kInit
One reviewed script does the first hour on every Debian box, and checks everything it downloads against a verified manifest.
source(opens in new tab)The problem
Every new server starts the same way: create a user, harden SSH, install the usual packages, wire up monitoring, set up unattended maintenance. Doing it by hand is slow and inconsistent. Doing it with a pile of copy-pasted snippets is worse, because nobody remembers which snippet ran on which box (I checked).
kInit turns that ritual into one reviewed script with four modules - system, utilities, software, miscellaneous - each independently toggleable. A fresh Debian or Ubuntu install goes in, a box you can actually work on comes out, and every box got there the same way.
Architecture
The first stage stays deliberately small: kInit.sh creates a private 0700 run
directory, downloads its helper library and a checksum manifest, verifies
both against SHA-256 hashes embedded in the script it just asked you to
read, and only then runs modules. Every file the modules fetch afterwards is
checked against that verified manifest. Optionally, minisign (a tool for signing and verifying files) adds real
provenance: a detached signature over the manifest, verified against a key
that never lives in the repository, failing closed (stopping rather than proceeding when verification fails) if anything is missing.
Bypassing integrity checks was made deliberately unpleasant (you're welcome, future me) - it requires an
interactive terminal and typing out an explicit risk acknowledgment.
The hardening choices favor not locking yourself out. Root SSH defaults to
prohibit-password; password authentication is disabled only after a usable
key was actually installed, and every SSH change passes sshd -t before it
is activated, via a drop-in file the uninstaller can cleanly remove.
Commands run as argv arrays (argument lists passed without shell parsing) rather than assembled strings, inputs like
hostnames, ports, and cron entries are validated, and analyze output redacts
anything that looks like a credential.
The maintenance modules install daily update and cleanup jobs with conservative defaults: ordinary upgrades that never remove packages unattended, existing config files preserved, journal retention trimmed, everything bounded by timeouts and detached from cron's terminal. Monitoring means a Zabbix agent installed from the official repository with normal APT key verification - the bundled packages are only repo configuration, not binaries. Analyze mode emits sanitized configuration and planned actions for CI use, and a setup profile from kUtils can be executed through the same machinery, HTTPS-only and hash-pinned by default.
Boundaries
kInit configures a server; it does not manage one. There is no agent, no drift detection, no reconciliation loop (a process that repeatedly restores declared state) - if you want fleet state enforced continuously, that is a configuration management problem and kInit will not pretend otherwise. Its trust root is the reviewed first-stage script: embedded checksums protect everything downloaded after it, which is exactly why the script is kept small enough to actually read before giving it root. The uninstaller is best-effort, and says so - it restores backups and removes what kInit owns, but leaves installed packages and authorized keys for a human to review.