atl.sh is a public Unix environment (pubnix) for the All Things Linux community. Get a shell account, host a personal website, and connect with others on a shared server.

• SSH access on ports 22 and 2222 (key-only, passwords disabled)
• Shells: bash, zsh, fish, mksh
• Editors: vim, neovim, nano, emacs, micro, joe
• Languages: Python, Node.js, Go, Rust, Ruby, C/C++, Haskell, Elixir, Java, and 20+ more
• Tools: tmux, git, ripgrep, fzf, jq, bat, eza, lazygit, and many more
• Package managers: pip/pipx/uv, npm/pnpm, cargo, gem, go install — install to ~/.local/

• Web: Static sites at https://atl.sh/~username with CGI support
• Gemini: Capsules at gemini://atl.sh/~username
• Gopher: Holes at gopher://atl.sh/~username
• FTP/S: Explicit FTP over TLS (port 21); SFTP via SSH
• Finger: Profiles at finger [email protected] via ~/.plan and ~/.project

• Webring: Self-managing ring of member sites — join with touch ~/.ring
• Games: NetHack with shared high scores, botany virtual plant, angband, crawl, and arcade games
• Messaging: write, talk, wall for real-time user-to-user communication
• IRC: #support on irc.atl.chat (port 6697, SSL)

• CIS hardening: kernel parameters (ASLR, ptrace restrictions), network protections, module blacklisting
• SSH: key-only auth, ports 22 + 2222, max 3 auth attempts, allowed groups enforced
• Fail2ban: 1-hour bans after 5 failures in 10 minutes
• Firewall: UFW with allowlist — only necessary ports open
• AIDE: file integrity monitoring, daily checks at 05:00 UTC
• Auditd: 40+ rules covering identity files, privilege escalation, suspicious tools, and syscalls
• Resource isolation: systemd cgroup v2 user slices per user
• Private /tmp: pam_namespace polyinstantiation — each session gets an isolated tmpdir
• Automatic updates: unattended security upgrades

This project uses just as a task runner. Run just to list all commands.

• Ansible
• just
• Vagrant + vagrant-libvirt (for local dev)
• Terraform 1.8+ (for infrastructure)

just install   # install Ansible roles and collections

just dev-up          # start Vagrant VM
just deploy dev      # run Ansible against dev VM

# SSH into dev VM
ssh -p 2223 -i .ssh/dev_key [email protected]

Requires .ssh/dev_key and .ssh/dev_key.pub — see docs/testing.md for setup.

# Infrastructure
just tf-init
just tf-apply

# Configuration
just deploy prod

# Selective deploy by role tag
just deploy-tag prod infra
just deploy-tag prod services

# User management
just create-user <username> '<ssh-ed25519 AAAA...>' prod
just remove-user <username> prod

Roles run in the order defined in ansible/site.yml:

pre-commit install
just lint          # runs pre-commit, ansible-lint, terraform fmt/validate
just syntax-check  # ansible playbook syntax check only

Full documentation is at docs.atl.sh, built with Fumadocs and deployed to Cloudflare Workers from the docs/ directory.

Source and issue tracker: github.com/allthingslinux/atl.sh. Pull requests and bug reports are welcome.

GNU GPL-3.0