This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
Open / close firewalld ports
Opens or closes ports and services in firewalld's permanent configuration and reloads the runtime ruleset.
Generate a firewalld command sequence for the task “Open / close firewalld ports”. Accept zone, and lists of ports/services to add and to remove; apply them with firewall-cmd --permanent, reload at the end, and print --list-all for confirmation. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Remove rich rule
Removes previously added rich rules (a source-restricted MySQL port, an HTTPS allowance), adds a drop rule for a source address, and restarts firewalld.
Commands
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="<INTERNAL_IP>" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="<IP>" service name="https" accept'
# Firewall-cmd to block source IP address
firewall-cmd --permanent --zone="public" --add-rich-rule='rule family="ipv4" source address="<IP>" drop'
systemctl restart firewalld.service
AI prompt
Generate a firewalld command sequence for the task “Remove rich rule”. Take the zone and the exact rich-rule strings to remove; list the current rules with firewall-cmd --list-rich-rules, remove each match with firewall-cmd --permanent --remove-rich-rule, report any that were not present, and reload rather than restart the service. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Block source addresses in firewalld
Adds permanent firewalld rich rules that drop all traffic from one or more source addresses, then reloads the firewall.
Generate a firewalld command sequence for the task “Block source addresses in firewalld”. Accept a list of CIDR ranges, emit one permanent firewall-cmd --add-rich-rule per entry that drops the source, and finish with firewall-cmd --reload; make re-runs safe. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
IP set commands
Creates firewalld ipsets from files of networks (a drop set and a trusted set), loads their entries, and binds each ipset to the matching zone.
Generate a firewalld command sequence for the task “IP set commands”. Take a set name, a hash:net type, and a path to an entries file; create the ipset if missing, sync entries from the file, bind it to a zone, and reload — all idempotent. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generally useful commands
Tidies a zone’s permanent rules — closes the passive-FTP and high port ranges, removes the ftp service, opens a single admin port — then reloads and lists the result.
Generate a firewalld command sequence for the task “Generally useful commands”. Take the zone plus lists of ports and services to close and to open; apply each with firewall-cmd --permanent, skip entries already in the desired state, reload, and print --list-all before and after for comparison. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Open / close firewalld ports (2)
Removes the rich rules that opened PostgreSQL (5432) and port 9011 to every IPv4 source.
Commands
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" port port="5432" protocol="tcp" accept"
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" port port="9011" protocol="tcp" accept"
AI prompt
Generate a firewalld command sequence for the task “Open / close firewalld ports (2)”. Take a list of TCP ports; for each, remove the matching rule family="ipv4" port port=… protocol="tcp" accept rich rule with firewall-cmd --permanent --remove-rich-rule, report rules that were not present, and reload. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.