From 949e62748198d58d05ed9cc9eca9437c0f673ef6 Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:14:22 +0200
Subject: [PATCH 1/8] feat: add K3s installer

kubernetes/k3s_installer.sh installs K3s via get.k3s.io with --control-plane / --worker roles. Same helper block, section layout and Verb-Noun function names as the other installers.
---
 kubernetes/k3s_installer.sh | 248 ++++++++++++++++++++++++++++++++++++
 1 file changed, 248 insertions(+)
 create mode 100755 kubernetes/k3s_installer.sh

diff --git a/kubernetes/k3s_installer.sh b/kubernetes/k3s_installer.sh
new file mode 100755
index 0000000..722ed96
--- /dev/null
+++ b/kubernetes/k3s_installer.sh
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+#
+# K3s Installer Script
+#
+# Installs K3s, the lightweight single-binary Kubernetes distribution, via the
+# official installer at https://get.k3s.io. The installer bundles containerd,
+# so it works on any systemd-based Linux without a distro package manager.
+# Kubernetes role names are used (control plane / worker); K3s' own
+# "server / agent" wording is mapped internally.
+# Run as root.
+#
+
+set -euo pipefail
+
+# ============================================================================
+# Common Helper Functions
+# The same helpers are used in every bash script in this repo, so the
+# scripts stay consistent while remaining standalone single-file downloads.
+# Function names follow the PowerShell Verb-Noun convention.
+# ============================================================================
+
+# shellcheck disable=SC2034  # not every script uses every color
+readonly RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[1;33m' \
+         BLUE='\033[0;34m' PURPLE='\033[0;35m' BOLD='\033[1m' NC='\033[0m'
+
+# Optional plain-text logfile; set LOG_FILE after this block to enable.
+LOG_FILE="${LOG_FILE:-}"
+
+# Usage: Write-Log <INFO|SUCCESS|WARN|ERROR|STEP> "message"
+Write-Log() {
+    local level=$1; shift
+    local color=$NC
+    case $level in
+        INFO)    color=$BLUE ;;
+        SUCCESS) color=$GREEN ;;
+        WARN)    color=$YELLOW ;;
+        ERROR)   color=$RED ;;
+        STEP)    color=$PURPLE ;;
+    esac
+    if [[ $level == ERROR ]]; then
+        echo -e "${color}[$level]${NC} $*" >&2
+    else
+        echo -e "${color}[$level]${NC} $*"
+    fi
+    if [[ -n "$LOG_FILE" ]]; then
+        echo "[$level] $*" >> "$LOG_FILE"
+    fi
+}
+
+# Usage: Stop-Script "fatal message"
+Stop-Script() {
+    Write-Log ERROR "$1"
+    exit 1
+}
+
+# Usage: Test-Root  (exits unless running as root)
+Test-Root() {
+    [[ $EUID -eq 0 ]] || Stop-Script "Run as root (sudo)."
+}
+
+# Usage: mgr=$(Get-PkgMgr)  ->  apt | dnf | pacman | unknown
+Get-PkgMgr() {
+    if command -v apt-get >/dev/null 2>&1; then
+        echo "apt"
+    elif command -v dnf >/dev/null 2>&1; then
+        echo "dnf"
+    elif command -v pacman >/dev/null 2>&1; then
+        echo "pacman"
+    else
+        echo "unknown"
+    fi
+}
+
+# Usage: os_id=$(Get-OsId)  ->  lowercase /etc/os-release ID (ubuntu, debian,
+# fedora, arch, ...) or "unknown". Call in $(...) so sourcing stays contained.
+Get-OsId() {
+    if [[ -r /etc/os-release ]]; then
+        # shellcheck disable=SC1091
+        . /etc/os-release
+        local os_id="${ID:-unknown}"
+        echo "${os_id,,}"
+    else
+        echo "unknown"
+    fi
+}
+
+# Usage: Invoke-Cmd command [args...]
+# Logs the command, sends its output to LOG_FILE when set, aborts on failure.
+Invoke-Cmd() {
+    Write-Log INFO "Executing: $*"
+    if [[ -n "$LOG_FILE" ]]; then
+        "$@" >> "$LOG_FILE" 2>&1 || Stop-Script "Command failed: '$*'. Check log: $LOG_FILE"
+    else
+        "$@" || Stop-Script "Command failed: '$*'"
+    fi
+}
+
+# ============================================================================
+# Usage
+# ============================================================================
+
+Show-Usage() {
+    cat <<'EOF'
+Usage: k3s_installer.sh <role> [options]
+
+Roles:
+  --control-plane   Install the first K3s node (control plane)
+  --worker          Join this node to an existing cluster as a worker
+
+Options (worker):
+  --url URL         Control-plane API URL, or a bare IP/host (-> https://IP:6443)
+  --token VALUE     Join value from the control plane
+                    (/var/lib/rancher/k3s/server/node-token)
+
+Other:
+  -h, --help        Show this help
+
+After a --control-plane install the summary prints the join value and the
+exact --worker command to run on the other nodes.
+
+Examples:
+  sudo ./k3s_installer.sh --control-plane
+  sudo ./k3s_installer.sh --worker --url https://10.0.0.1:6443 --token K10abc...
+EOF
+}
+
+# === Settings ===
+LOG_FILE="/tmp/k3s_install_$(date +%Y%m%d_%H%M%S).log"
+
+# Pinned K3s release (Renovate-managed). get.k3s.io reads INSTALL_K3S_VERSION.
+K3S_VERSION="${K3S_VERSION:-v1.36.4+k3s1}"
+
+# === Commands ===
+
+# Usage: Install-ControlPlane
+Install-ControlPlane() {
+    Write-Log INFO "Installing K3s ${K3S_VERSION} (control plane)"
+
+    # get.k3s.io is Rancher's official install path; it is a remote script.
+    Write-Log WARN "Fetching and running the official installer from https://get.k3s.io"
+    curl -sfL https://get.k3s.io | \
+        INSTALL_K3S_VERSION="$K3S_VERSION" sh -s - server >> "$LOG_FILE" 2>&1 || \
+        Stop-Script "K3s install failed. Check log: $LOG_FILE"
+    Invoke-Cmd systemctl enable k3s
+
+    Write-Log INFO "Waiting for the node to become Ready..."
+    local _
+    for _ in $(seq 1 45); do
+        k3s kubectl get node 2>/dev/null | grep -q ' Ready ' && break
+        sleep 2
+    done
+    k3s kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'k3s kubectl get node'."
+
+    local node_ip node_join k3s_ver
+    node_ip=$(hostname -I | awk '{print $1}')
+    node_join=$(cat /var/lib/rancher/k3s/server/node-token 2>/dev/null || true)
+    k3s_ver=$(k3s --version 2>/dev/null | head -n1) || k3s_ver="N/A"
+
+    echo -e "\n${GREEN}==============================================================${NC}"
+    Write-Log SUCCESS "K3s control plane ready!"
+    echo -e "${GREEN}==============================================================${NC}\n"
+    echo -e "${BLUE}K3s:${NC}          ${GREEN}${k3s_ver}${NC}"
+    echo -e "${BLUE}kubeconfig:${NC}   ${GREEN}/etc/rancher/k3s/k3s.yaml${NC}"
+    echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
+    echo ""
+    echo -e "${BLUE}Join a worker:${NC}"
+    echo -e "  sudo ./k3s_installer.sh --worker --url https://${node_ip}:6443 --token ${node_join:-(see /var/lib/rancher/k3s/server/node-token)}"
+    echo ""
+    echo -e "${BLUE}Use kubectl:${NC}  export KUBECONFIG=/etc/rancher/k3s/k3s.yaml   # or: k3s kubectl ..."
+}
+
+# Usage: Install-Worker <server-url-or-ip> <join-value>
+Install-Worker() {
+    local url=$1 join=$2
+
+    [[ -n "$url"  ]] || Stop-Script "Worker needs --url https://<control-plane-ip>:6443"
+    [[ -n "$join" ]] || Stop-Script "Worker needs --token <value from the control plane>"
+    [[ "$url" == https://* ]] || url="https://${url}:6443"
+    [[ "$join" =~ ^[A-Za-z0-9:._-]+$ ]] || Stop-Script "The --token value has unexpected characters."
+
+    Write-Log INFO "Installing K3s ${K3S_VERSION} (worker), joining ${url}"
+
+    # get.k3s.io is Rancher's official install path; it is a remote script.
+    Write-Log WARN "Fetching and running the official installer from https://get.k3s.io"
+    curl -sfL https://get.k3s.io | \
+        INSTALL_K3S_VERSION="$K3S_VERSION" K3S_URL="$url" K3S_TOKEN="$join" \
+        sh -s - agent >> "$LOG_FILE" 2>&1 || \
+        Stop-Script "K3s agent install failed. Check log: $LOG_FILE"
+    Invoke-Cmd systemctl enable k3s-agent
+
+    local k3s_ver
+    k3s_ver=$(k3s --version 2>/dev/null | head -n1) || k3s_ver="N/A"
+
+    echo -e "\n${GREEN}==============================================================${NC}"
+    Write-Log SUCCESS "K3s worker joined!"
+    echo -e "${GREEN}==============================================================${NC}\n"
+    echo -e "${BLUE}K3s:${NC}          ${GREEN}${k3s_ver}${NC}"
+    echo -e "${BLUE}Joined:${NC}       ${GREEN}${url}${NC}"
+    echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
+    echo ""
+    echo -e "${BLUE}Verify:${NC}       k3s kubectl get node   # run on the control plane"
+}
+
+# ============================================================================
+# Main Entry Point
+# ============================================================================
+
+ROLE=""
+SERVER_URL=""
+JOIN_VALUE=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --control-plane)
+            ROLE="control-plane"; shift ;;
+        --worker)
+            ROLE="worker"; shift ;;
+        --url)
+            SERVER_URL=${2:-}
+            [[ -n "$SERVER_URL" ]] || Stop-Script "--url requires a value"
+            shift 2 ;;
+        --token)
+            JOIN_VALUE=${2:-}
+            [[ -n "$JOIN_VALUE" ]] || Stop-Script "--token requires a value"
+            shift 2 ;;
+        -h|--help)
+            Show-Usage; exit 0 ;;
+        *)
+            Write-Log ERROR "Unknown argument: $1"; Show-Usage; exit 1 ;;
+    esac
+done
+
+Test-Root
+[[ -d /run/systemd/system ]] || Stop-Script "K3s requires a systemd-based system."
+[[ "$(Get-PkgMgr)" != "unknown" ]] || \
+    Write-Log WARN "Unrecognised package manager; continuing (K3s bundles its own runtime)."
+
+if command -v k3s &>/dev/null; then
+    Write-Log WARN "K3s is already installed: $(k3s --version | head -n1)"
+    Write-Log INFO "Remove it with k3s-uninstall.sh or k3s-agent-uninstall.sh first."
+    exit 0
+fi
+
+case "$ROLE" in
+    control-plane) Install-ControlPlane ;;
+    worker)        Install-Worker "$SERVER_URL" "$JOIN_VALUE" ;;
+    *)             Show-Usage; Stop-Script "Pass --control-plane or --worker." ;;
+esac

From bcc11594da554347049668685958af65497ed5be Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:14:22 +0200
Subject: [PATCH 2/8] chore: add Renovate coverage for K3s version

Custom manager for K3S_VERSION (k3s-io/k3s) with a regex versioning that understands the +k3sN build suffix.
---
 renovate.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/renovate.json b/renovate.json
index 5133bd6..c01c947 100644
--- a/renovate.json
+++ b/renovate.json
@@ -271,6 +271,19 @@
         "/^kubernetes/kubernetes_installer\\.sh$/"
       ]
     },
+    {
+      "datasourceTemplate": "github-releases",
+      "matchStrings": [
+        "K3S_VERSION:-(?<currentValue>[^}]+)"
+      ],
+      "description": "K3s version in the bash installer",
+      "customType": "regex",
+      "depNameTemplate": "k3s-io/k3s",
+      "versioningTemplate": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\+k3s(?<build>\\d+)$",
+      "managerFilePatterns": [
+        "/^kubernetes/k3s_installer\\.sh$/"
+      ]
+    },
     {
       "datasourceTemplate": "github-releases",
       "matchStrings": [

From 7be9680088492f4fb0f298fa0df6ec22cae435a5 Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:14:23 +0200
Subject: [PATCH 3/8] docs: list k3s_installer in the README and site

---
 README.md                | 3 +++
 src/content/_index.md    | 3 +++
 src/content/_index.nl.md | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/README.md b/README.md
index 6f6b7f5..8ec998d 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,7 @@ pwsh ./<tool>_installer.ps1
 | `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
 | `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
 | `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optional Minikube |
+| `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
 | `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
@@ -52,6 +53,7 @@ All Linux installers target the same three package-manager families:
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
 | `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |
 | `podman_installer.sh` | ✅ | ✅ | ✅ |
@@ -59,6 +61,7 @@ All Linux installers target the same three package-manager families:
 
 ¹ No vendor repo exists for Arch; installed from the community repos.
 ² No pkgs.k8s.io repo exists for Arch; kubectl is installed as a checksum-verified binary.
+³ Installed via the official `get.k3s.io` script (bundles containerd); requires systemd.
 
 openSUSE (zypper) is not supported.
 
diff --git a/src/content/_index.md b/src/content/_index.md
index 8740e2d..2c57590 100644
--- a/src/content/_index.md
+++ b/src/content/_index.md
@@ -48,6 +48,7 @@ pwsh ./<tool>_installer.ps1
 | `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
 | `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
 | `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optional Minikube |
+| `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
 | `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
@@ -72,6 +73,7 @@ All Linux installers target the same three package-manager families:
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
 | `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |
 | `podman_installer.sh` | ✅ | ✅ | ✅ |
@@ -79,6 +81,7 @@ All Linux installers target the same three package-manager families:
 
 ¹ No vendor repo exists for Arch; installed from the community repos.
 ² No pkgs.k8s.io repo exists for Arch; kubectl is installed as a checksum-verified binary.
+³ Installed via the official `get.k3s.io` script (bundles containerd); requires systemd.
 
 openSUSE (zypper) is not supported.
 
diff --git a/src/content/_index.nl.md b/src/content/_index.nl.md
index b3fc2a0..7d4883b 100644
--- a/src/content/_index.nl.md
+++ b/src/content/_index.nl.md
@@ -48,6 +48,7 @@ pwsh ./<tool>_installer.ps1
 | `ansible/` | `ansible_installer.sh` | Linux | Installeert Ansible via pip in een venv |
 | `docker/` | `docker_installer.sh` | Linux | Officiële Docker-repositories |
 | `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optioneel Minikube |
+| `kubernetes/` | `k3s_installer.sh` | Linux | K3s-clusternode: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, alleen Ed25519, post-quantum KEX (ML-KEM) |
 | `podman/` | `podman_installer.sh` | Linux | Distributie-repositories |
@@ -72,6 +73,7 @@ Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
 | `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |
 | `podman_installer.sh` | ✅ | ✅ | ✅ |
@@ -79,6 +81,7 @@ Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
 
 ¹ Geen vendor-repo voor Arch; installatie via de community-repositories.
 ² Geen pkgs.k8s.io-repo voor Arch; kubectl wordt geïnstalleerd als checksum-geverifieerde binary.
+³ Geïnstalleerd via het officiële `get.k3s.io`-script (bevat containerd); vereist systemd.
 
 openSUSE (zypper) wordt niet ondersteund.
 

From 3138ec3476c11780c3f2a2e358a7797163a4142b Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:15:00 +0200
Subject: [PATCH 4/8] refactor: rename kubernetes_installer.sh to
 k8s_installer.sh

Pairs with k3s_installer.sh. Updates the Renovate managers, README and Hugo site references.
---
 README.md                                                | 4 ++--
 kubernetes/{kubernetes_installer.sh => k8s_installer.sh} | 2 +-
 renovate.json                                            | 4 ++--
 src/content/_index.md                                    | 4 ++--
 src/content/_index.nl.md                                 | 4 ++--
 5 files changed, 9 insertions(+), 9 deletions(-)
 rename kubernetes/{kubernetes_installer.sh => k8s_installer.sh} (99%)

diff --git a/README.md b/README.md
index 8ec998d..a8437c3 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ pwsh ./<tool>_installer.ps1
 |-----------|---------|----------|-------|
 | `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
 | `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
-| `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optional Minikube |
+| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optional Minikube |
 | `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
@@ -52,7 +52,7 @@ All Linux installers target the same three package-manager families:
 |--------|:---:|:---:|:---:|
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
 | `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |
diff --git a/kubernetes/kubernetes_installer.sh b/kubernetes/k8s_installer.sh
similarity index 99%
rename from kubernetes/kubernetes_installer.sh
rename to kubernetes/k8s_installer.sh
index 311bb01..ef52e04 100644
--- a/kubernetes/kubernetes_installer.sh
+++ b/kubernetes/k8s_installer.sh
@@ -94,7 +94,7 @@ Invoke-Cmd() {
 }
 
 # === Settings ===
-LOG_FILE="/tmp/kubernetes_install_$(date +%Y%m%d_%H%M%S).log"
+LOG_FILE="/tmp/k8s_install_$(date +%Y%m%d_%H%M%S).log"
 
 K8S_VERSION="${K8S_VERSION:-v1.37.0}"
 MINIKUBE_VERSION="${MINIKUBE_VERSION:-v1.39.0}"
diff --git a/renovate.json b/renovate.json
index c01c947..47e5dc6 100644
--- a/renovate.json
+++ b/renovate.json
@@ -256,7 +256,7 @@
       "customType": "regex",
       "depNameTemplate": "kubernetes/kubernetes",
       "managerFilePatterns": [
-        "/^kubernetes/kubernetes_installer\\.sh$/"
+        "/^kubernetes/k8s_installer\\.sh$/"
       ]
     },
     {
@@ -268,7 +268,7 @@
       "customType": "regex",
       "depNameTemplate": "kubernetes/minikube",
       "managerFilePatterns": [
-        "/^kubernetes/kubernetes_installer\\.sh$/"
+        "/^kubernetes/k8s_installer\\.sh$/"
       ]
     },
     {
diff --git a/src/content/_index.md b/src/content/_index.md
index 2c57590..a5d0c9d 100644
--- a/src/content/_index.md
+++ b/src/content/_index.md
@@ -47,7 +47,7 @@ pwsh ./<tool>_installer.ps1
 |-----------|---------|----------|-------|
 | `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
 | `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
-| `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optional Minikube |
+| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optional Minikube |
 | `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
@@ -72,7 +72,7 @@ All Linux installers target the same three package-manager families:
 |--------|:---:|:---:|:---:|
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
 | `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |
diff --git a/src/content/_index.nl.md b/src/content/_index.nl.md
index 7d4883b..49d582c 100644
--- a/src/content/_index.nl.md
+++ b/src/content/_index.nl.md
@@ -47,7 +47,7 @@ pwsh ./<tool>_installer.ps1
 |-----------|---------|----------|-------|
 | `ansible/` | `ansible_installer.sh` | Linux | Installeert Ansible via pip in een venv |
 | `docker/` | `docker_installer.sh` | Linux | Officiële Docker-repositories |
-| `kubernetes/` | `kubernetes_installer.sh` | Linux | kubectl + optioneel Minikube |
+| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optioneel Minikube |
 | `kubernetes/` | `k3s_installer.sh` | Linux | K3s-clusternode: `--control-plane` / `--worker` |
 | `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
 | `openssh/` | `openssh_installer.sh` | Linux | Hardened config, alleen Ed25519, post-quantum KEX (ML-KEM) |
@@ -72,7 +72,7 @@ Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
 |--------|:---:|:---:|:---:|
 | `ansible_installer.sh` | ✅ | ✅ | ✅ |
 | `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `kubernetes_installer.sh` | ✅ | ✅ | ✅ ² |
+| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
 | `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
 | `nginx_installer.sh` | ✅ | ✅ | ✅ |
 | `openssh_installer.sh` | ✅ | ✅ | ✅ |

From b05f07604cb19d8a1af65dfea1ea74269bd6ba37 Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:17:35 +0200
Subject: [PATCH 5/8] Update README.md

---
 README.md | 54 ------------------------------------------------------
 1 file changed, 54 deletions(-)

diff --git a/README.md b/README.md
index a8437c3..8457807 100644
--- a/README.md
+++ b/README.md
@@ -21,60 +21,6 @@ PowerShell:
 pwsh ./<tool>_installer.ps1
 ```
 
-## Scripts
-
-| Directory | File(s) | Platform | Notes |
-|-----------|---------|----------|-------|
-| `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
-| `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
-| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optional Minikube |
-| `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
-| `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
-| `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
-| `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
-| `system/` | `planned_shutdown.sh` | Linux | Schedule/cancel/check a planned shutdown or reboot |
-| `terraform/` | `terraform_installer.sh` | Linux | HashiCorp repositories |
-| `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Tests TLS versions, HTTP versions, QUIC, HSTS, compression |
-| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at a specific version |
-| `windows/` | `Enable-WinRM.ps1` | Windows | Configures WinRM for remote management |
-| `windows/` | `Get-InstalledSoftware.ps1` | Windows | Lists installed software from registry |
-| `windows/` | `Optimize-WindowsVM.ps1` | Windows | Disables unnecessary services for VMs |
-| `windows/` | `Install-VagrantVMware.ps1` | Windows | Installs Vagrant + VMware Workstation |
-| `windows/` | `Install-DellCommandUpdate.ps1` | Windows | Installs Dell Command Update via winget |
-| `windows/` | `Install-HPImageAssistant.ps1` | Windows | Installs HP Image Assistant via winget |
-| `windows/` | `Set-PlannedShutdown.ps1` | Windows | Schedule/cancel/check a planned shutdown or reboot |
-
-## Linux distro support
-
-All Linux installers target the same three package-manager families:
-
-| Script | apt (Debian/Ubuntu) | dnf (Fedora/RHEL) | pacman (Arch) |
-|--------|:---:|:---:|:---:|
-| `ansible_installer.sh` | ✅ | ✅ | ✅ |
-| `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
-| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
-| `nginx_installer.sh` | ✅ | ✅ | ✅ |
-| `openssh_installer.sh` | ✅ | ✅ | ✅ |
-| `podman_installer.sh` | ✅ | ✅ | ✅ |
-| `terraform_installer.sh` | ✅ | ✅ | ✅ ¹ |
-
-¹ No vendor repo exists for Arch; installed from the community repos.
-² No pkgs.k8s.io repo exists for Arch; kubectl is installed as a checksum-verified binary.
-³ Installed via the official `get.k3s.io` script (bundles containerd); requires systemd.
-
-openSUSE (zypper) is not supported.
-
-## Conventions
-
-- All bash scripts are standalone single-file downloads. They share the same
-  set of helper functions (`Write-Log`, `Stop-Script`, `Get-PkgMgr`, ...),
-  copied into each script — keep them aligned when changing one.
-- Function names follow the PowerShell Verb-Noun convention everywhere — also
-  in bash (`Write-Log`, `Get-PkgMgr`, `Install-Podman`). Hyphenated function
-  names are bash-only syntax, so scripts must keep the bash shebang.
-- Every script starts with `#!/usr/bin/env bash` and `set -euo pipefail`.
-
 ## Automation
 
 Dependency checks run weekly via GitHub Actions. When updates are detected, a PR is created automatically.

From 31e512eabd9effd1546a7f1d27ae9a296c878f39 Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:23:12 +0200
Subject: [PATCH 6/8] docs: sync Automation and Notes sections into the site

README dropped the duplicated Scripts/distro tables (b05f0760); mirror its Automation + Notes prose into _index.md and _index.nl.md so the two stay aligned.
---
 src/content/_index.md    | 14 +++++++++++---
 src/content/_index.nl.md | 14 +++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/content/_index.md b/src/content/_index.md
index a5d0c9d..b48a8fe 100644
--- a/src/content/_index.md
+++ b/src/content/_index.md
@@ -85,6 +85,14 @@ All Linux installers target the same three package-manager families:
 
 openSUSE (zypper) is not supported.
 
-{{< callout type="info" >}}
-Dependency checks run weekly; script validation (ShellCheck for Bash, PSScriptAnalyzer for PowerShell) runs on every push. See the [GitHub repository](https://github.com/Thectic-NL/Scripts) for the full source and conventions.
-{{< /callout >}}
+## Automation
+
+Dependency checks run weekly via GitHub Actions. When updates are detected, a PR is created automatically.
+
+Script validation runs on every push: ShellCheck for Bash, PSScriptAnalyzer for PowerShell.
+
+## Notes
+
+- `testssl.sh` is included as a Git submodule. Run `git submodule update --init` if it's missing after cloning.
+- NGINX updates require manual checksum verification: `.github/scripts/update-nginx-checksums.sh`
+- Some scripts were partially written with GitHub Copilot assistance.
diff --git a/src/content/_index.nl.md b/src/content/_index.nl.md
index 49d582c..7795641 100644
--- a/src/content/_index.nl.md
+++ b/src/content/_index.nl.md
@@ -85,6 +85,14 @@ Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
 
 openSUSE (zypper) wordt niet ondersteund.
 
-{{< callout type="info" >}}
-Dependency-checks draaien wekelijks; scriptvalidatie (ShellCheck voor Bash, PSScriptAnalyzer voor PowerShell) draait bij elke push. Zie de [GitHub-repository](https://github.com/Thectic-NL/Scripts) voor de volledige broncode en conventies.
-{{< /callout >}}
+## Automatisering
+
+Dependency-checks draaien wekelijks via GitHub Actions. Bij gevonden updates wordt automatisch een PR aangemaakt.
+
+Scriptvalidatie draait bij elke push: ShellCheck voor Bash, PSScriptAnalyzer voor PowerShell.
+
+## Opmerkingen
+
+- `testssl.sh` zit als Git-submodule in de repo. Draai `git submodule update --init` als die na het klonen ontbreekt.
+- NGINX-updates vereisen handmatige checksum-verificatie: `.github/scripts/update-nginx-checksums.sh`
+- Sommige scripts zijn deels geschreven met hulp van GitHub Copilot.

From cc76db9fe56f1e901dfac0a125a37865f2331c6b Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:26:14 +0200
Subject: [PATCH 7/8] docs: use the correct clone directory name in the README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8457807..dd0807f 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Also browsable as a site: [scripts.thectic.nl](https://scripts.thectic.nl) (`src
 
 ```bash
 git clone --recurse-submodules https://github.com/Thectic-NL/Scripts.git
-cd scripts
+cd Scripts
 ```
 
 Bash:

From 8ff8deae1dda8e1055ed9a1f32516afa2f2c590a Mon Sep 17 00:00:00 2001
From: "Sten T." <102481635+Stensel8@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:26:14 +0200
Subject: [PATCH 8/8] docs: drop the script tables from the site

The README no longer lists them (b05f0760); keep the site in step and let the repo tree be the single catalogue.
---
 CONTRIBUTING.md          |  3 +--
 src/content/_index.md    | 44 ----------------------------------------
 src/content/_index.nl.md | 44 ----------------------------------------
 3 files changed, 1 insertion(+), 90 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 77212f8..f5c702d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -187,8 +187,7 @@ them in sync. Test locally with `cd src && hugo server`.
 4. Support apt, dnf and pacman
 5. Include a version configuration section at the top (if versions are pinned)
 6. Test thoroughly on clean systems
-7. Update README.md (script table + distro matrix)
-8. Add a Renovate custom manager for any pinned versions
+7. Add a Renovate custom manager for any pinned versions
 
 ## Security Considerations
 
diff --git a/src/content/_index.md b/src/content/_index.md
index b48a8fe..3504c3e 100644
--- a/src/content/_index.md
+++ b/src/content/_index.md
@@ -41,50 +41,6 @@ PowerShell:
 pwsh ./<tool>_installer.ps1
 ```
 
-## Scripts
-
-| Directory | File(s) | Platform | Notes |
-|-----------|---------|----------|-------|
-| `ansible/` | `ansible_installer.sh` | Linux | Installs Ansible via pip in a venv |
-| `docker/` | `docker_installer.sh` | Linux | Official Docker repositories |
-| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optional Minikube |
-| `kubernetes/` | `k3s_installer.sh` | Linux | K3s cluster node: `--control-plane` / `--worker` |
-| `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
-| `openssh/` | `openssh_installer.sh` | Linux | Hardened config, Ed25519-only, post-quantum KEX (ML-KEM) |
-| `podman/` | `podman_installer.sh` | Linux | Distribution repositories |
-| `system/` | `planned_shutdown.sh` | Linux | Schedule/cancel/check a planned shutdown or reboot |
-| `terraform/` | `terraform_installer.sh` | Linux | HashiCorp repositories |
-| `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Tests TLS versions, HTTP versions, QUIC, HSTS, compression |
-| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Comprehensive TLS/SSL scanner by Dirk Wetter — pinned at a specific version |
-| `windows/` | `Enable-WinRM.ps1` | Windows | Configures WinRM for remote management |
-| `windows/` | `Get-InstalledSoftware.ps1` | Windows | Lists installed software from registry |
-| `windows/` | `Optimize-WindowsVM.ps1` | Windows | Disables unnecessary services for VMs |
-| `windows/` | `Install-VagrantVMware.ps1` | Windows | Installs Vagrant + VMware Workstation |
-| `windows/` | `Install-DellCommandUpdate.ps1` | Windows | Installs Dell Command Update via winget |
-| `windows/` | `Install-HPImageAssistant.ps1` | Windows | Installs HP Image Assistant via winget |
-| `windows/` | `Set-PlannedShutdown.ps1` | Windows | Schedule/cancel/check a planned shutdown or reboot |
-
-## Linux distro support
-
-All Linux installers target the same three package-manager families:
-
-| Script | apt (Debian/Ubuntu) | dnf (Fedora/RHEL) | pacman (Arch) |
-|--------|:---:|:---:|:---:|
-| `ansible_installer.sh` | ✅ | ✅ | ✅ |
-| `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
-| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
-| `nginx_installer.sh` | ✅ | ✅ | ✅ |
-| `openssh_installer.sh` | ✅ | ✅ | ✅ |
-| `podman_installer.sh` | ✅ | ✅ | ✅ |
-| `terraform_installer.sh` | ✅ | ✅ | ✅ ¹ |
-
-¹ No vendor repo exists for Arch; installed from the community repos.
-² No pkgs.k8s.io repo exists for Arch; kubectl is installed as a checksum-verified binary.
-³ Installed via the official `get.k3s.io` script (bundles containerd); requires systemd.
-
-openSUSE (zypper) is not supported.
-
 ## Automation
 
 Dependency checks run weekly via GitHub Actions. When updates are detected, a PR is created automatically.
diff --git a/src/content/_index.nl.md b/src/content/_index.nl.md
index 7795641..e3b0df7 100644
--- a/src/content/_index.nl.md
+++ b/src/content/_index.nl.md
@@ -41,50 +41,6 @@ PowerShell:
 pwsh ./<tool>_installer.ps1
 ```
 
-## Scripts
-
-| Map | Bestand(en) | Platform | Toelichting |
-|-----------|---------|----------|-------|
-| `ansible/` | `ansible_installer.sh` | Linux | Installeert Ansible via pip in een venv |
-| `docker/` | `docker_installer.sh` | Linux | Officiële Docker-repositories |
-| `kubernetes/` | `k8s_installer.sh` | Linux | kubectl + optioneel Minikube |
-| `kubernetes/` | `k3s_installer.sh` | Linux | K3s-clusternode: `--control-plane` / `--worker` |
-| `nginx/` | `nginx_installer.sh` | Linux | Custom build: OpenSSL 3.x, HTTP/2, HTTP/3, zstd, headers-more, ACME |
-| `openssh/` | `openssh_installer.sh` | Linux | Hardened config, alleen Ed25519, post-quantum KEX (ML-KEM) |
-| `podman/` | `podman_installer.sh` | Linux | Distributie-repositories |
-| `system/` | `planned_shutdown.sh` | Linux | Geplande afsluiting/herstart plannen/annuleren/controleren |
-| `terraform/` | `terraform_installer.sh` | Linux | HashiCorp-repositories |
-| `TLS-tools/` | `TLS-checker.ps1` | Cross-platform | Test TLS-versies, HTTP-versies, QUIC, HSTS, compressie |
-| `TLS-tools/` | `testssl.sh` (submodule) | Linux | Uitgebreide TLS/SSL-scanner van Dirk Wetter — vastgezet op een specifieke versie |
-| `windows/` | `Enable-WinRM.ps1` | Windows | Configureert WinRM voor remote beheer |
-| `windows/` | `Get-InstalledSoftware.ps1` | Windows | Toont geïnstalleerde software uit het register |
-| `windows/` | `Optimize-WindowsVM.ps1` | Windows | Schakelt onnodige services uit voor VM's |
-| `windows/` | `Install-VagrantVMware.ps1` | Windows | Installeert Vagrant + VMware Workstation |
-| `windows/` | `Install-DellCommandUpdate.ps1` | Windows | Installeert Dell Command Update via winget |
-| `windows/` | `Install-HPImageAssistant.ps1` | Windows | Installeert HP Image Assistant via winget |
-| `windows/` | `Set-PlannedShutdown.ps1` | Windows | Geplande afsluiting/herstart plannen/annuleren/controleren |
-
-## Ondersteunde Linux-distro's
-
-Alle Linux-installers richten zich op dezelfde drie pakketbeheerfamilies:
-
-| Script | apt (Debian/Ubuntu) | dnf (Fedora/RHEL) | pacman (Arch) |
-|--------|:---:|:---:|:---:|
-| `ansible_installer.sh` | ✅ | ✅ | ✅ |
-| `docker_installer.sh` | ✅ | ✅ | ✅ ¹ |
-| `k8s_installer.sh` | ✅ | ✅ | ✅ ² |
-| `k3s_installer.sh` | ✅ | ✅ | ✅ ³ |
-| `nginx_installer.sh` | ✅ | ✅ | ✅ |
-| `openssh_installer.sh` | ✅ | ✅ | ✅ |
-| `podman_installer.sh` | ✅ | ✅ | ✅ |
-| `terraform_installer.sh` | ✅ | ✅ | ✅ ¹ |
-
-¹ Geen vendor-repo voor Arch; installatie via de community-repositories.
-² Geen pkgs.k8s.io-repo voor Arch; kubectl wordt geïnstalleerd als checksum-geverifieerde binary.
-³ Geïnstalleerd via het officiële `get.k3s.io`-script (bevat containerd); vereist systemd.
-
-openSUSE (zypper) wordt niet ondersteund.
-
 ## Automatisering
 
 Dependency-checks draaien wekelijks via GitHub Actions. Bij gevonden updates wordt automatisch een PR aangemaakt.