# Scripts — DevOps Toolbox

A personal collection of Python scripts for deploying, monitoring, and
maintaining Linux systems. Every script is **idempotent** (safe to run
repeatedly), requires **no external dependencies** (stdlib only), and
ships with `--dry-run` where applicable.

---

## Stack

| Concern | Choice |
|---------|--------|
| Language | Python 3.12+ |
| Package manager | None — stdlib only |
| Target platforms | Fedora Server, CentOS Stream, openEuler; FreeBSD 13+ (`network-diag.py` only) |
| Lint / format | Ruff (line length 100 — see `ruff.toml`) |
| Licence | MIT |

---

## Scripts

### Diagnostics

| Script | Version | Purpose |
|--------|---------|---------|
| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |

### Deployment

| Script | Version | Purpose |
|--------|---------|---------|
| `server-setup.py` | 1.3.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
| `workstation-setup.py` | 4.1.0 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
| `vllm-deploy.py` | 1.2.0 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
| `zabbix-deploy.py` | 1.1.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |

### Maintenance

| Script | Version | Purpose |
|--------|---------|---------|
| `system-optimise.py` | 1.4.0 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |

---

## Quick Start

```bash
git clone https://codeberg.org/petrbalvin/scripts.git && cd scripts
```

All scripts are standalone — run them directly:

```bash
# Check your network (Linux or FreeBSD)
python3 network-diag.py

# Full system health report (Linux)
python3 system-diag.py

# Set up a new server
sudo python3 server-setup.py --dry-run

# Set up a development workstation
sudo python3 workstation-setup.py --dry-run

# Deploy vLLM (interactive model selection)
sudo python3 vllm-deploy.py

# Deploy the Zabbix monitoring stack
sudo python3 zabbix-deploy.py --dry-run

# Clean up old kernels and temp files
sudo python3 system-optimise.py --dry-run
```

Every script supports `--help` and `--version` without root privileges.
Use `--dry-run` to preview changes before applying them, and `--skip-*`
flags to skip individual sections.

---

## Notes

### Security

- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
  Supply your own with `--api-key`, or let the script generate one — it is
  stored in a root-only `EnvironmentFile` and printed once in the summary.
- **`zabbix-deploy.py`** accepts secrets via the environment variables
  `ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
  `--db-password` / `--zabbix-password` flags (visible in shell history).
  The database password is never passed on any command line.
- **`workstation-setup.py`** verifies what it downloads: Bun is installed
  from a pinned release with SHA-256 verification, uv comes from the
  Fedora repositories, and Brave's GPG key is checked against known
  fingerprints before import. Zed's installer is pinned but published
  without checksums — the script says so loudly.
- **`system-diag.py`** only contacts a third-party service
  (`icanhazip.com`) when you pass `--external-ip`.

### Platform support

- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
  it falls back to the legacy `ping6` binary where available.
- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
  so clearly on other platforms.
- The deployment and maintenance scripts target Fedora, CentOS Stream and
  openEuler (dnf4 and dnf5 are both handled).

---

## Development

No build step, no dependencies. Lint and format with Ruff
(configuration in `ruff.toml`, line length 100):

```bash
ruff check .
ruff format --check .
```

---

## Licence

MIT — see [`LICENSE`](LICENSE).  
Copyright © 2026 [Petr Balvín](https://petrbalvin.org)