log-everything.
Expose a service running inside a libvirt VM on the host's LAN IP. Zone selection, masquerade, IP forwarding, and WireGuard-aware troubleshooting for when it only half-works.
Read/write folder on the Fedora host exposed over SMB to Windows guests on libvirt's default network. Covers SELinux contexts, firewalld in the libvirt zone, and Samba user mapping.
qemu-img + virt-install one-liners to spin up Server 2022 VMs for an Active Directory + Exchange lab: correct disk perms, host-passthrough CPU, split OS/data disks, SPICE console, and libvirt network wiring.
Docker Compose stack that ingests Cisco IOS-XE model-driven telemetry over gRPC dial-out. Includes Cisco telemetry ietf subscription templates and ready-to-paste Flux queries for CPU, memory, interface rates, errors, and OSPF neighbor state.
Real GitHub Actions workflows that gate every script in this repo — run on each push, block merges on failure.
One workflow, four parallel jobs. Linting gates every .sh and .md;
integration jobs run each script end-to-end on a fresh OS image and assert the expected
state landed. Runs on every push & PR, plus weekly to catch upstream package regressions.
Silent, unattended installers and deployment scripts for common Windows software stacks.
Bootstraps a fresh dev box on Windows or Ubuntu. Installs VS Code, Git, Node.js, .NET SDK, Docker, plus shell tooling on Linux (ripgrep, fd, fzf, bat, tmux, neovim).
One-shot baseline hardening for Fedora or FreeBSD servers. AIDE, auditd, fail2ban, SELinux enforcing, USBGuard, SSH lockdown, and firewalld on Fedora; PF, SSH hardening, sysctl & blacklist.conf on FreeBSD. Log-everything, idempotent.
Ubuntu 22.04 / 24.04 build agent with every common toolchain: Node, Python, Java, .NET, Go, Rust, Docker. Headless, idempotent, flag-driven (--skip-* / --with-cloud).
--skip-*)ci user (unless --no-ci-user)--with-cloudBootstraps a Fedora workstation into a KVM/libvirt lab host for network automation — hypervisor, dev tools, and a full Python networking stack (Netmiko, NAPALM, Nornir, Scrapli, PyEZ).
@virtualization & enable libvirtdperformanceWhat you'll find here, and what it's for.
A working notebook of infrastructure scripts and operational guides — patterns worth keeping documented somewhere durable and searchable. Everything here is built and tested in a home lab, then trimmed down to the parts that actually matter.
What's covered:
Scripts are written to be read first and run second — skim before you pipe anything to a shell. Nothing here is a finished product; it's a snapshot of a lab that's still being built.