# Scripts

This directory is the preferred home for self-contained operational scripts.

## Current Scripts

- `ubuntu-vm-security-update.sh`
  - Supported.
  - Purpose: update and harden Ubuntu VMs with unattended upgrades, UFW, and fail2ban.
  - Risk level: high, because it modifies packages, firewall rules, and reboot behavior.

## Conventions

- New standalone operational scripts should go here instead of the repo root.
- Each script should document:
  - prerequisites
  - required environment variables
  - destructive or privileged behavior
  - example usage
- Scripts that change host state should support `--help` and a non-destructive preview mode when practical.

## Legacy Note

The repo root still contains older shell utilities. Those are not all deprecated, but new work should prefer `scripts/` for clearer ownership and discoverability.