After reinstalling Linux, you usually need to install packages, set up SSH, configure the firewall, and install apps. This repo automates all of that in one go.

What you get:

25+ system packages installed automatically (git, curl, tmux, ufw, fail2ban, etc.)
Unified pos CLI — one command for network, Docker, media, system, and SSH tasks
119+ self-hosted services via ScaleTail + Tailscale (Jellyfin, Home Assistant, etc.)
15 optional desktop apps (VS Code, Docker Desktop, Brave, OBS, etc.) — pick what you want
systemd services for SSH agent and boot-time automation
Everything in /usr/local/bin/ — you can delete the repo after install

Quick Start

git clone https://gitea.skink-platy.ts.net/admin/Linux_post_install.git
cd Linux_post_install
./install.sh              # core: packages + CLI + services + ScaleTail
./install.sh --apps       # core + interactive app picker
./install.sh --full        # core + all apps (non-interactive)

Flags:

Flag	What it does
`--apps`	Run interactive app picker after core install
`--full`	Core install + all apps (no prompts)
`--dry-run`	Preview without executing anything
`--skip <phase>`	Skip a phase (repeatable): `preinstall`, `scripts`, `postinstall`, `scalepoint`
`--steps <spec>`	Run specific phases only, e.g. `--steps 1,3` or `--steps 1-3`
`--no-color`	Disable colored output

What Gets Installed

Phase	Script	What happens
1	`preinstall.sh`	`apt update` + 25+ packages + yt-dlp + fail2ban
2	`install.sh`	Copies all `bin/` tools to `/usr/local/bin/`
3	`postinstall.sh`	Configures fail2ban, SSH agent, PATH, bash completion, systemd services
4	ScaleTail clone	Downloads 119+ Docker Compose templates with Tailscale sidecar
5 (opt)	`apps/install.sh`	Installs desktop apps you select

The `pos` CLI

After install, use the pos command for everything:

pos                          # list available categories
pos help network             # help for a specific category

Network

pos network ip                               # Show interfaces, routes, public IP
pos network checkport 192.168.1.1:80         # Check if a TCP port is open
pos network scan 192.168.8.0/24              # Fast parallel ping sweep

Docker

pos docker ps                                # List containers with health, IPs, ports
pos docker health                            # Health dashboard (exits 1 if unhealthy)

Compose (ScaleTail — 119+ self-hosted services)

Each service runs with a Tailscale sidecar and gets its own tail-xxxxx.ts.net URL.

Quick start:

# 1. Set your Tailscale auth key (required once)
pos docker compose config set TS_AUTHKEY=tskey-auth-xxxxx

# 2. Deploy a service
pos docker compose up jellyfin

# 3. Open https://jellyfin.tail-xxxxx.ts.net

All commands:

pos docker compose ls                        # List available service templates
pos docker compose installed                 # List deployed services
pos docker compose up jellyfin               # Deploy or start a service
pos docker compose down actual-budget        # Stop a service
pos docker compose logs home-assistant -f    # Tail logs
pos docker compose restart home-assistant    # Restart a service
pos docker compose update                    # Pull latest templates + refresh deployed compose files
pos docker compose config                    # Show current configuration
pos docker compose config set TZ=Asia/Tokyo  # Set a global default
pos docker compose config edit               # Open config in editor

Config strategy — three layers:

Layer	File	Purpose
Template defaults	`/usr/local/share/linux_post_install/scale-tail/services/<name>/.env`	Per-service defaults from ScaleTail
Global config	`~/.config/linux_post_install/compose.env`	Your defaults — applies to all services
Per-service	`/srv/<service>/.env`	Actual config — created on first deploy, never overwritten

Set global defaults once, then every up fills them into the new service's .env.

Paths:

Templates: /usr/local/share/linux_post_install/scale-tail/services/
Deployments: /srv/<service>/ (configurable via SERVICES_BASE)
Global config: ~/.config/linux_post_install/compose.env

Config keys:

Key	What it does
`TS_AUTHKEY`	Tailscale auth key (required for sidecar networking)
`TZ`	Timezone for the service
`DNS_SERVER`	Custom DNS server
`SERVICES_BASE`	Where services are deployed (default: `/srv`)

VBox (disposable Docker containers)

pos vbox create lab1                         # Create — prompts to enter
pos vbox create lab1 --dir .                 # Bind mount current directory
pos vbox enter lab1                          # Auto-starts if stopped
pos vbox ls                                  # List vbox containers only
pos vbox stop/start/rm lab1

Media

pos media mp3 https://youtube.com/watch?v=...    # Audio → MP3
pos media mp4 https://youtube.com/watch?v=...    # Video with format selection

System

sudo pos system firewall                     # Interactive UFW manager

SSH

pos ssh load-keys                            # Load all SSH keys into agent

The ssh-agent.service runs at boot. SSH_AUTH_SOCK is set in ~/.bashrc.

Legacy wrappers

These still work and forward to pos: wr-ip, wr-checkport, wr-scan-ping, wr-docker, wr-compose, wr-ufw, mp3, mp4, vbox, ssh-load-all.

Optional Apps

Install with ./apps/install.sh (interactive), ./apps/install.sh --all, or by name. Uninstall the same way with --uninstall:

./apps/install.sh --uninstall                  # interactive uninstall selection
./apps/install.sh --uninstall --all            # uninstall everything
./apps/install.sh --uninstall brave vscode     # uninstall specific apps

Category	Apps
Browsers	Brave
Development	opencode, VS Code
Media	OBS Studio, scrcpy, VLC
Networking	NetBird, Tailscale, ZeroTier
Remote Access	Termius, VNC Viewer
System	Docker Engine, QEMU + KVM
Utilities	AFFiNE, btop, LocalSend

Development

See DEV.md for architecture, conventions, and how to add or modify tools.

README.md

Linux_post_install — Personal Bootstrap & Homelab Toolkit

What Is This