scripts/README.md

# Scripts — DevOps Toolbox

A personal collection of standalone Python scripts for Linux server and
desktop management — stdlib only, MIT-licensed.

---

## Scripts

### Diagnostics

| Script | Version | Purpose |
|--------|---------|---------|
| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |

### Deployment

| Script | Version | Purpose |
|--------|---------|---------|
| `server-setup.py` | 1.3.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
| `workstation-setup.py` | 4.1.0 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
| `vllm-deploy.py` | 1.2.1 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
| `zabbix-deploy.py` | 1.1.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |

### Maintenance

| Script | Version | Purpose |
|--------|---------|---------|
| `system-optimise.py` | 1.4.0 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |

---

## Quick Start

Run any script directly without cloning — just `curl` and go:

```bash
# Network diagnostics (no root needed)
curl -sSf https://petrbalvin.org/scripts/network-diag.py | python3

# System health (no root needed)
curl -sSf https://petrbalvin.org/scripts/system-diag.py | python3

# Server setup
curl -sSf https://petrbalvin.org/scripts/server-setup.py | sudo python3

# Workstation setup
curl -sSf https://petrbalvin.org/scripts/workstation-setup.py | sudo python3

# vLLM deployment
curl -sSf https://petrbalvin.org/scripts/vllm-deploy.py | sudo python3

# Zabbix monitoring
curl -sSf https://petrbalvin.org/scripts/zabbix-deploy.py | sudo python3

# System cleanup
curl -sSf https://petrbalvin.org/scripts/system-optimise.py | sudo python3
```

#### Integrity verification (optional)

A single [`SHA256SUMS`](https://petrbalvin.org/scripts/SHA256SUMS) file covers
every script. Verify before running:

```bash
curl -sSfO https://petrbalvin.org/scripts/server-setup.py
curl -sSfO https://petrbalvin.org/scripts/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
sudo python3 server-setup.py --dry-run
```

---

## Notes

### Security

- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
  Supply your own with `--api-key`, or let the script generate one — it is
  stored in a root-only `EnvironmentFile` and printed once in the summary.
- **`zabbix-deploy.py`** accepts secrets via the environment variables
  `ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
  `--db-password` / `--zabbix-password` flags (visible in shell history).
  The database password is never passed on any command line.
- **`workstation-setup.py`** verifies what it downloads: Bun is installed
  from a pinned release with SHA-256 verification, uv comes from the
  Fedora repositories, and Brave's GPG key is checked against known
  fingerprints before import. Zed's installer is pinned but published
  without checksums — the script says so loudly.
- **`system-diag.py`** only contacts a third-party service
  (`icanhazip.com`) when you pass `--external-ip`.

### Platform support

- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
  it falls back to the legacy `ping6` binary where available.
- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
  so clearly on other platforms.
- The deployment and maintenance scripts target Fedora, CentOS Stream and
  openEuler (dnf4 and dnf5 are both handled).

---

## Licence

MIT — see [`LICENSE`](LICENSE).  
Copyright © 2026 [Petr Balvín](https://petrbalvin.org)