chore: initial commit of sysadmin scripts collection

.gitignore

@@ -0,0 +1,11 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+
+# Ruff
+.ruff_cache/
+
+# Pytest
+.pytest_cache/

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,130 @@
+# Scripts — DevOps Toolbox
+
+A personal collection of Python scripts for deploying, monitoring, and
+maintaining Linux systems. Every script is **idempotent** (safe to run
+repeatedly), requires **no external dependencies** (stdlib only), and
+ships with `--dry-run` where applicable.
+
+---
+
+## Stack
+
+| Concern | Choice |
+|---------|--------|
+| Language | Python 3.12+ |
+| Package manager | None — stdlib only |
+| Target platforms | Fedora Server, openEuler; FreeBSD 13+ (`network-diag.py` only) |
+| Lint / format | Ruff (line length 100 — see `ruff.toml`) |
+| Licence | MIT |
+
+---
+
+## Scripts
+
+### Diagnostics
+
+| Script | Version | Purpose |
+|--------|---------|---------|
+| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
+| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |
+
+### Deployment
+
+| Script | Version | Purpose |
+|--------|---------|---------|
+| `server-setup.py` | 1.2.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
+| `workstation-setup.py` | 4.1.0 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
+| `vllm-deploy.py` | 1.1.0 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
+| `zabbix-deploy.py` | 1.0.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |
+
+### Maintenance
+
+| Script | Version | Purpose |
+|--------|---------|---------|
+| `system-optimise.py` | 1.3.1 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |
+
+---
+
+## Quick Start
+
+```bash
+git clone https://codeberg.org/petrbalvin/scripts.git && cd scripts
+```
+
+All scripts are standalone — run them directly:
+
+```bash
+# Check your network (Linux or FreeBSD)
+python3 network-diag.py
+
+# Full system health report (Linux)
+python3 system-diag.py
+
+# Set up a new server
+sudo python3 server-setup.py --dry-run
+
+# Set up a development workstation
+sudo python3 workstation-setup.py --dry-run
+
+# Deploy vLLM (interactive model selection)
+sudo python3 vllm-deploy.py
+
+# Deploy the Zabbix monitoring stack
+sudo python3 zabbix-deploy.py --dry-run
+
+# Clean up old kernels and temp files
+sudo python3 system-optimise.py --dry-run
+```
+
+Every script supports `--help` and `--version` without root privileges.
+Use `--dry-run` to preview changes before applying them, and `--skip-*`
+flags to skip individual sections.
+
+---
+
+## Notes
+
+### Security
+
+- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
+  Supply your own with `--api-key`, or let the script generate one — it is
+  stored in a root-only `EnvironmentFile` and printed once in the summary.
+- **`zabbix-deploy.py`** accepts secrets via the environment variables
+  `ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
+  `--db-password` / `--zabbix-password` flags (visible in shell history).
+  The database password is never passed on any command line.
+- **`workstation-setup.py`** verifies what it downloads: Bun is installed
+  from a pinned release with SHA-256 verification, uv comes from the
+  Fedora repositories, and Brave's GPG key is checked against known
+  fingerprints before import. Zed's installer is pinned but published
+  without checksums — the script says so loudly.
+- **`system-diag.py`** only contacts a third-party service
+  (`icanhazip.com`) when you pass `--external-ip`.
+
+### Platform support
+
+- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
+  it falls back to the legacy `ping6` binary where available.
+- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
+  so clearly on other platforms.
+- The deployment and maintenance scripts target Fedora and openEuler
+  (dnf4 and dnf5 are both handled).
+
+---
+
+## Development
+
+No build step, no dependencies. Lint and format with Ruff
+(configuration in `ruff.toml`, line length 100):
+
+```bash
+ruff check .
+ruff format --check .
+```
+
+---
+
+## Licence
+
+MIT — see [`LICENSE`](LICENSE).  
+Copyright © 2026 [Petr Balvín](https://petrbalvin.org)

ruff.toml

@@ -0,0 +1,9 @@
+# Ruff configuration for the sysadmin scripts collection.
+# Docs: https://docs.astral.sh/ruff/configuration/
+# Default rule selection is kept intentionally — stricter linting is a separate decision.
+
+# Owner style: 100-character lines (applies to both the linter and the formatter).
+line-length = 100
+
+# Scripts target Python 3.12+ (stdlib only).
+target-version = "py312"