Copy · paste · run
The Script Drawer
Tested, copy-ready scripts for Linux, macOS, and Windows — the exact commands behind the field notes. Click to copy, paste to run.
47 SCRIPTS · 9 CATEGORIES · 38 TESTED ON THE LIVE LAB
Security
8 scriptsRead-only forced-command SSH reader for a Git vault
Give cluster services and AI agents safe read-only access to a canonical vault via an SSH forced command — status, read, and search only, reporting the commit on every call, with no shell and no write path.
Vault secret store + Git history scrub
Set up a pointers-not-values secret pattern with a pre-commit guard, and purge a secret that was already committed from all Git history with git-filter-repo.
ClamAV Download Scan + Auto-Purge (Docker)
Run ClamAV in a container to scan your download folder, delete executables that masquerade as media, and quarantine infected files on a schedule.
Block SSH brute-force with fail2ban (Linux)
Install fail2ban and configure an SSH jail that auto-bans IPs after repeated failed login attempts. Works on Ubuntu, Debian, Fedora, and openSUSE.
Generate a self-signed TLS certificate (Linux / macOS / Windows)
Create a self-signed TLS certificate and private key with OpenSSL for internal homelab services. Includes Subject Alternative Names so modern browsers accept it.
SSH Server Hardening (Linux)
Disable password auth, lock down SSH to key-only access, change the default port, and restrict user logins. Works on Ubuntu, Debian, Fedora, and openSUSE.
Generate an SSH key pair (Linux / macOS / Windows)
Create an Ed25519 SSH key pair and copy the public key to a remote server. Works identically on Linux, macOS, and Windows 10+ with the built-in OpenSSH client.
UFW Firewall Baseline (Ubuntu / Debian)
Set up a secure default UFW ruleset: deny all inbound, allow SSH and common homelab services. Safe to run on a fresh VPS or LXC container.
Networking
5 scriptsFlush the DNS cache (Linux / macOS / Windows)
Clear the local DNS resolver cache on Linux, macOS, and Windows. Fixes stale DNS records after changing a hostname, IP, or internal DNS entry.
Set a static IP with netplan (Ubuntu / Debian)
Configure a static IP address on Ubuntu or Debian using netplan. Includes a dry-run safety step so you can't accidentally lock yourself out of a remote server.
Install Tailscale on Linux
One-command Tailscale install that works on Ubuntu, Debian, Fedora, openSUSE, Arch, and most other Linux distros. Official install script from Tailscale.
Install Tailscale on macOS
Install Tailscale on macOS via Homebrew or the Mac App Store. Includes subnet routing and exit node setup for homelab access.
Infrastructure
7 scriptsScratch container lifecycle: create, configure, destroy from code
The full test loop for Proxmox infrastructure code — mint a scoped identity, tofu apply a throwaway container, converge it with Ansible, destroy every trace.
Install Proxmox Backup Server + Connect It to PVE
Install PBS 4 from the no-subscription repo, create a datastore, and register it as storage on your Proxmox VE node — ready for deduplicated, scheduled VM and container backups.
Build a Proxmox Cloud-Init Template + Clone a VM
One script to turn the Ubuntu 24.04 cloud image into a reusable Proxmox template, plus the three commands that clone and personalize a ready-to-boot VM in seconds.
Create a Proxmox VM from the CLI (q35 + OVMF + VirtIO)
The full create-VM wizard as one qm command — q35 machine, OVMF firmware with EFI disk, host CPU, VirtIO SCSI and network, guest agent enabled, ISO attached and ready to install.
Install Jellyfin Media Server on Debian/Ubuntu
Install the free, open-source Jellyfin media server on Debian or Ubuntu using the official APT repository, then reach the setup wizard on port 8096.
Install Plex Media Server on Debian/Ubuntu
Add Plex's official APT repository, install Plex Media Server, and claim a headless server to your account from the command line.
Containers
9 scriptsCreate a Proxmox LXC Container from the CLI
Download a Debian 12 container template with pveam and create an unprivileged LXC with pct — cores, memory, rootfs, DHCP networking, and nesting enabled, started and updated in one pass.
Traefik + Let's Encrypt Reverse Proxy (Docker Compose)
A complete Traefik v3 docker-compose.yml with automatic Let's Encrypt certificates, an HTTPS redirect, and label-based routing — plus the DNS-challenge variant for wildcard certs on internal services.
Your First Docker Compose Stack (nginx hello-world)
A starter Docker Compose stack that serves a local folder with nginx. Demonstrates images, containers, ports, volumes, and the five daily-driver compose commands on Linux, macOS, and Windows.
Homepage Dashboard — Docker Compose Install
Deploy the Homepage application dashboard with Docker Compose. Creates the config directory, sets the required HOMEPAGE_ALLOWED_HOSTS variable, and starts the container on port 3000.
Immich Photo Backup — Docker Compose Install
Deploy Immich v3 with Docker Compose on Linux. Downloads the official compose and env files, sets the upload location and database password, and starts the full stack on port 2283.
Uptime Kuma — Docker Compose Install
Deploy Uptime Kuma monitoring on Linux with Docker Compose. Persists data to a named volume and exposes the web UI on port 3001. Covers notification setup and monitor types.
Arr Stack Docker Compose (Prowlarr, Radarr, Sonarr + VPN)
A complete docker-compose.yml for the *arr stack — Prowlarr, Radarr, Sonarr, and a VPN-shielded qBittorrent — with the single-root layout that makes imports instant hardlinks.
VPN-Shielded Torrent Stack (gluetun + qBittorrent)
Run qBittorrent inside a gluetun VPN container so all torrent traffic exits through a VPN with a kill-switch — plus port-forward sync for full download speed.
Knowledge Base
7 scriptsA cited RAG endpoint over your Markdown wiki
Retrieve-then-generate Q&A over a local embeddings index in one dependency-free Node file — correct query prefix, in-memory ranking, numbered citations, and every answer stamped with the revision it came from.
Begin/End skills: a revision-labeled cold start for AI agents
Give AI agents a fail-closed cold start against a Git vault — verify the canonical commit, load the smallest relevant context, and persist outcomes only through the controlled writer.
Build and query a local embeddings index for a Markdown vault
Section-chunk a Markdown vault, embed with nomic-embed-text on a local Ollama cluster, cache by content hash, swap the index atomically stamped with the vault commit, and query it with fail-closed staleness checks.
Canonical writer lock + validation gates
Serialize writes to a canonical vault behind a file lock, validate before committing (stdin-fed audit), refresh and verify projections, and abort safely with SIGINT so the lock is always released.
Generate a topic-map graph from Markdown frontmatter
A Node script that reads topic:/relates: frontmatter across a Markdown vault and generates MOC index pages, region tags, and backlink blocks — with a --check gate that blocks stale commits.
Stand up a Git + Markdown knowledge vault
Create a bare Git vault on an always-on host and mount it from your laptop over SSHFS, so your editor works on the one canonical copy with no sync step.
Tools
5 scriptsPlex Transcoder Tuning for Weak CPUs (API)
Tune a headless Plex server's transcoder over the API for low-power hardware: disable broken hardware acceleration, prefer speed, cap concurrent transcodes, and use a RAM temp dir.
Check what's using a port (Linux / macOS / Windows)
Find which process is listening on a given port number on Linux, macOS, or Windows. Essential for diagnosing port conflicts when a service fails to start.
Create a Ventoy USB drive on Linux
Download, verify, and install Ventoy on a USB drive from Linux. Supports BIOS and UEFI. Drop ISOs directly onto the drive — no re-flashing needed between images.
Create a Ventoy USB drive on macOS
Download and install Ventoy onto a USB drive from macOS using the official GUI app. Drop ISO files directly onto the drive — no re-flashing between images.
Monitoring
2 scriptsNUT: One-UPS Network Shutdown (Server + Client)
Wire one UPS to shut down a whole homelab: NUT server on the machine with the USB cable, NUT clients on every other machine, safe automatic shutdown on low battery.
Node Exporter + pve-exporter for Proxmox Metrics
Install prometheus-node-exporter on every Proxmox node and prometheus-pve-exporter with a read-only API token — the two endpoints Prometheus needs for full host and cluster metrics.
Storage
2 scriptsSamba + NFS File Server on Debian/Ubuntu (LXC or VM)
Stand up a central file server that shares the same storage over Samba (for Windows, macOS, and phones) and NFS (for other Linux hosts). Single user, consistent UID 1000 ownership.
Plex Default-Subtitle Sweep (Linux)
Clear default subtitle flags across a media library with ffmpeg stream-copy remux so files Direct Play instead of forcing a transcode — plus a cron job for new downloads.
Automation
2 scriptsCluster drift detector: OpenTofu plan + Ansible check in one command
One script that answers 'has anything in my cluster changed that nobody wrote down?' — guest definitions via tofu plan, node config via ansible --check.
Home Assistant OS VM on Proxmox (community-scripts helper)
Create a Home Assistant OS virtual machine on Proxmox using the community-scripts helper. One command on the Proxmox shell downloads the official HAOS KVM image, builds the VM, and boots it.
No scripts found for this filter.