109 lines
3.8 KiB
Markdown
109 lines
3.8 KiB
Markdown
# Scripts — DevOps Toolbox
|
||
|
||
A personal collection of standalone Python scripts for Linux server and
|
||
desktop management — stdlib only, MIT-licensed.
|
||
|
||
---
|
||
|
||
## Scripts
|
||
|
||
### Diagnostics
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
|
||
| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |
|
||
|
||
### Deployment
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `server-setup.py` | 1.3.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
|
||
| `workstation-setup.py` | 4.1.1 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
|
||
| `vllm-deploy.py` | 1.2.1 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
|
||
| `zabbix-deploy.py` | 1.1.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |
|
||
|
||
### Maintenance
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `system-optimise.py` | 1.4.0 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |
|
||
|
||
---
|
||
|
||
## Quick Start
|
||
|
||
Run any script directly without cloning — just `curl` and go:
|
||
|
||
```bash
|
||
# Network diagnostics (no root needed)
|
||
curl -sSf https://petrbalvin.org/scripts/network-diag.py | python3
|
||
|
||
# System health (no root needed)
|
||
curl -sSf https://petrbalvin.org/scripts/system-diag.py | python3
|
||
|
||
# Server setup
|
||
curl -sSf https://petrbalvin.org/scripts/server-setup.py | sudo python3
|
||
|
||
# Workstation setup
|
||
curl -sSf https://petrbalvin.org/scripts/workstation-setup.py | sudo python3
|
||
|
||
# vLLM deployment
|
||
curl -sSf https://petrbalvin.org/scripts/vllm-deploy.py | sudo python3
|
||
|
||
# Zabbix monitoring
|
||
curl -sSf https://petrbalvin.org/scripts/zabbix-deploy.py | sudo python3
|
||
|
||
# System cleanup
|
||
curl -sSf https://petrbalvin.org/scripts/system-optimise.py | sudo python3
|
||
```
|
||
|
||
#### Integrity verification (optional)
|
||
|
||
A single [`SHA256SUMS`](https://petrbalvin.org/scripts/SHA256SUMS) file covers
|
||
every script. Verify before running:
|
||
|
||
```bash
|
||
curl -sSfO https://petrbalvin.org/scripts/server-setup.py
|
||
curl -sSfO https://petrbalvin.org/scripts/SHA256SUMS
|
||
sha256sum -c --ignore-missing SHA256SUMS
|
||
sudo python3 server-setup.py --dry-run
|
||
```
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
### Security
|
||
|
||
- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
|
||
Supply your own with `--api-key`, or let the script generate one — it is
|
||
stored in a root-only `EnvironmentFile` and printed once in the summary.
|
||
- **`zabbix-deploy.py`** accepts secrets via the environment variables
|
||
`ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
|
||
`--db-password` / `--zabbix-password` flags (visible in shell history).
|
||
The database password is never passed on any command line.
|
||
- **`workstation-setup.py`** verifies what it downloads: Bun is installed
|
||
from a pinned release with SHA-256 verification, uv comes from the
|
||
Fedora repositories, and Brave's GPG key is checked against known
|
||
fingerprints before import. Zed's installer is pinned but published
|
||
without checksums — the script says so loudly.
|
||
- **`system-diag.py`** only contacts a third-party service
|
||
(`icanhazip.com`) when you pass `--external-ip`.
|
||
|
||
### Platform support
|
||
|
||
- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
|
||
it falls back to the legacy `ping6` binary where available.
|
||
- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
|
||
so clearly on other platforms.
|
||
- The deployment and maintenance scripts target Fedora, CentOS Stream and
|
||
openEuler (dnf4 and dnf5 are both handled).
|
||
|
||
---
|
||
|
||
## Licence
|
||
|
||
MIT — see [`LICENSE`](LICENSE).
|
||
Copyright © 2026 [Petr Balvín](https://petrbalvin.org)
|