commit 7a74c1b970db9330c7e22e12603ea821de52d852
Author: root <root@mail.libertylion.me>
Date:   Mon Aug 3 16:29:17 2026 +0200

    feat: initial operator setup scripts

diff --git a/00-setup-root.sh b/00-setup-root.sh
new file mode 100755
index 0000000..8bda057
--- /dev/null
+++ b/00-setup-root.sh
@@ -0,0 +1,53 @@
+#!/bin/bash -eu
+# Run this script as root on a fresh Debian server
+
+if [ "$EUID" -ne 0 ]; then
+    echo "Please run this script as root"
+    exit 1
+fi
+
+echo "=== Updating system packages ==="
+apt-get update && apt-get upgrade -y
+
+echo "=== Installing dependencies ==="
+apt-get install -y curl git ufw nginx certbot python3-certbot-nginx pwgen openssl
+
+echo "=== Installing Docker ==="
+curl -fsSL https://get.docker.com | sh
+
+echo "=== Configuring DNS (Quad9) ==="
+sed -i 's/1.1.1.1/9.9.9.9/g'  /etc/resolv.conf
+sed -i 's/8.8.8.8/9.9.9.10/g' /etc/resolv.conf
+if [ -f /etc/netplan/50-cloud-init.yaml ]; then
+    sed -i 's/1.1.1.1/9.9.9.9/g'  /etc/netplan/50-cloud-init.yaml
+    sed -i 's/8.8.8.8/9.9.9.10/g' /etc/netplan/50-cloud-init.yaml
+fi
+
+echo "=== Configuring firewall ==="
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow OpenSSH
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw allow 51820/udp
+ufw allow 48271/udp
+ufw allow 52428/udp
+ufw allow 54783/tcp
+ufw show added
+ufw enable -y
+
+echo "=== Creating Linux user ==="
+read -p "Enter a username to create: " LINUX_USERNAME
+read -s -p "Enter a password for ${LINUX_USERNAME}: " LINUX_PASSWORD
+echo ""
+
+useradd -m -s /bin/bash "$LINUX_USERNAME"
+echo "${LINUX_USERNAME}:${LINUX_PASSWORD}" | chpasswd
+usermod -aG sudo,docker "$LINUX_USERNAME"
+
+echo ""
+echo "User '${LINUX_USERNAME}' created and added to sudo and docker groups."
+echo ""
+echo "=== Done ==="
+echo ""
+echo "Next step: log in as '${LINUX_USERNAME}' and run setup-user.sh"
diff --git a/01-setup-user.sh b/01-setup-user.sh
new file mode 100755
index 0000000..21d684d
--- /dev/null
+++ b/01-setup-user.sh
@@ -0,0 +1,37 @@
+#!/bin/bash -eu
+# Run this as your Linux user — NOT as root
+
+if [ "$EUID" -eq 0 ]; then
+    echo "Please run this script as your Linux user, not as root"
+    exit 1
+fi
+
+echo "=== Detecting IPv6 ==="
+IPV6_ADDRESSES=$(ip -6 addr show | grep -oP 'inet6 \K[0-9a-fA-F:]+' | grep -v '^::1$' || true)
+if [ -n "$IPV6_ADDRESSES" ]; then
+    echo "IPv6 is enabled. Addresses:"
+    echo "$IPV6_ADDRESSES"
+    IPV6_RESULT="IPv6 Enabled"
+else
+    echo "IPv6 is not enabled."
+    IPV6_RESULT="IPv4 Only"
+fi
+
+echo ""
+echo "=== Generating SSH key for repo access ==="
+mkdir -p ~/.ssh
+echo "Hit Enter for the default path and leave the passphrase empty (press Enter twice)."
+ssh-keygen -t ed25519
+
+echo ""
+echo "================================================================"
+echo "Give Simplified Privacy the following information:"
+echo ""
+echo "1) Your SSH public key:"
+echo ""
+cat ~/.ssh/id_ed25519.pub
+echo ""
+echo "2) Your IPv6 status: ${IPV6_RESULT}"
+echo "================================================================"
+echo ""
+echo "Once SP has whitelisted your SSH key, run install.sh"
diff --git a/02-install.sh b/02-install.sh
new file mode 100755
index 0000000..a86c48f
--- /dev/null
+++ b/02-install.sh
@@ -0,0 +1,16 @@
+#!/bin/bash -eu
+# Run this as your Linux user — NOT as root
+# SP must have whitelisted your SSH key before running this
+
+if [ "$EUID" -eq 0 ]; then
+    echo "Please run this script as your Linux user, not as root"
+    exit 1
+fi
+
+REPO_URL="git@git.simplifiedprivacy.com:Support/operator-docker.git"
+
+echo "=== Cloning operator-docker repo ==="
+GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git clone "$REPO_URL" operator-docker
+
+cd operator-docker
+sudo bash install.sh