131 lines
4.1 KiB
Markdown
131 lines
4.1 KiB
Markdown
|
# Scripts — DevOps Toolbox
|
|||
|
|
|
|||
|
|
A personal collection of Python scripts for deploying, monitoring, and
|
|||
|
|
maintaining Linux systems. Every script is **idempotent** (safe to run
|
|||
|
|
repeatedly), requires **no external dependencies** (stdlib only), and
|
|||
|
|
ships with `--dry-run` where applicable.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Stack
|
|||
|
|
|
|||
|
|
| Concern | Choice |
|
|||
|
|
|---------|--------|
|
|||
|
|
| Language | Python 3.12+ |
|
|||
|
|
| Package manager | None — stdlib only |
|
|||
|
|
| Target platforms | Fedora Server, openEuler; FreeBSD 13+ (`network-diag.py` only) |
|
|||
|
|
| Lint / format | Ruff (line length 100 — see `ruff.toml`) |
|
|||
|
|
| Licence | MIT |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Scripts
|
|||
|
|
|
|||
|
|
### Diagnostics
|
|||
|
|
|
|||
|
|
| Script | Version | Purpose |
|
|||
|
|
|--------|---------|---------|
|
|||
|
|
| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
|
|||
|
|
| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |
|
|||
|
|
|
|||
|
|
### Deployment
|
|||
|
|
|
|||
|
|
| Script | Version | Purpose |
|
|||
|
|
|--------|---------|---------|
|
|||
|
|
| `server-setup.py` | 1.2.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
|
|||
|
|
| `workstation-setup.py` | 4.1.0 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
|
|||
|
|
| `vllm-deploy.py` | 1.1.0 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
|
|||
|
|
| `zabbix-deploy.py` | 1.0.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |
|
|||
|
|
|
|||
|
|
### Maintenance
|
|||
|
|
|
|||
|
|
| Script | Version | Purpose |
|
|||
|
|
|--------|---------|---------|
|
|||
|
|
| `system-optimise.py` | 1.3.1 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Quick Start
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
git clone https://codeberg.org/petrbalvin/scripts.git && cd scripts
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
All scripts are standalone — run them directly:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# Check your network (Linux or FreeBSD)
|
|||
|
|
python3 network-diag.py
|
|||
|
|
|
|||
|
|
# Full system health report (Linux)
|
|||
|
|
python3 system-diag.py
|
|||
|
|
|
|||
|
|
# Set up a new server
|
|||
|
|
sudo python3 server-setup.py --dry-run
|
|||
|
|
|
|||
|
|
# Set up a development workstation
|
|||
|
|
sudo python3 workstation-setup.py --dry-run
|
|||
|
|
|
|||
|
|
# Deploy vLLM (interactive model selection)
|
|||
|
|
sudo python3 vllm-deploy.py
|
|||
|
|
|
|||
|
|
# Deploy the Zabbix monitoring stack
|
|||
|
|
sudo python3 zabbix-deploy.py --dry-run
|
|||
|
|
|
|||
|
|
# Clean up old kernels and temp files
|
|||
|
|
sudo python3 system-optimise.py --dry-run
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Every script supports `--help` and `--version` without root privileges.
|
|||
|
|
Use `--dry-run` to preview changes before applying them, and `--skip-*`
|
|||
|
|
flags to skip individual sections.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Notes
|
|||
|
|
|
|||
|
|
### Security
|
|||
|
|
|
|||
|
|
- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
|
|||
|
|
Supply your own with `--api-key`, or let the script generate one — it is
|
|||
|
|
stored in a root-only `EnvironmentFile` and printed once in the summary.
|
|||
|
|
- **`zabbix-deploy.py`** accepts secrets via the environment variables
|
|||
|
|
`ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
|
|||
|
|
`--db-password` / `--zabbix-password` flags (visible in shell history).
|
|||
|
|
The database password is never passed on any command line.
|
|||
|
|
- **`workstation-setup.py`** verifies what it downloads: Bun is installed
|
|||
|
|
from a pinned release with SHA-256 verification, uv comes from the
|
|||
|
|
Fedora repositories, and Brave's GPG key is checked against known
|
|||
|
|
fingerprints before import. Zed's installer is pinned but published
|
|||
|
|
without checksums — the script says so loudly.
|
|||
|
|
- **`system-diag.py`** only contacts a third-party service
|
|||
|
|
(`icanhazip.com`) when you pass `--external-ip`.
|
|||
|
|
|
|||
|
|
### Platform support
|
|||
|
|
|
|||
|
|
- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
|
|||
|
|
it falls back to the legacy `ping6` binary where available.
|
|||
|
|
- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
|
|||
|
|
so clearly on other platforms.
|
|||
|
|
- The deployment and maintenance scripts target Fedora and openEuler
|
|||
|
|
(dnf4 and dnf5 are both handled).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Development
|
|||
|
|
|
|||
|
|
No build step, no dependencies. Lint and format with Ruff
|
|||
|
|
(configuration in `ruff.toml`, line length 100):
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
ruff check .
|
|||
|
|
ruff format --check .
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Licence
|
|||
|
|
|
|||
|
|
MIT — see [`LICENSE`](LICENSE).
|
|||
|
|
Copyright © 2026 [Petr Balvín](https://petrbalvin.org)
|