blakeridgway/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Debian prep hardening, verify script, and quality pass

Browse Source 
- 00-system-prep.sh: bootstrap sudo when run as root; on Debian enable
  contrib/non-free-firmware (SKIP_NONFREE to opt out) + install needrestart
- scripts/verify-debian.sh: non-destructive post-install sanity checker
  (exit 0/1) covering OS, tools, Debian renames, upstream tooling,
  .NET/Podman/Postgres, groups, flatpak, dotfile symlinks
- 01-package-install.sh: auto-detect current Kubernetes minor from upstream
  (fallback v1.36, override K8S_MINOR) instead of stale v1.32 pin
- fix shellcheck findings (SC2155, SC2207, SC2088); all scripts clean at
  warning severity
- docs: fold decisions/status into plan; README lists new tools
This commit is contained in:
Blake Ridgway
2026-09-02 16:32:40 -05:00
parent ae72614636
commit 0817d6a815
6 changed files with 319 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

111
docs/debian-13-migration-plan.md
View File

@@ -46,87 +46,60 @@ The repo is mostly distro-agnostic already (shell rc files, aliases, nvim via Nv
---
## 3. File-by-file plan
## 3. File-by-file status (as of 2026-09-02)
### `main-setup.sh`
- [ ] Keep existing `detect_linux_distro()` — already returns `debian` for trixie (`ID=debian`). Verify `sudo` present; if missing, warn to `su -`/install `sudo` first (or auto-detect root).
- [ ] Replace the Fedora-only prompt for `03-fedora-dotnet-setup.sh` with a distro-agnostic `.NET` prompt (new `03-dotnet-setup.sh`), OR gate on both `fedora` and `debian`.
- [ ] Consider exporting `DEBIAN_CODENAME`/`DISTRO_VERSION` (from `/etc/os-release`) for downstream repo URLs.
### `main-setup.sh` — DONE
- [x] `detect_linux_distro()` returns `debian` for trixie; `PACKAGE_MANAGER=apt`.
- [x] Preflight: if non-root and `sudo` missing → clear guidance (run as root or install `sudo`); `sudo -n` note.
- [x] `.NET` prompt is now distro-agnostic → runs `03-dotnet-setup.sh` on every supported distro.
### `scripts/00-system-prep.sh`
- [ ] `apt update && apt upgrade` path already correct. Add optional: install `sudo`, `curl`, `gnupg`, `ca-certificates`, `software-properties-common`/`apt-transport-https` prerequisites early.
- [ ] (Optional) enable `contrib`/`non-free-firmware` components in `/etc/apt/sources.list.d/debian.sources` — needed for some firmware/tools.
### `scripts/00-system-prep.sh` — DONE
- [x] `sudo` bootstrap when running as root on a fresh install (apt/dnf).
- [x] Debian: idempotently add `contrib` + `non-free-firmware` to `debian.sources` (deb822) or legacy `sources.list` (skip with `SKIP_NONFREE=1`); `needrestart` installed on apt.
### `scripts/01-package-install.sh`
- [ ] Split `BASE_PACKAGE_LIST` into truly-common + distro lists; on Debian drop anything not in trixie and add Debian equivalents.
- [ ] **Rename fixes (Debian branch of `DISTRO_SPECIFIC_PACKAGES`):**
- `dnsutils` → `bind9-dnsutils`
- add `bat` handling: after install, `ln -sf /usr/bin/batcat /usr/local/bin/bat`
- add `sudo`, `ca-certificates`, `gnupg`, `curl` (ensure present)
- add `libvirt-daemon-system`, `virtinst`, `qemu-kvm`, `bridge-utils` for virt-manager
- add `zsh` post: `chsh -s /usr/bin/zsh` (or instruct)
- `python3-pip` stays, but flag PEP 668 handling (see 02)
- `docker.io` + `docker-compose` **or** wire Docker CE repo (defer to decision in §4)
- [ ] **Upstream repo tools not in Debian main** — install in this script or a new `05-` script:
- `gh` → GitHub CLI apt repo (`https://cli.github.com/packages`)
- `terraform` → HashiCorp apt repo
- `kubectl` → Kubernetes apt repo (`pkgs.k8s.io`)
- `k9s`, `minikube` → GitHub `.deb` releases (minikube official `.deb` exists)
- [ ] Flatpak list unchanged (distro-agnostic). Note VS Code Flatpak vs MS repo decision in §4.
### `scripts/01-package-install.sh` — DONE
- [x] Split base vs distro lists; `dnsutils` → `bind9-dnsutils`; `bat` → `batcat` symlink; libvirt/QEMU stack (`libvirt-daemon-system`, `libvirt-clients`, `qemu-system-x86`, `virtinst`, `bridge-utils`); prereqs (`sudo`, `ca-certificates`, `gnupg`, `curl`).
- [x] `setup_upstream_tooling()`: vendor repos for `gh` (GitHub CLI), `terraform` (HashiCorp), `kubectl` (pkgs.k8s.io); `k9s` (GitHub tarball) + `minikube` (official `.deb`) on apt; best-effort `dnf` on Fedora.
- [x] Kubernetes minor auto-detected from the latest k8s release (fallback `v1.36`; override with `K8S_MINOR`).
- [x] Flatpak list unchanged (VS Code stays Flatpak per decision).
### `scripts/02-dev-tools-setup.sh`
- [ ] **pynvim PEP 668 fix:** replace `pip install --user pynvim` with `python3 -m pip install --user --break-system-packages pynvim`, or (cleaner) install into NvChad's venv, or note `pipx`.
- [ ] Rest is GitHub-download based → distro-agnostic; verify `unzip`, `tar`, `wget` present.
- [ ] `dive` already handles `.deb` via `dpkg -i` on apt — good.
- [ ] Go/Rust/Nerd Font/Oh-My-Posh/Helm/kubectx/stern/trivy/AWS — no changes needed.
### `scripts/02-dev-tools-setup.sh` — DONE
- [x] `pynvim` PEP 668 fix: try `pip install --user`, fall back to `--break-system-packages`.
### `scripts/03-fedora-dotnet-setup.sh` → split/generalize
- [ ] Rename to **`03-dotnet-setup.sh`** and branch by `$PACKAGE_MANAGER`:
- **Fedora:** keep existing RPM/MS-repo path.
- **Debian:** add MS Debian repo `https://packages.microsoft.com/config/debian/13/packages-microsoft-prod.deb` (verify trixie support; fall back to `dotnet-install.sh` if repo is unavailable for trixie) then `apt install dotnet-sdk-10.0` (or 8/9 fallback loop like Fedora).
- Alternatively use official **`dotnet-install.sh`** for both — fully distro-agnostic, no repo dependency.
- [ ] Replace Fedora-specific db/container section with Debian equivalents:
- PostgreSQL: `apt install postgresql` (cluster auto-init — remove `postgresql-setup --initdb` step for Debian; just `systemctl enable --now postgresql`).
- Docker: `docker.io` + `docker-compose` + add user to `docker` group, or Docker CE repo.
- [ ] Update `main-setup.sh` gate accordingly.
### `scripts/03-fedora-dotnet-setup.sh` → `03-dotnet-setup.sh` — DONE
- [x] Renamed to `03-dotnet-setup.sh`, distro-agnostic (apt/dnf).
- [x] `.NET SDK` via official `dotnet-install.sh` (channel `STS`, override `DOTNET_CHANNEL`) → `~/.dotnet`, PATH added to `bashrc`/`zshrc`.
- [x] PostgreSQL: auto-cluster on Debian; `--initdb` only on Fedora.
- [x] Containers = **Podman** + `podman-compose` + `podman-docker` (Docker-CLI shim). No MS repo, no moby/docker-ce.
### `scripts/04-config-symlinks.sh`
- [ ] No functional changes needed (pure symlinking). Optionally handle `~/.bash_aliases` (Debian's default bashrc sources it) or leave as-is since `bashrc` sources `aliases.bash` directly.
### `scripts/04-config-symlinks.sh` — no changes required
- [x] Pure symlinking; distro-agnostic as-is.
### Shell rc files (`bashrc`, `zshrc`, aliases)
- [ ] Already distro-agnostic (PATH for `/usr/local/go`, `~/.local/bin`, cargo, nvm). No Fedora-specific bits.
- [ ] Note: `zshrc` still references **oh-my-zsh** (`$ZSH/oh-my-zsh.sh`, `plugins=(git)`) but no script installs it anymore (repo moved to Oh-My-Posh). On a fresh Debian this will fail silently. Decide: purge oh-my-zsh remnants or restore its install step. Recommend purging on this branch.
- [ ] Ensure `~/.fzf.zsh` / `~/.fzf.bash` generation (`fzf --zsh`/`--bash`) or skip gracefully (already guarded).
### Shell rc files (`bashrc`, `zshrc`, aliases) — DONE
- [x] `zshrc` oh-my-zsh remnants purged (plain zsh + Oh-My-Posh).
- [x] Duplicate Go `PATH` lines (appended by an old 02 run) removed from `bashrc`/`zshrc`.
- [x] `nvim/nvim` + `nushell/nushell` self-symlink targets updated to `/home/blake`.
### `README.md`
- [ ] Update "Supported Distributions" / feature matrix to reflect **Debian 13 = first-class**, Fedora optional.
- [ ] Rename "Fedora-Specific (.NET)" section → ".NET Development" with per-distro notes.
- [ ] Update post-install steps (group names `docker`, `libvirt`; remove Fedora-only log-out note if not applicable; add PEP 668 note).
- [ ] Update file listing for `03-*.sh` renames.
### `README.md` — DONE
- [x] Debian 13 first-class; feature lists, modular architecture, post-install steps, and supported-distro matrix updated (Podman, Flatpak VS Code, libvirt/kvm groups, rootless podman socket).
### Tooling / quality — DONE (this pass)
- [x] **`scripts/verify-debian.sh`** added — non-destructive end-to-end sanity checker (OS, binaries, Debian renames, upstream tools, dev tools, .NET/Podman/Postgres, groups, flatpak, dotfile symlinks); exit code 0/1.
- [x] **ShellCheck** (v0.11.0) run on all scripts — clean at warning severity (remaining notes are pre-existing info/style only).
---
## 4. Open decisions (need your input)
## 4. Decisions (confirmed)
1. **Container runtime:** Podman (`podman-docker` provides the `docker` shim so existing aliases keep working).
2. **VS Code:** Flatpak `com.visualstudio.code` (no MS editor repo).
3. **.NET:** official `dotnet-install.sh` (no MS vendor repo).
4. **oh-my-zsh:** purged from `zshrc`.
5. **Scope:** full rework (applied).
1. **Container runtime on Debian:** `docker.io` (Debian pkg) vs official **Docker CE** repo vs **Podman** (since Fedora used Podman Desktop + `moby-engine`)? This repo mixes docker aliases and Podman Desktop flatpak.
2. **VS Code source:** keep **Flatpak** `com.visualstudio.code` (already in list) or switch to MS apt repo `.deb` like Fedora's RPM setup did?
3. **.NET SDK version to target:** repo tries 8.0 → 9.0 on Fedora; pick a default for Debian (e.g. SDK 10 on trixie) or keep the fallback loop.
4. **oh-my-zsh remnants in `zshrc`:** purge (recommended) or keep?
5. **Scope of this branch:** full rework of all scripts, or a lighter pass (fix names + PEP 668 + .NET script) to validate on a live trixie box first?
---
## 5. Suggested execution order
1. Do the cheap, high-confidence fixes:
- `main-setup.sh` gating + `.NET` prompt
- `01-package-install.sh` Debian package renames (`bind9-dnsutils`, `bat` symlink, prerequisites, virt stack)
- `02-dev-tools-setup.sh` PEP 668 pynvim fix
2. Rename/generalize `03-fedora-dotnet-setup.sh` → `03-dotnet-setup.sh`.
3. Add upstream repo/bootstrap logic for `gh`, `terraform`, `kubectl`, `minikube`, `k9s`.
4. Purge oh-my-zsh remnants from `zshrc`.
5. Update `README.md`.
6. Test end-to-end on a Debian 13 VM (or real install) before merging to `master`.
## 5. Remaining work / next steps
- [ ] **Test end-to-end on a real Debian 13 box**: run `./main-setup.sh`, then `bash scripts/verify-debian.sh`, and fix anything the checker flags.
- [ ] Decide whether to keep Fedora/dnf support long-term or trim it later (kept for now).
- [ ] Merge `debian-13` → `master` after validation.
---