131 lines
4.1 KiB
Markdown
131 lines
4.1 KiB
Markdown
# Scripts — DevOps Toolbox
|
||
|
||
A personal collection of Python scripts for deploying, monitoring, and
|
||
maintaining Linux systems. Every script is **idempotent** (safe to run
|
||
repeatedly), requires **no external dependencies** (stdlib only), and
|
||
ships with `--dry-run` where applicable.
|
||
|
||
---
|
||
|
||
## Stack
|
||
|
||
| Concern | Choice |
|
||
|---------|--------|
|
||
| Language | Python 3.12+ |
|
||
| Package manager | None — stdlib only |
|
||
| Target platforms | Fedora Server, openEuler; FreeBSD 13+ (`network-diag.py` only) |
|
||
| Lint / format | Ruff (line length 100 — see `ruff.toml`) |
|
||
| Licence | MIT |
|
||
|
||
---
|
||
|
||
## Scripts
|
||
|
||
### Diagnostics
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `network-diag.py` | 2.1.1 | Network latency, DNS, MTU, packet loss, dual-stack — Linux + FreeBSD |
|
||
| `system-diag.py` | 1.0.0 | Full system health: CPU, memory, disk, GPU, services, security, performance — with A–F grade. Linux only |
|
||
|
||
### Deployment
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `server-setup.py` | 1.2.0 | Server initial setup: packages, firewall (SSH verified before start), SELinux, Podman, automatic updates |
|
||
| `workstation-setup.py` | 4.1.0 | Fedora desktop setup: Brave, dev tools (Bun, Zed, uv, Rust), Flatpak apps, SSH + Git |
|
||
| `vllm-deploy.py` | 1.1.0 | vLLM inference server behind nginx with HTTPS and API-key auth — installs ROCm on AMD GPUs |
|
||
| `zabbix-deploy.py` | 1.0.0 | Zabbix 7.4 monitoring stack: PostgreSQL 18, nginx with HTTPS on :443, PHP-FPM, SELinux |
|
||
|
||
### Maintenance
|
||
|
||
| Script | Version | Purpose |
|
||
|--------|---------|---------|
|
||
| `system-optimise.py` | 1.3.1 | System cleanup: old kernels (running + one fallback always kept), journals, temp files, core dumps, package audit. Refuses rpm-ostree systems |
|
||
|
||
---
|
||
|
||
## Quick Start
|
||
|
||
```bash
|
||
git clone https://codeberg.org/petrbalvin/scripts.git && cd scripts
|
||
```
|
||
|
||
All scripts are standalone — run them directly:
|
||
|
||
```bash
|
||
# Check your network (Linux or FreeBSD)
|
||
python3 network-diag.py
|
||
|
||
# Full system health report (Linux)
|
||
python3 system-diag.py
|
||
|
||
# Set up a new server
|
||
sudo python3 server-setup.py --dry-run
|
||
|
||
# Set up a development workstation
|
||
sudo python3 workstation-setup.py --dry-run
|
||
|
||
# Deploy vLLM (interactive model selection)
|
||
sudo python3 vllm-deploy.py
|
||
|
||
# Deploy the Zabbix monitoring stack
|
||
sudo python3 zabbix-deploy.py --dry-run
|
||
|
||
# Clean up old kernels and temp files
|
||
sudo python3 system-optimise.py --dry-run
|
||
```
|
||
|
||
Every script supports `--help` and `--version` without root privileges.
|
||
Use `--dry-run` to preview changes before applying them, and `--skip-*`
|
||
flags to skip individual sections.
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
### Security
|
||
|
||
- **`vllm-deploy.py`** always protects the HTTPS endpoint with an API key.
|
||
Supply your own with `--api-key`, or let the script generate one — it is
|
||
stored in a root-only `EnvironmentFile` and printed once in the summary.
|
||
- **`zabbix-deploy.py`** accepts secrets via the environment variables
|
||
`ZABBIX_DB_PASSWORD` and `ZABBIX_ADMIN_PASSWORD` (preferred), or the
|
||
`--db-password` / `--zabbix-password` flags (visible in shell history).
|
||
The database password is never passed on any command line.
|
||
- **`workstation-setup.py`** verifies what it downloads: Bun is installed
|
||
from a pinned release with SHA-256 verification, uv comes from the
|
||
Fedora repositories, and Brave's GPG key is checked against known
|
||
fingerprints before import. Zed's installer is pinned but published
|
||
without checksums — the script says so loudly.
|
||
- **`system-diag.py`** only contacts a third-party service
|
||
(`icanhazip.com`) when you pass `--external-ip`.
|
||
|
||
### Platform support
|
||
|
||
- `network-diag.py` runs on Linux and FreeBSD. On FreeBSD older than 13
|
||
it falls back to the legacy `ping6` binary where available.
|
||
- `system-diag.py` is Linux-only (it reads `/proc` and `/sys`) and says
|
||
so clearly on other platforms.
|
||
- The deployment and maintenance scripts target Fedora and openEuler
|
||
(dnf4 and dnf5 are both handled).
|
||
|
||
---
|
||
|
||
## Development
|
||
|
||
No build step, no dependencies. Lint and format with Ruff
|
||
(configuration in `ruff.toml`, line length 100):
|
||
|
||
```bash
|
||
ruff check .
|
||
ruff format --check .
|
||
```
|
||
|
||
---
|
||
|
||
## Licence
|
||
|
||
MIT — see [`LICENSE`](LICENSE).
|
||
Copyright © 2026 [Petr Balvín](https://petrbalvin.org)
|