This page is a scrubbed, public-safe version of an internal operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same tabs as the original workbook — reach any of them from the
Operations menu above, or the list just below. Each tab is a section on this
page; within a section, every task shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, svnadmin, postsuper -d ALL, firewall reloads).
General-purpose Linux/Unix one-liners — sync, ssh tunnels, certificates, mail queues, cron and more.
26 tasks
Rsync from local to a remote directory
Mirrors files between two paths — locally or over SSH — with rsync, preserving modification times and permissions and optionally deleting extra files at the destination.
Generate a Bash script for the task “Rsync from local to a remote directory”. Parameterise the source and destination (host, user, path), keep --times --perms --links, make --delete opt-in, and echo the full rsync command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To remove a line from .ssh/known_hosts
Removes a stale host key from ~/.ssh/known_hosts after a server is rebuilt or its key changes.
Generate a Bash script for the task “To remove a line from .ssh/known_hosts”. Take a hostname or IP and run ssh-keygen -R <host>; mention doing it for both the name and the address. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Sort processes by memory usage
Inspects the running system — processes by memory, CPU model, NIC settings, or SMART disk errors.
Commands
ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
# Get CPU Model
grep 'model name' /proc/cpuinfo | awk -F: '{print $2}' | uniq -c | sed -re 's/^ +//'
AI prompt
Generate a Bash script for the task “Sort processes by memory usage”. Provide the one-liners: processes sorted by RSS, model name from /proc/cpuinfo, ethtool <iface>, and smartctl -l error <dev> — each with a one-line explanation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Open / close firewalld ports
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Generate a firewalld command sequence for the task “Open / close firewalld ports”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Remove rich rule
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Commands
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="<INTERNAL_IP>" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="<IP>" service name="https" accept'
# Firewall-cmd to block source IP address
firewall-cmd --permanent --zone="public" --add-rich-rule='rule family="ipv4" source address="<IP>" drop'
systemctl restart firewalld.service
AI prompt
Generate a firewalld command sequence for the task “Remove rich rule”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
File search and replace
Finds and replaces a string across many files — recursive grep -rl piped into sed -i, and the equivalent vi global-substitute form.
Commands
grep -rl 2011 * | xargs sed -i 's/2011/2018/g'
AI prompt
Generate a Bash script for the task “File search and replace”. Take a search string, a replacement and a path glob; list matching files with grep -rl then xargs sed -i 's/…/…/g', and make a backup copy first. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To initiate a local port forward
Opens an SSH tunnel between two hosts — a local forward (-L) to reach a service behind a bastion, or a reverse forward (-R) to expose a local port outward.
Commands
ssh <USER>@<SERVER> -L 2227:<INTERNAL_IP>:22
# To initiate a remote port forward
ssh -R 9000:localhost:22 -p 22022 <SSH_USER>@<REMOTE_HOST>
# For <SVN_HOST>
ssh -i ~/Documents/<GROUP>/IT/certs/<GROUP>-LightsailPrivateKey-us-west-2.pem -R 8443:<IP>:443 ec2-user@<BASTION_HOST>
AI prompt
Generate a Bash script for the task “To initiate a local port forward”. Parameterise local port, remote host:port, the jump host and key/port; build the ssh -L or ssh -R command and note how to background it with -fN. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
vi global replace
Finds and replaces a string across many files — recursive grep -rl piped into sed -i, and the equivalent vi global-substitute form.
Commands
:%s/search_string/replacement_string/g :%s/search_string/replacement_string/ghello
# Delete all files from a locate
locate nagios | xargs -t -I{} rm -rf {}
AI prompt
Generate a Bash script for the task “vi global replace”. Take a search string, a replacement and a path glob; list matching files with grep -rl then xargs sed -i 's/…/…/g', and make a backup copy first. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL clear password
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
User: backup Password: <DB_PASSWORD> Host name: <BACKUP_HOST>
update mysql.user set password=PASSWORD('<DB_PASSWORD>') where user='backup';
GRANT ALL PRIVILEGES ON *.* TO 'backup'@'<BACKUP_HOST>' identified by '<DB_PASSWORD>';
AI prompt
Generate the SQL statements for the task “MySQL clear password”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mount NFS
Mounts a remote CIFS/SMB share, an NFS export or an ISO image onto a local mount point (and remounts the root filesystem read-write).
Commands
mount <SERVER>:/var/lib/libvirt/images/<SERVER> /mnt/usb
# Mount ISO
mount -o loop disk1.iso /mnt/disk
# Mount Cifs
mount -t cifs //<INTERNAL_IP>/d\$ /mnt/sql -o username=Administrator,password=<SMB_PASSWORD>
# Show memory by process
ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
AI prompt
Generate a Bash script for the task “Mount NFS”. Take the source (share path, export or .iso), the mount point and credentials; pick the right mount -t cifs|-o loop|nfs invocation and create the mount point if needed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Timestamp log of a command
Wraps a command so its output is written to a log file bracketed by start and end timestamps.
Commands
date > mylog.txt;find /opt/bak/* -mtime +7 -exec ls -l {} \; >> mylog.txt;date >> mylog.txt
AI prompt
Generate a Bash script for the task “Timestamp log of a command”. Take a command and a log path; write date, run the command appending stdout/stderr, then date again — so the log shows exactly when it ran. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mail something
Inspects the running system — processes by memory, CPU model, NIC settings, or SMART disk errors.
Commands
mail -s "Reorg and Runstats from $HOSTNAME" <SSH_USER>@<REMOTE_HOST> < mailBody.txt
# Ethernet adapter settings
ethtool eth0
AI prompt
Generate a Bash script for the task “Mail something”. Provide the one-liners: processes sorted by RSS, model name from /proc/cpuinfo, ethtool <iface>, and smartctl -l error <dev> — each with a one-line explanation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Example crontab commands
Example crontab entries for routine maintenance — pruning old backups, NTP sync, updatedb, nightly backup and cleanup jobs.
Generate a crontab block for the task “Example crontab commands”. Produce a commented crontab block: field legend, then one line per job (backup prune, ntpdate, updatedb, backup script) with sane staggered times. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
List any disk errors for /dev/sdb
Inspects the running system — processes by memory, CPU model, NIC settings, or SMART disk errors.
Commands
smartctl -l error /dev/sdb
AI prompt
Generate a Bash script for the task “List any disk errors for /dev/sdb”. Provide the one-liners: processes sorted by RSS, model name from /proc/cpuinfo, ethtool <iface>, and smartctl -l error <dev> — each with a one-line explanation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Create a self-signed certificate
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Commands
Common name must be the same name as the server if we are self signing
Public Cert Filename: <GROUP>.pem Private Key Filename: <GROUP>.pem
openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/<GROUP>.pem -keyout /etc/ssl/private/<GROUP>.pem
# View a certificate chain
openssl s_client -CApath /usr/share/ca-certificates/cacert.org/ -connect <SVN_HOST>:993
openssl s_client -connect <USER>.com:443 -servername <USER>.com
AI prompt
Generate an openssl command sequence for the task “Create a self-signed certificate”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
OpenSSL
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Generate an openssl command sequence for the task “OpenSSL”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Refresh all zone files
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Commands
for file in *; do l=${file%.hosts}; l=${l%.rev}; rndc reload "$l"; done
# Test IMAPS on mail server
openssl s_client -connect <MAIL_HOST>:imaps
# Append Certificate Authority to bundle
openssl x509 -text -in /path/to/proxycert.crt >> /etc/pki/tls/certs/ca-bundle.crt
AI prompt
Generate an openssl command sequence for the task “Refresh all zone files”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generate certificate <PROJECT>
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Generate certificate <PROJECT>”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Sync mount with local directory
Mirrors files between two paths — locally or over SSH — with rsync, preserving modification times and permissions and optionally deleting extra files at the destination.
Generate a Bash script for the task “Sync mount with local directory”. Parameterise the source and destination (host, user, path), keep --times --perms --links, make --delete opt-in, and echo the full rsync command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Stop DHCP from overwriting resolv.conf
Makes /etc/resolv.conf immutable with chattr +i so DHCP or NetworkManager can't overwrite the resolver settings.
Commands
chattr +i /etc/resolv.conf Make it immutable
AI prompt
Generate a Bash script for the task “Stop DHCP from overwriting resolv.conf”. Show chattr +i /etc/resolv.conf to lock and chattr -i to unlock, with a note to set the desired nameservers first. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mysql MAX Locks exceeded
Edits the MySQL server config (my.cnf) — bind address or InnoDB buffer size — to fix a startup or locking error.
Commands
[mysqld]
innodb_buffer_pool_size=50M
AI prompt
Generate the config snippet for the task “Mysql MAX Locks exceeded”. Show the [mysqld] keys to set (bind-address, innodb_buffer_pool_size), where the file lives on Debian vs RHEL, and the restart command. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Postfix Clear queue
Manages the Postfix mail queue — inspect it, delete all or just the deferred queue, and trace a message by its queue ID.
Commands
postsuper -d ALL Deferred queue postsuper -d ALL deferred
# View the queue
mailq
# Query a user from a Queue ID
postcat -q <QUEUE_ID> | grep Auth Queue ID <QUEUE_ID>
AI prompt
Generate a Bash script for the task “Postfix Clear queue”. Provide mailq, postsuper -d ALL / postsuper -d ALL deferred, and postcat -q <id> | grep -i auth, with a guard prompt before any bulk delete. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MAC flush DNS Cache
Flushes the macOS DNS resolver cache after a hosts-file or DNS change.
Generate a Bash script for the task “MAC flush DNS Cache”. Emit sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder and note it needs an admin password. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Save a website
Mirrors a website to static files with wget — page requisites, link conversion and domain limiting for offline browsing.
Generate a Bash script for the task “Save a website”. Take the start URL and the domain to stay within; run wget --recursive --page-requisites --convert-links --restrict-file-names=windows --no-parent --domains <domain>. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
VirtualBox commands
Clones a VirtualBox disk image and resets its UUID so the copy can be attached alongside the original.
Generate a Bash script for the task “VirtualBox commands”. Take a source .vdi and a target name; run VBoxManage clonehd, then VBoxManage internalcommands sethduuid if the UUID still clashes. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Block source addresses in firewalld
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Generate a firewalld command sequence for the task “Block source addresses in firewalld”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generate a firewalld command sequence for the task “Open / close firewalld ports”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Remove rich rule
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Commands
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="<INTERNAL_IP>" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="<IP>" service name="https" accept'
# Firewall-cmd to block source IP address
firewall-cmd --permanent --zone="public" --add-rich-rule='rule family="ipv4" source address="<IP>" drop'
systemctl restart firewalld.service
AI prompt
Generate a firewalld command sequence for the task “Remove rich rule”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Block source addresses in firewalld
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Generate a firewalld command sequence for the task “Block source addresses in firewalld”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
IP set commands
Creates firewalld ipsets from files of networks (a drop set and a trusted set), loads their entries, and binds each ipset to the matching zone.
Generate a firewalld command sequence for the task “IP set commands”. Take a set name, a hash:net type, and a path to an entries file; create the ipset if missing, sync entries from the file, bind it to a zone, and reload — all idempotent. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generally useful commands
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Generate a firewalld command sequence for the task “Generally useful commands”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Open / close firewalld ports (2)
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Commands
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" port port="5432" protocol="tcp" accept"
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" port port="9011" protocol="tcp" accept"
AI prompt
Generate a firewalld command sequence for the task “Open / close firewalld ports (2)”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Git
Bootstrapping Git on a fresh host and recovering when the per-host branch is wrong.
4 tasks
New install
Bootstraps Git on a fresh host — identity, a new remote, a per-host branch — and the recovery steps when the hostname (and therefore the branch) is wrong.
Generate a Bash script for the task “New install”. Parameterise user name, email, remote URL and branch (default $HOSTNAME); set the global identity, add the origin, create and push the branch, and show how to redo it after git remote remove origin. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Set remote to another git server
Bootstraps Git on a fresh host — identity, a new remote, a per-host branch — and the recovery steps when the hostname (and therefore the branch) is wrong.
Generate a Bash script for the task “Set remote to another git server”. Parameterise user name, email, remote URL and branch (default $HOSTNAME); set the global identity, add the origin, create and push the branch, and show how to redo it after git remote remove origin. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Get and view all branches
Bootstraps Git on a fresh host — identity, a new remote, a per-host branch — and the recovery steps when the hostname (and therefore the branch) is wrong.
Commands
git fetch -a && git branch -a
AI prompt
Generate a Bash script for the task “Get and view all branches”. Parameterise user name, email, remote URL and branch (default $HOSTNAME); set the global identity, add the origin, create and push the branch, and show how to redo it after git remote remove origin. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
If the hostname is wrong
Bootstraps Git on a fresh host — identity, a new remote, a per-host branch — and the recovery steps when the hostname (and therefore the branch) is wrong.
Commands
git remote remove origin
Then run all of the above
AI prompt
Generate a Bash script for the task “If the hostname is wrong”. Parameterise user name, email, remote URL and branch (default $HOSTNAME); set the global identity, add the origin, create and push the branch, and show how to redo it after git remote remove origin. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Makes bash tab-completion case-insensitive through readline.
Commands
set completion-ignore-case on
AI prompt
Generate a Bash script for the task “Auto complete without case”. Show adding set completion-ignore-case on to ~/.inputrc (or /etc/inputrc for all users) and reloading with bind -f. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Default to graphical start
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
systemctl set-default graphical.target
AI prompt
Generate a Bash script for the task “Default to graphical start”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To add a <PROJECT> repository
Checks out a Subversion working copy over HTTPS and strips any stray .svn metadata directories left behind by an old export.
Generate a Bash script for the task “To add a <PROJECT> repository”. Take the repository URL and a target directory; run svn checkout <url> <dir> and optionally find -iname '*.svn' -exec rm -rf {} +. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Rsync examples
Mirrors files between two paths — locally or over SSH — with rsync, preserving modification times and permissions and optionally deleting extra files at the destination.
Generate a Bash script for the task “Rsync examples”. Parameterise the source and destination (host, user, path), keep --times --perms --links, make --delete opt-in, and echo the full rsync command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Create Boot USB on a Mac
Uses diskutil and dd on macOS to identify a removable disk, unmount it, and image it to a file or write an image (e.g. a Raspberry Pi card) back to it.
Generate a Bash script for the task “Create Boot USB on a Mac”. Take the disk identifier and an image path; diskutil list, diskutil unmountDisk, then dd in the requested direction using the raw device — and refuse to run without an explicit disk id. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
NFS for clients
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Commands
yum install nfs-utils nfs-utils-lib
AI prompt
Generate a Bash script for the task “NFS for clients”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mount an NTFS partition
Mounts a remote CIFS/SMB share, an NFS export or an ISO image onto a local mount point (and remounts the root filesystem read-write).
Commands
mount -t cifs //<INTERNAL_IP>/Public /mnt/usb -o username=<USER>
# Remount a read-only file system
mount -no remount,rw /
# Mount an ISO file
mount -o loop TheISOfilename.iso /mnt/usb
AI prompt
Generate a Bash script for the task “Mount an NTFS partition”. Take the source (share path, export or .iso), the mount point and credentials; pick the right mount -t cifs|-o loop|nfs invocation and create the mount point if needed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
New CentOs7 post install
Sets SELinux file contexts and booleans so a service (Samba, libvirt, a custom SSH port) can use a directory or port without being denied.
Commands
cp /usr/lib/firewalld/services/ssh.xml .
yum -y install policycoreutils-python
semanage port -a -t ssh_port_t -p tcp 22022
systemctl reload firewalld.service
AI prompt
Generate a Bash script for the task “New CentOs7 post install”. Take a path and a target type (e.g. samba_share_t, public_content_rw_t); add the fcontext rule, restorecon -Rv, and set any needed boolean with setsebool -P. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Test disk speed
Uses diskutil and dd on macOS to identify a removable disk, unmount it, and image it to a file or write an image (e.g. a Raspberry Pi card) back to it.
Generate a Bash script for the task “Test disk speed”. Take the disk identifier and an image path; diskutil list, diskutil unmountDisk, then dd in the requested direction using the raw device — and refuse to run without an explicit disk id. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Samba install - setup directory
Sets SELinux file contexts and booleans so a service (Samba, libvirt, a custom SSH port) can use a directory or port without being denied.
Commands
mkdir /data2/<GROUP>
useradd <GROUP> -d /data2/<GROUP>
chown -R <GROUP>:<GROUP> /data2/<GROUP>
semanage fcontext -a -t samba_share_t '/data2/<GROUP>'
restorecon -R /data2/<GROUP>
Edit /etc/passwd, nano /etc/passwd
<GROUP>:x:1002:1002::/data2/<GROUP>:/sbin/nologin - Set's the user directory to /sbin/nologin so the user cannot SSH to this server
Common /etc/samba/smb.conf entries to a directory share:
write list = <USER>
force user = <SMB_USER>
force group = <SMB_USER>
AI prompt
Generate a Bash script for the task “Samba install - setup directory”. Take a path and a target type (e.g. samba_share_t, public_content_rw_t); add the fcontext rule, restorecon -Rv, and set any needed boolean with setsebool -P. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,pass…
Mounts a remote CIFS/SMB share, an NFS export or an ISO image onto a local mount point (and remounts the root filesystem read-write).
Commands
mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,password=<SMB_PASSWORD>
AI prompt
Generate a Bash script for the task “mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,pass…”. Take the source (share path, export or .iso), the mount point and credentials; pick the right mount -t cifs|-o loop|nfs invocation and create the mount point if needed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup SELinux for directories
Sets SELinux file contexts and booleans so a service (Samba, libvirt, a custom SSH port) can use a directory or port without being denied.
Commands
http://danwalsh.livejournal.com/14195.html Directory to use: /data1/bak
chcon -R -t samba_share_t /data1/bak
semanage fcontext -a -t samba_share_t '/data1/bak(/.*)?'
restorecon -R -v /data1/bak
# share home directories
setsebool -P samba_enable_home_dirs 1
# share public directories
semanage fcontext -a -t public_content_rw_t '/data1/bak(/.*)?'
restorecon -R -v /data1/bak
setsebool -P allow_smbd_anon_write 1
# share public NFS files
setsebool -P samba_share_nfs 1
AI prompt
Generate a Bash script for the task “Setup SELinux for directories”. Take a path and a target type (e.g. samba_share_t, public_content_rw_t); add the fcontext rule, restorecon -Rv, and set any needed boolean with setsebool -P. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Set clock to UTC
Puts the system clock on UTC and enables NTP synchronisation with timedatectl.
Commands
timedatectl set-local-rtc no
timedatectl set-ntp yes
timedatectl set-timezone UTC
AI prompt
Generate a Bash script for the task “Set clock to UTC”. Emit timedatectl set-local-rtc no, set-ntp yes, set-timezone UTC, then timedatectl to confirm. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SSH local forwarding
Opens an SSH tunnel between two hosts — a local forward (-L) to reach a service behind a bastion, or a reverse forward (-R) to expose a local port outward.
Generate a Bash script for the task “SSH local forwarding”. Parameterise local port, remote host:port, the jump host and key/port; build the ssh -L or ssh -R command and note how to background it with -fN. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Serial Port connection
Opens a serial console to a device with minicom on the given tty.
Commands
minicom -D /dev/ttyS0
AI prompt
Generate a Bash script for the task “Serial Port connection”. Take the device path (default /dev/ttyS0) and baud rate and launch minicom -D <dev> -b <baud>. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SSH Connect two machines
Opens an SSH tunnel between two hosts — a local forward (-L) to reach a service behind a bastion, or a reverse forward (-R) to expose a local port outward.
Commands
On the primary machine: On the client machine:
ssh -R 9000:localhost:3000 -p 22022 <SSH_USER>@<REMOTE_HOST> ssh -R 9000:localhost:22 -p 22022 <SSH_USER>@<REMOTE_HOST>
AI prompt
Generate a Bash script for the task “SSH Connect two machines”. Parameterise local port, remote host:port, the jump host and key/port; build the ssh -L or ssh -R command and note how to background it with -fN. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mac
macOS admin: Homebrew toolchains, Internet Sharing ranges, interface aliases, pf.conf.
4 tasks
Installing dejavu for Python
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “Installing dejavu for Python”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Change default Internet Sharing IP addresses and range
Configures host networking — static interface config, an extra IP alias, macOS Internet Sharing ranges, a bridge, or pf.conf anchors.
Generate a Bash script for the task “Change default Internet Sharing IP addresses and range”. Parameterise interface, address, mask and gateway; show the persistent config file edit plus the live ip addr / ifconfig command, and how to revert. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Added an additional IP to en0
Configures host networking — static interface config, an extra IP alias, macOS Internet Sharing ranges, a bridge, or pf.conf anchors.
Commands
sudo ifconfig en0 alias <INTERNAL_IP> up Interface: en0 IP to add: <INTERNAL_IP> Subnet: 24
# Remove the IP
sudo ifconfig en0 alias <INTERNAL_IP> up
AI prompt
Generate a Bash script for the task “Added an additional IP to en0”. Parameterise interface, address, mask and gateway; show the persistent config file edit plus the live ip addr / ifconfig command, and how to revert. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Add firewall rules to /etc/pf.conf
Configures host networking — static interface config, an extra IP alias, macOS Internet Sharing ranges, a bridge, or pf.conf anchors.
Commands
anchor goodguys
load anchor goodguys from "/opt/scripts/mac/pf/<PF_ANCHOR_FILE>
AI prompt
Generate a Bash script for the task “Add firewall rules to /etc/pf.conf”. Parameterise interface, address, mask and gateway; show the persistent config file edit plus the live ip addr / ifconfig command, and how to revert. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Uses libvirt's virsh to list, dump, define, undefine, start and resize KVM guest domains, including looping over every guest to export its XML.
Commands
<GUEST>
# List all domains
virsh list --all
# Dump a configuration file
virsh dumpxml <GUEST> > <GUEST>.$HOSTNAME.110410.xml
# Persist a domain
virsh define <GUEST>.$HOSTNAME.110410.xml
# Undefine a domain
virsh undefine <GUEST>
# Just start a domain (does not save)
virsh create <GUEST>.$HOSTNAME.110410.xml
# Increase the size of the VM
truncate --size=+6G <GUEST>
# Get list of raw VM names
virsh list --all | tail -n+3 | cut -f4 -d' '
# Dump all VM configurations
for vm in `virsh list --all | tail -n+3 | cut -f4 -d' '`; do virsh dumpxml $vm > $vm.`date +%y%m%d`.xml; done
# Set SELinux permissions
chcon system_u:object_r:svirt_image_t:s0 <GUEST>.img
# Use an existing SELinux context
chcon --reference=/etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca.crt
AI prompt
Generate a Bash script for the task “libvirt / virsh guest management”. Parameterise the guest name; provide list/dumpxml/define/undefine/create commands and a loop that dumps every domain to <name>.<host>.<date>.xml. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Get just the virtual names
Uses libvirt's virsh to list, dump, define, undefine, start and resize KVM guest domains, including looping over every guest to export its XML.
Commands
virsh list --all | sed -n '3,${/./!bz;p;:z}' | cut -f4 -d" "
# To export all VM settings
for vm in `virsh list --all | sed -n '3,${/./!bz;p;:z}' | cut -f4 -d" "`; do virsh dumpxml "$vm" > "$vm.$HOSTNAME.`date +%y%m%d`.xml"; done
AI prompt
Generate a Bash script for the task “Get just the virtual names”. Parameterise the guest name; provide list/dumpxml/define/undefine/create commands and a loop that dumps every domain to <name>.<host>.<date>.xml. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL
MySQL backup and restore, account and privilege management, and config fixes.
7 tasks
MySQL connection details
The connection parameters for the reference MySQL instance — user, host and database. The password is redacted; the other snippets in this section use these values.
Commands
root
# Password:
<DB_PASSWORD> % denotes every database in GRANT statements
# Host:
<INTERNAL_IP> <INTERNAL_IP>.0.0.0 For subnets use: <INTERNAL_IP>.0.0.0.
# Database:
vtx
AI prompt
Generate a Bash script for the task “MySQL connection details”. Produce a .env template plus a shell function that loads MySQL host, user, password and database from the environment and opens a mysql session. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Change years to current year
An ad-hoc SQL query kept for reuse — here, shifting stored dates to the current year.
Generate the SQL statements for the task “Change years to current year”. Take the table and date column; write a parameterised SELECT / UPDATE and note to test it in a transaction before committing. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Connect to MySQL
Dumps MySQL databases to a timestamped, optionally gzipped file for backup and restores them with the mysql client.
Commands
#!/bin/sh
date=`date -I`
mysql -h <IP> -D vtx -u root
# Backup all databases
mysqldump --all-databases | gzip > /opt/bak/backup-$date.sql.gz
# Remotely
mysqldump -h <IP> -u root --all-databases > /opt/bak/mysql.$HOSTNAME.`date +%y%m%d`.bak.sql
# Backup a database
mysqldump -h <IP> -u root <INTERNAL_IP> > /opt/bak/mysql.$HOSTNAME.`date +%y%m%d`.bak.sql
# Backup and restore together
mysqldump -uroot -p <DB_PASSWORD> vtx | mysql --host=<IP> -C vtx
# MySQL Restore
mysql -u root -p vtx < /opt/bak/mysql.hostname.date.bak.sql
# Restore in the terminal
mysql -h <IP> -D <SERVER> -u jasperadmin
mysql>source filename.sql
AI prompt
Generate a Bash script for the task “Connect to MySQL”. Parameterise host, user and target database (or --all-databases); write dumps to a dated filename under a backup dir, and provide the matching restore command. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Get user names
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
SELECT Host, User FROM mysql.user;
# Create a user
CREATE USER 'root'@'<INTERNAL_IP>' identified by '<DB_PASSWORD>';
# Drop a user
DROP USER 'root'@'<INTERNAL_IP>';
# Grant priveleges
GRANT ALL PRIVILEGES ON *.* TO 'root'@'<INTERNAL_IP>' WITH GRANT OPTION;
# Change a password
SET PASSWORD FOR ''@'localhost' = PASSWORD('<DB_PASSWORD>');
AI prompt
Generate the SQL statements for the task “Get user names”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
For a domain
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
CREATE USER 'myname'@'%.mydomain.com' identified by '<DB_PASSWORD>';
# For localhost
CREATE USER 'root'@'<INTERNAL_IP>' identified by '<DB_PASSWORD>';
# Grant priveleges
GRANT ALL PRIVILEGES ON *.* TO 'root'@'<INTERNAL_IP>' WITH GRANT OPTION;
# For a LAN
CREATE USER 'root'@'192.168%' identified by '<DB_PASSWORD>';
GRANT ALL PRIVILEGES ON *.* TO 'root'@'192.168%' WITH GRANT OPTION;
# SYSTEM_USER issue
GRANT SYSTEM_USER ON *.* TO `root`@`%` WITH GRANT OPTION; GRANT SYSTEM_USER ON *.* TO `root`@`localhost` WITH GRANT OPTION;
AI prompt
Generate the SQL statements for the task “For a domain”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL account & privilege management
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
create user '<USER>'@'%' identified by '<DB_PASSWORD>';
grant all on *.* to '<USER>'@'%';
flush privileges;
AI prompt
Generate the SQL statements for the task “MySQL account & privilege management”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL account & privilege management (2)
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
use eg;
grant all on eg to 'eg'@'%';
use dejavu;
grant all on eg to 'eg'@'%';
AI prompt
Generate the SQL statements for the task “MySQL account & privilege management (2)”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Keys
Software licence keys (redacted here) — kept for reference only.
1 task
Software licence keys
A software licence key from the workbook. The key itself is redacted here — the row is kept only so the section structure matches the source.
Commands
# Visio Professional 2019
<PRODUCT_KEY> MSDN
AI prompt
Generate a Bash script for the task “Software licence keys”. Not applicable — this is a licence record, not a command. Store real keys in a secret manager, never in a page or a repo. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Raspberry Pi
Raspberry Pi provisioning: imaging cards, Node.js, cameras, Bluetooth, IR, audio.
22 tasks
Update keyboard map
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Commands
setxkbmap us
# Install Node.js
curl -sL https://deb.nodesource.com/setup | sudo bash - for v0.10.x (DO NOT USE)
curl -sL https://deb.nodesource.com/setup_7.x | sudo -E bash -
sudo apt-get install nodejs
node -v
npm -v
AI prompt
Generate a Bash script for the task “Update keyboard map”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Start VNC
Installs and enables a VNC server as a systemd (or SysV) service for a given display and user, and opens the matching firewall port.
Generate a Bash script for the task “Start VNC”. Parameterise the user and display number; install the server, template the vncserver@:N.service unit, open port 590N, and systemctl enable --now it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Apple program SD card
Uses diskutil and dd on macOS to identify a removable disk, unmount it, and image it to a file or write an image (e.g. a Raspberry Pi card) back to it.
Commands
diskutil list Find the disk# of the SD card.
diskutil unmountdisk /dev/disk3 Unmount the disk, do not eject
# Save the SD card's image
dd bs=1m if=/dev/disk3 of=raspberry.img
Writing to disk
# Wipe an SD card clean - remove all partitions
diskutil partitionDisk /dev/disk3 1 MBR "Free Space" "%noformat%" 100% May not be needed before a write. Just in case.
# Write an image to SD card
dd bs=1m if=raspberry.img of=/dev/rdisk3 Notice we're using rdisk#, not disk#
AI prompt
Generate a Bash script for the task “Apple program SD card”. Take the disk identifier and an image path; diskutil list, diskutil unmountDisk, then dd in the requested direction using the raw device — and refuse to run without an explicit disk id. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
New Pi setup
An ad-hoc SQL query kept for reuse — here, shifting stored dates to the current year.
Generate the SQL statements for the task “New Pi setup”. Take the table and date column; write a parameterised SELECT / UPDATE and note to test it in a transaction before committing. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
upgrade node.js past 0.10.x
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
curl -sL https://deb.nodesource.com/setup_7.x | sudo -E bash -
sudo apt install nodejs
sudo reboot
Create a new Gero on https://<APP_HOST>/ using your login
-- Not needed for Pi - Arduino only. sudo systemctl disable bluetooth
sudo apt-get install bluetooth bluez libbluetooth-dev libudev-dev
cd /opt/<APP>/gero;npm install websocket;npm install bluetooth-hci-socket;npm install bleno;npm install noble;npm install wiring-pi
AI prompt
Generate a Bash script for the task “upgrade node.js past 0.10.x”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
set the gerokey to the Gero GUID
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
nano /opt/<APP>/gero/config.json
sudo cp /opt/<APP>/gero/gero-init-pi /etc/init.d/gero;sudo update-rc.d gero defaults
sudo reboot Verify the service is running automatically. ps ax | grep 'node'
AI prompt
Generate a Bash script for the task “set the gerokey to the Gero GUID”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Install the camera software (if needed)
Clones a third-party project from GitHub and runs its shell installer.
Commands
git clone https://github.com/silvanmelchior/RPi_Cam_Web_Interface.git
cd RPi_Cam_Web_Interface
chmod u+x *.sh
sudo ./install.sh
AI prompt
Generate a Bash script for the task “Install the camera software (if needed)”. Take the repository URL; git clone, chmod u+x *.sh, read install.sh before trusting it, then run it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
For SSL Camera serving
Adds the TLS directives to an Apache virtual host — SSLEngine on plus the certificate, key and chain-file paths — and reloads Apache.
Commands
Create default index.html at /var/www unless you've installed Rpi Cam directly to /var/www, then drop the html
sudo nano /var/www/html/config.php Set your app and camera names
APP_NAME <APP> Cam
CAM_NAME
CAMERA_STRING APP_NAME . ": " . CAM_NAME . '@' . HOST_NAME
sudo nano /var/www/html/index.php
Add to the head tags <script src="https://<APP_HOST>/Scripts/pi/pi-camera.js"></script>
Near the Annotation Text: line Replace RPi Cam with <APP> Cam
On the camera web page, press the Full button, go to Camera Settings, and change the annotation to your preference.
sudo a2enmod ssl
cd /home/pi Create symlinks to <APP> certs.
svn checkout https://<SVN_HOST>/svn/<APP>/IT/<APP>.com.Certs
sudo mv /home/pi/<APP>.com.Certs /opt
cd /etc/ssl/private; sudo ln -s /opt/<APP>.com.Certs/<APP>.com.key
cd /etc/ssl/certs; sudo ln -s /opt/<APP>.com.Certs/<APP>.com.crt;sudo ln -s /opt/<APP>.com.Certs/gd_bundle-g2-g1.crt
AI prompt
Generate a Bash script for the task “For SSL Camera serving”. Take the vhost file, the listen port and the cert/key/chain paths; insert the SSLEngine / SSLCertificate* lines, enable mod_ssl, and apachectl configtest && apachectl graceful. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Enable SSL on an Apache vhost
Adds the TLS directives to an Apache virtual host — SSLEngine on plus the certificate, key and chain-file paths — and reloads Apache.
Commands
Add these lines for ssl. Set VirtualHost port to match ../ports.conf port.
SSLEngine on
SSLCertificateFile /etc/ssl/certs/<APP>.com.crt
SSLCertificateKeyFile /etc/ssl/private/<APP>.com.key
SSLCertificateChainFile /etc/ssl/certs/gd_bundle-g2-g1.crt
AI prompt
Generate a Bash script for the task “Enable SSL on an Apache vhost”. Take the vhost file, the listen port and the cert/key/chain paths; insert the SSLEngine / SSLCertificate* lines, enable mod_ssl, and apachectl configtest && apachectl graceful. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
LIRC - Linux Infrared Control
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Commands
sudo apt install lirc GPIOs: In Pin: 17 Out pin: 18
Add to /etc/modules lirc_dev
lirc_rpi gpio_in_pin=17 gpio_out_pin=18
Add to /boot/config.txt dtoverlay=lirc-rpi,gpio_in_pin=17,gpio_out_pin=18
AI prompt
Generate a Bash script for the task “LIRC - Linux Infrared Control”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
irsend LIST "" ""
Sets up LIRC infrared send/receive on Raspberry Pi GPIO pins and sends remote key codes with irsend.
Commands
irsend SEND_ONCE JKT-86 KEY_POWER Turn on/off a Changhong TV.
AI prompt
Generate a Bash script for the task “irsend LIST "" ""”. Take the in/out GPIO pins and a remote+key name; show the /etc/modules, /boot/config.txt overlay lines, and irsend SEND_ONCE <remote> <key>. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
BodyWave
Example crontab entries for routine maintenance — pruning old backups, NTP sync, updatedb, nightly backup and cleanup jobs.
Commands
sudo nano /etc/systemd/system/dbus-org.bluez.service ExecStart=/usr/lib/bluetooth/bluetoothd --compat --noplugin=sap
sudo cp /opt/<APP>/gero/freer-logic/libbluetooth.so* /usr/lib/arm-linux-gnueabihf Tray - Freer Logic sudo scp pi@<PI_HOST>:/usr/lib/arm-linux-gnueabihf/libbluetooth.so* /usr/lib/arm-linux-gnueabihf
sudo mkdir /var/run/sdp
Edit /opt/<APP>/gero/start.sh and replace app.js with freer-logic-httpcomm.js and add gpio mode 1 out before running if pin 18. Must use wiring-pi numbers.
@reboot /opt/<APP>/gero/freer-logic/bw_bluetooth.sh sudo crontab -e
AI prompt
Generate a crontab block for the task “BodyWave”. Produce a commented crontab block: field legend, then one line per job (backup prune, ntpdate, updatedb, backup script) with sane staggered times. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Pair Pi with the phone
Pairs the Raspberry Pi with a Bluetooth device from the command line and wires up the BlueZ service overrides needed for a serial/SPP link.
Commands
sudo bluetoothctl
scan on Then look for the device and copy the address
pair ${address_you_found}
pairable yes
trust <BT_ADDR>
pair <BT_ADDR> Say yes on your phone
AI prompt
Generate a Bash script for the task “Pair Pi with the phone”. Walk bluetoothctl (scan on, trust, pair) parameterised by the device MAC, and show the dbus-org.bluez.service ExecStart override for --compat. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Emissions Group support
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “Emissions Group support”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
<USER_EMAIL>
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “<USER_EMAIL>”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Raspberry Pi EG install support Python3 libs
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “Raspberry Pi EG install support Python3 libs”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Set the default USB Audio device
Forces a USB audio device to be card 0 on Raspberry Pi and works around PulseAudio/ALSA startup errors.
Commands
sudo nano /lib/modprobe.d/aliases.conf #options snd-usb-audio index=-2 options snd- usb- audio index = -2 change to 0
options snd-usb-audio index=0
AI prompt
Generate a Bash script for the task “Set the default USB Audio device”. Show the /lib/modprobe.d/aliases.conf edit setting options snd-usb-audio index=0 plus the ALSA/PulseAudio packages to install, then a reboot. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Bigtime help getting past PulseAudio errors
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “Bigtime help getting past PulseAudio errors”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
didn't help
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “didn't help”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
OBD reset
Pairs the Raspberry Pi with a Bluetooth device from the command line and wires up the BlueZ service overrides needed for a serial/SPP link.
Commands
rfcomm bind rfcomm0 <BT_ADDR>
AI prompt
Generate a Bash script for the task “OBD reset”. Walk bluetoothctl (scan on, trust, pair) parameterised by the device MAC, and show the dbus-org.bluez.service ExecStart override for --compat. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Python3 PyQt5 install on Pi
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Generate a Bash script for the task “Python3 PyQt5 install on Pi”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL update
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
create user 'root'@'%' identified by '<DB_PASSWORD>'; grant all on *.* to 'root'@'%' with grant option; flush privileges;
AI prompt
Generate the SQL statements for the task “MySQL update”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
New Linux Server
The full first-boot runbook for a new CentOS server — networking, services, VNC, Samba.
5 tasks
New CentOS server — first-boot runbook
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
Command Notes
# Configure networking
service NetworkManager stop
chkconfig NetworkManager off
chkconfig --levels 2345 network on
system-config-network Configure your static IPs here.
service network restart
ping www.yahoo.com Verify a response
# Turn off Kernel SharedPages Memory
chkconfig ksm off
chkconfig ksmtuned off
# Turn off PC Smart Card daemon
chkconfig pcscd off
# Copy care package
scp -pr <SERVER>:/opt/sw/newServerCarePackage /root Get all the files we will need
cat /root/newServerCarePackage >> /etc/hosts
nano /etc/hosts Remove unneeded and duplicate line items. If this server's name was appended, comment it out.
scp -pr <SERVER>:/opt/scripts /opt
# Link to bash startup script
cd /etc/profile.d
ln -s /opt/scripts/bash_completion.sh
# Stop unused services
/opt/script/stopUnusedServices.sh
# If you are not using LVM
chkconfig lvm2-monitor off
mkdir /opt/sw
cp -R /root/newServerCarePackage/sw /opt
# Disable IPV6
nano /etc/sysconfig/network Add the line: NETWORKING_IPV6=no
nano /etc/sysconfig/network-scripts/ifcfg-eth0 Add the line: IPV6INIT=no
Add the line: IPV6_AUTOCONF=no
nano /etc/modprobe.d/blacklist.conf Add the line: blacklist ipv6
echo "install ipv6 /bin/true" > /etc/modprobe.d/ipv6.dave.conf
service network restart
rmmod ipv6
# Setup Webmin
rpm -ivh /opt/sw/webmin-<version>.noarch.rpm
# Reboot
reboot
yum -y root
reboot
# Setup bridge network
cat /root/newServerCarePackage/ifcfg-eth0 >> /etc/sysconfig/network-scripts/ifcfg-eth0
cp /root/newServerCarePackage/ifcfg-br0 >> /etc/sysconfig/network-scripts/
nano /etc/sysconfig/network-scripts/ifcfg-br0 Configure your static IP.
nano /etc/sysconfig/network-scripts/ifcfg-eth0 Update the correct HWADDR line. Delete the original ifcfg-eth0 lines.
service network restart You should see a "bridge br0 does not exist" error. This ok.
service network restart Now make sure there are no errors.
AI prompt
Generate a Bash script for the task “New CentOS server — first-boot runbook”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Install and configure VNC
Adds INPUT ACCEPT rules to /etc/sysconfig/iptables for the listed TCP ports.
Commands
yum -y install vnc-server
nano /etc/sysconfig/vncservers
VNCSERVERS="1:root" Add these two lines
VNCSERVERARGS[1]="-geometry 1280x960 -depth 16"
vncserver Type in a password when prompted
# Update IPtables
nano /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT Add these two lines
-A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT
# Optional
yum -y install ifstat
# Optional
yum -y install sysstat
reboot
AI prompt
Generate a Bash script for the task “Install and configure VNC”. Given a list of TCP ports, insert matching -A INPUT -m state --state NEW -p tcp --dport <port> -j ACCEPT lines before the reject rule and reload iptables. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
VirtualMin
Manages the Postfix mail queue — inspect it, delete all or just the deferred queue, and trace a message by its queue ID.
Commands
usermod -a -G sasl postfix Needed for bug in install script.
/etc/init.d/saslauthd restart; /etc/init.d/postfix restart
AI prompt
Generate a Bash script for the task “VirtualMin”. Provide mailq, postsuper -d ALL / postsuper -d ALL deferred, and postcat -q <id> | grep -i auth, with a guard prompt before any bulk delete. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Install Tiger VNC server
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Commands
yum install tigervnc-server
cp /lib/systemd/system/vncserver@.service /etc/systemd/system/vncserver@:
1.service
nano /etc/systemd/system/vncserver@:1.service
firewall-cmd --permanent --zone=public --add-service vnc-server
firewall-cmd --reload
su - <USER>
# Start VNC, input a password, then kill :1 to end VNC server
systemctl daemon-reload
systemctl enable vncserver@:1.service
reboot
AI prompt
Generate a firewalld command sequence for the task “Install Tiger VNC server”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup a new SAMBA server
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Commands
yum install samba samba-client samba-common
yum install system-config-samba
useradd <SMB_USER>
less /etc/group
usermod -a -G <SMB_USER> <USER>
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload
cd /etc/samba/
less smb.conf
smbpasswd <USER>
smbpasswd
smbpasswd -h
smbpasswd -a <USER>
systemctl start smb
systemctl start nmb
cd /var/log/samba/
less log.nmbd
less log.smbd
chown -R <SMB_USER>:<SMB_USER> /fourtb/sw
chmod -R g+rw,u+rw /fourtb/sw
usermod -a -G <SMB_USER> <SMB_USER>
chcon -R -t samba_share_t the_share_directory
setsebool -P samba_enable_home_dirs=1
# Try connecting as a client
smbclient -L localhost –U <USER>
AI prompt
Generate a firewalld command sequence for the task “Setup a new SAMBA server”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certs
Certificate format conversions with openssl and keytool — PEM, DER, PKCS#12, JKS.
6 tasks
Cert to PEM
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
openssl x509 -in aps_development.cer -inform DER -out aps_development.pem -outform PEM
# P12 to cert
openssl pkcs12 -in aps_development.p12 -out certificate.cer -nodes
# Linux p12 to pem
openssl pkcs12 -in aps_development.p12 -out aps_development.pem -nodes -clcerts
AI prompt
Generate an openssl command sequence for the task “Cert to PEM”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
View Certificates
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Generate an openssl command sequence for the task “View Certificates”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Certificate format conversion”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Get an Apple iOS cert first
Steps to export an Apple Push (APNs) certificate and private key from Keychain Access as a .p12 and import it on Windows for a .NET app.
Commands
# Get an Apple Push cert
To get a p12 file, go to KeychainAccess and select the Apple Development Push Services: xxx
Select both the certificate and the private key (by opening the triangle to the left of the cert name)
Copy p12 to Windows and import into Personal and Trusted Root Certification Authorities stores.
Now use Visual Studio to read the .cer file from Apple (remember the password needs to be placed in the app for the cert to open properly).
AI prompt
Generate a step-by-step runbook for the task “Get an Apple iOS cert first”. Turn the checklist into an ordered runbook: export from Keychain (cert + key), convert to PKCS#12, import into the Windows stores, and load the .cer with its passphrase. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Keystore for FusionAuth
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
Ensure the passwords you use are all the same
openssl pkcs12 -export -in /home/<USER>/ssl.cert -inkey /home/<USER>/ssl.key -out ssl.p12
/usr/local/fusionauth/java/current/bin/keytool -importkeystore -srckeystore ssl.p12 -srcstoretype PKCS12 -destkeystore keystore -deststoretype JKS
AI prompt
Generate an openssl command sequence for the task “Keystore for FusionAuth”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
svn
Subversion server setup, per-repository backup/restore, SVN Edge TLS, and SVN→Git migration.
12 tasks
To setup a new subversion server
Stands up an Apache-backed Subversion server on RHEL/CentOS — packages, the mod_dav_svn config, the auth file, the repo root and the firewall port.
Commands
scp -P 2227 /etc/httpd/conf.d/subversion.conf localhost:/etc/httpd/conf.d localhost
# As root
scp -P 2227 /etc/svn-serve.conf localhost:/etc
scp -P 2227 /etc/svn-auth-file localhost:/etc
# On new server as root
yum -y install subversion
yum -y install mod_dav_svn
chmod /etc/svn-auth-file 644
chmod /etc/svn-serve.conf 640
chown root.apache /etc/svn-serve.conf
mkdir /var/svn
Open port 443 in IP Tables
Set the ServerName directive to the hostname in /etc/httpd/conf/httpd.conf
# Add users to svn
htpasswd -m /etc/svn-auth-file <USER> Use -c if you are creating this file
# Set repository directory ACLs (if needed)
nano /etc/svnserve.conf
svn checkout https://<SVN_HOST>/svn/opt-scripts scripts Must be the same as the server's ServerName directive
AI prompt
Generate a Bash script for the task “To setup a new subversion server”. Parameterise the repo root and ServerName; install subversion + mod_dav_svn, drop in subversion.conf, create the htpasswd auth file, open 443, and create /var/svn. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Dump all repositories
Iterates over Subversion repositories to dump each to a dated backup file and reload them onto another server, plus one-off checkout / create helpers.
Commands
for file in /var/svn/*; do if [[ -d "$file" ]]; then echo "$file"; fi; done
for file in `find /var/svn -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do echo "$file"; done
for file in `find /opt/csvn/data/repositories -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do svnadmin dump "/opt/csvn/data/repositories/$file" > "/opt/csvn/data/dumps/$file.$HOSTNAME.`date +%y%m%d`.svn"; done
# Echo the result (for testing)
for file in `find /opt/csvn/data/repositories -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do echo "/opt/csvn/data/repositories/$file > /opt/csvn/data/dumps/$file.$HOSTNAME.`date +%y%m%d`.svn"; done
# To get just the repository names for a restore
for file in `ls -1`; do echo ${file%".<SVN_HOST>.180409.dmp"}; done
# To restore from the contents of a whole directory
for file in `ls -1 /opt/csvn/data/dumps`; do echo ${file%".<SVN_HOST>.180409.dmp"}; /opt/scripts/svnRepositoryFunctions.sh create ${file%".<SVN_HOST>.180409.dmp"};svnadmin load /opt/csvn/data/repositories/${file%".<SVN_HOST>.180409.dmp"} < /opt/csvn/data/dumps/${file}; done
for file in /var/svn/*; do if [[ -d "$file" ]]; then svnadmin dump "$file" > "$file.$HOSTNAME.`date +%y%m%d`.svn"; fi; done
# To load the repository
/opt/scripts/svnRepositoryFunctions.sh create MyRepo;svnadmin load /opt/csvn/data/repositories/ < /opt/csvn/data/dumps/<SVN_HOST>.MyRepo.180409.dmp
for file in /opt/csvn/data/dumps/*; do if [[ -d "$file" ]]; then svnadmin dump "$file" > "$file.$HOSTNAME.`date +%y%m%d`.dmp"; fi; done
cd /opt/csvn/data/repositories; export PATH=$PATH:/opt/csvn/bin # Start here for a full restore of everything in the /opt/csvn/data/dumps directory.
for file in /opt/csvn/data/dumps/*; do myfile="${file:25}"; echo "${myfile%.*}"; done
for file in /opt/csvn/data/dumps/*; do myfile="${file:21}"; repo="${myfile%.<SVN_HOST>.200622.dmp}"; svnadmin create $repo; svnadmin load /opt/csvn/data/repositories/$repo < $file; done
file:21 if name is svn, else 25 for svnedge as the server name prefix.
Date 180409 180409
IP <INTERNAL_IP>
Repository name MyRepo <SVN_HOST>.MyRepo.180409.dmp
Existing server name <SVN_HOST> <SVN_HOST>.180409.dmp
Path to existing repository /opt/csvn/data/repositories /opt/csvn/data/repositories/
Path to dump existing repository to /opt/csvn/data/dumps /opt/csvn/data/dumps/
Path to dump files on new server /opt/csvn/data/dumps /opt/csvn/data/dumps/<SVN_HOST>.MyRepo.180409.dmp
Path to SVN repository on new server /opt/csvn/data/repositories /opt/csvn/data/repositories/
AI prompt
Generate a Bash script for the task “Dump all repositories”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup certs for SVN Edge
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
# Convert the Apache certificate into PKCS#12 format
openssl pkcs12 -export -in /opt/<SVN_HOST>/<GROUP>.com.crt -inkey /opt/<SVN_HOST>/<GROUP>.com.key -name svnedge -out /opt/<SVN_HOST>/<GROUP>.com.p12
AI prompt
Generate an openssl command sequence for the task “Setup certs for SVN Edge”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
# Convert the Apache certificate into PKCS#12 format when using intermediate certificates
openssl pkcs12 -export -in /opt/<SVN_HOST>/<GROUP>.com.crt -inkey /opt/<SVN_HOST>/<GROUP>.com.key -name svnedge -certfile /opt/<SVN_HOST>/gd_bundle-g2.crt -out /opt/<SVN_HOST>/<GROUP>.com.p12
AI prompt
Generate an openssl command sequence for the task “Certificate format conversion”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion (2)
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
# For SVN Edge - use svnedge as the password. It's the default for SVN Edge.
#${JAVA_HOME}/bin/keytool -importkeystore -srckeystore /opt/<SVN_HOST>/<GROUP>.com.p12 -srcstoretype PKCS12 -destkeystore /opt/csvn/data/conf/svnedge.jks
${JAVA_HOME}/bin/keytool -importkeystore -srckeystore /opt/<SVN_HOST>/<GROUP>.com.p12 -srcstoretype PKCS12 -destkeystore /opt/csvn/appserver/etc/svnedge.jks
AI prompt
Generate an openssl command sequence for the task “Certificate format conversion (2)”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion repository backup & restore
Iterates over Subversion repositories to dump each to a dated backup file and reload them onto another server, plus one-off checkout / create helpers.
Generate a Bash script for the task “Subversion repository backup & restore”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion Edge certificate creation and install.
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Subversion Edge certificate creation and install”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion repository backup & restore (2)
Iterates over Subversion repositories to dump each to a dated backup file and reload them onto another server, plus one-off checkout / create helpers.
Generate a Bash script for the task “Subversion repository backup & restore (2)”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generate password for svnedge-ssl.xml in appserver dir
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Commands
openssl pkcs8 -topk8 -nocrypt -in <GROUP>.com.pem -inform PEM -out key.der -outform DER
openssl x509 -in <GROUP>.com.pem -inform PEM -out cert.der -outform DER
cat /root/keystore.ImportKey > /opt/csvn/appserver/etc/svnedge.jks
java -cp lib/jetty-http-8.1.9.v20130131.jar:lib/jetty-util-8.1.9.v20130131.jar org.eclipse.jetty.util.security.Password importkey
Edit the svnedge-ssl.xml with the OBF: password returned
AI prompt
Generate an openssl command sequence for the task “Generate password for svnedge-ssl.xml in appserver dir”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion → Git migration (collect authors)
Migrates a Subversion repository to Git with git svn, converting remote tag/branch refs into real Git tags and branches and pushing to a new origin.
Commands
<GROUP>.com 1
# Get all of the users from svn
svn log --xml --quiet | grep author | sort -u | perl -pe 's/.*>(.*?)<.*/$1 = /'
AI prompt
Generate a Bash script for the task “Subversion → Git migration (collect authors)”. Take the SVN URL, an authors file and the new Git remote; run git svn clone --stdlayout --no-metadata, rewrite refs/remotes/tags and branches, then git push --all --tags. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion → Git migration (git svn clone)
Migrates a Subversion repository to Git with git svn, converting remote tag/branch refs into real Git tags and branches and pushing to a new origin.
Commands
# https://git-scm.com/book/en/v2/Git-and-Other-Systems-Migrating-to-Git
git svn clone https://<SVN_HOST>/svn/<GROUP>.com --authors-file=users.txt --no-metadata --prefix="" --stdlayout
cd <GROUP>.com
#git svn show-ignore > .gitignore
for t in $(git for-each-ref --format='%(refname:short)' refs/remotes/tags); do git tag ${t/tags\//} $t && git branch -D -r $t; done
for b in $(git for-each-ref --format='%(refname:short)' refs/remotes); do git branch $b refs/remotes/$b && git branch -D -r $b; done
#git branch -d trunk
git remote add origin https://github.com/<GROUP>/<GROUP>.com.git
git branch -d git-svn
git push origin --all
git push origin --tags
cd ..
AI prompt
Generate a Bash script for the task “Subversion → Git migration (git svn clone)”. Take the SVN URL, an authors file and the new Git remote; run git svn clone --stdlayout --no-metadata, rewrite refs/remotes/tags and branches, then git push --all --tags. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Per-repository backup & restore
Iterates over Subversion repositories to dump each to a dated backup file and reload them onto another server, plus one-off checkout / create helpers.
Commands
# One row per Subversion repository — checkout, create, dump, restore.
svn checkout https://<SVN_HOST>/svn/<repo> .
/opt/scripts/svnRepositoryFunctions.sh create <repo>
svnadmin create <repo>
svnadmin dump /opt/csvn/data/repositories/<repo> > /opt/csvn/data/dumps/<repo>.<date>.dmp
svnadmin create <repo>; svnadmin load /opt/csvn/data/repositories/<repo> < /opt/csvn/data/dumps/<repo>.<date>.dmp
# … the source workbook lists 128 repositories following this exact pattern.
AI prompt
Generate a Bash script for the task “Per-repository backup & restore”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
WordPress
Moving a WordPress site between domains and fixing MySQL bind errors.
3 tasks
Move a WordPress site to a new domain
Rewrites a WordPress site's URL directly in the database — home/siteurl, post GUIDs and inlined links in post content.
Commands
UPDATE wp_options SET option_value = replace(option_value, 'http://www.<OLD_DOMAIN>', 'http://<NEW_DOMAIN>') WHERE option_name = 'home' OR option_name = 'siteurl';
UPDATE wp_posts SET guid = replace(guid, 'http://www.<OLD_DOMAIN>','http://<NEW_DOMAIN>');
UPDATE wp_posts SET post_content = replace(post_content, 'http://www.<OLD_DOMAIN>', 'http://<NEW_DOMAIN>');
AI prompt
Generate the SQL statements for the task “Move a WordPress site to a new domain”. Take the old and new base URLs and the table prefix; emit the three UPDATE statements against wp_options and wp_posts, and warn that GUIDs should normally stay frozen. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
MySQL account & privilege management
Creates a MySQL account for a given host pattern and grants it privileges (and shows how to drop it or reset its password).
Commands
root Remote Host: <INTERNAL_IP> Password: <DB_PASSWORD>
GRANT ALL PRIVILEGES ON *.* TO root@<INTERNAL_IP> identified by '<DB_PASSWORD>' WITH GRANT OPTION
AI prompt
Generate the SQL statements for the task “MySQL account & privilege management”. Take username, host pattern (e.g. %, 192.168.%, host.domain) and database scope; emit CREATE USER … IDENTIFIED BY, the matching GRANT, and FLUSH PRIVILEGES. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Error starting MySQL
Edits the MySQL server config (my.cnf) — bind address or InnoDB buffer size — to fix a startup or locking error.
Commands
Edit /etc/mysql/my.conf Change bind-address to servers address
AI prompt
Generate the config snippet for the task “Error starting MySQL”. Show the [mysqld] keys to set (bind-address, innodb_buffer_pool_size), where the file lives on Debian vs RHEL, and the restart command. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.