scripts/README.md

Scripts — DevOps Toolbox

A personal collection of standalone Python scripts for Linux server and desktop management — stdlib only, MIT-licensed.

---

Scripts

Diagnostics

Script	Version	Purpose
network-diag.py	2.1.1	Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD
system-diag.py	1.0.0	Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only

Deployment

Script	Version	Purpose
server-setup.py	1.3.0	Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates
workstation-setup.py	4.1.1	Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git
vllm-deploy.py	1.2.1	vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs
zabbix-deploy.py	1.1.0	Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux

Maintenance

Script	Version	Purpose
system-optimise.py	1.4.0	System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems

---

Quick Start

Run any script directly without cloning — just curl and go:

# Network diagnostics (no root needed)
curl -sSf https://petrbalvin.org/scripts/network-diag.py | python3

# System health (no root needed)
curl -sSf https://petrbalvin.org/scripts/system-diag.py | python3

# Server setup
curl -sSf https://petrbalvin.org/scripts/server-setup.py | sudo python3

# Workstation setup
curl -sSf https://petrbalvin.org/scripts/workstation-setup.py | sudo python3

# vLLM deployment
curl -sSf https://petrbalvin.org/scripts/vllm-deploy.py | sudo python3

# Zabbix monitoring
curl -sSf https://petrbalvin.org/scripts/zabbix-deploy.py | sudo python3

# System cleanup
curl -sSf https://petrbalvin.org/scripts/system-optimise.py | sudo python3

Integrity verification (optional)

A single SHA256SUMS file covers every script. Verify before running:

curl -sSfO https://petrbalvin.org/scripts/server-setup.py
curl -sSfO https://petrbalvin.org/scripts/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
sudo python3 server-setup.py --dry-run

---

Notes

Security

• vllm-deploy.py always protects the HTTPS endpoint with an API key. Supply your own with --api-key, or let the script generate one — it is stored in a root-only EnvironmentFile and printed once in the summary.
• zabbix-deploy.py accepts secrets via the environment variables ZABBIX_DB_PASSWORD and ZABBIX_ADMIN_PASSWORD (preferred), or the --db-password / --zabbix-password flags (visible in shell history). The database password is never passed on any command line.
• workstation-setup.py verifies what it downloads: Bun is installed from a pinned release with SHA-256 verification, uv comes from the Fedora repositories, and Brave's GPG key is checked against known fingerprints before import. Zed's installer is pinned but published without checksums — the script says so loudly.
• system-diag.py only contacts a third-party service (icanhazip.com) when you pass --external-ip.

Platform support

• network-diag.py runs on Linux and FreeBSD. On FreeBSD older than 13 it falls back to the legacy ping6 binary where available.
• system-diag.py is Linux-only (it reads /proc and /sys) and says so clearly on other platforms.
• The deployment and maintenance scripts target Fedora, CentOS Stream and openEuler (dnf4 and dnf5 are both handled).

---

Licence

MIT — see LICENSE.
Copyright © 2026 Petr Balvín