This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
Auto complete without case
Makes bash tab-completion case-insensitive through readline.
Commands
set completion-ignore-case on
AI prompt
Generate a Bash script for the task “Auto complete without case”. Show adding set completion-ignore-case on to ~/.inputrc (or /etc/inputrc for all users) and reloading with bind -f. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Default to graphical start
Enables, disables or restarts system services (systemd, SysV chkconfig, or update-rc.d) as part of host setup or hardening.
Commands
systemctl set-default graphical.target
AI prompt
Generate a Bash script for the task “Default to graphical start”. Take a service name and desired state; use systemctl enable --now / disable on systemd and fall back to chkconfig / update-rc.d, reporting the resulting status. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
To add a <PROJECT> repository
Checks out a Subversion working copy over HTTPS and strips any stray .svn metadata directories left behind by an old export.
Generate a Bash script for the task “To add a <PROJECT> repository”. Take the repository URL and a target directory; run svn checkout <url> <dir> and optionally find -iname '*.svn' -exec rm -rf {} +. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Rsync examples
Mirrors files between two paths — locally or over SSH — with rsync, preserving modification times and permissions and optionally deleting extra files at the destination.
Generate a Bash script for the task “Rsync examples”. Parameterise the source and destination (host, user, path), keep --times --perms --links, make --delete opt-in, and echo the full rsync command before executing it. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Create Boot USB on a Mac
Uses diskutil and dd on macOS to identify a removable disk, unmount it, and image it to a file or write an image (e.g. a Raspberry Pi card) back to it.
Generate a Bash script for the task “Create Boot USB on a Mac”. Take the disk identifier and an image path; diskutil list, diskutil unmountDisk, then dd in the requested direction using the raw device — and refuse to run without an explicit disk id. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
NFS for clients
Installs the OS packages and language libraries this component needs (apt/yum/brew plus pip/npm), on Raspberry Pi OS, CentOS or macOS.
Commands
yum install nfs-utils nfs-utils-lib
AI prompt
Generate a Bash script for the task “NFS for clients”. Take the package list and package manager; run a single non-interactive install, then print the installed versions of the key tools. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Mount an NTFS partition
Mounts a remote CIFS/SMB share, an NFS export or an ISO image onto a local mount point (and remounts the root filesystem read-write).
Commands
mount -t cifs //<INTERNAL_IP>/Public /mnt/usb -o username=<USER>
# Remount a read-only file system
mount -no remount,rw /
# Mount an ISO file
mount -o loop TheISOfilename.iso /mnt/usb
AI prompt
Generate a Bash script for the task “Mount an NTFS partition”. Take the source (share path, export or .iso), the mount point and credentials; pick the right mount -t cifs|-o loop|nfs invocation and create the mount point if needed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
New CentOs7 post install
Moves SSH to a custom port on a new CentOS 7 host: copies the firewalld ssh service definition, installs the SELinux tools and labels the new port with semanage.
Commands
cp /usr/lib/firewalld/services/ssh.xml .
yum -y install policycoreutils-python
semanage port -a -t ssh_port_t -p tcp 22022
systemctl reload firewalld.service
AI prompt
Generate a Bash script for the task “New CentOs7 post install”. Parameterise the new SSH port; install policycoreutils-python, add the port with semanage port -a -t ssh_port_t, create a firewalld service override for it, update sshd_config, and restart sshd only after sshd -t passes — keeping the old port open until the new one is confirmed. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Test disk speed
Measures sequential write speed by writing 1 GB of zeros with dd, syncing before and after.
Generate a Bash script for the task “Test disk speed”. Take a target directory and a size (default 1 GB); write a temporary file with dd … conv=fdatasync, report the throughput, optionally measure read speed after dropping caches, and always delete the test file. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Samba install - setup directory
Creates a no-login user and home directory for a Samba share, labels it samba_share_t for SELinux, and lists the common smb.conf share settings.
Commands
mkdir /data2/<GROUP>
useradd <GROUP> -d /data2/<GROUP>
chown -R <GROUP>:<GROUP> /data2/<GROUP>
semanage fcontext -a -t samba_share_t '/data2/<GROUP>'
restorecon -R /data2/<GROUP>
Edit /etc/passwd, nano /etc/passwd
<GROUP>:x:1002:1002::/data2/<GROUP>:/sbin/nologin - Set's the user directory to /sbin/nologin so the user cannot SSH to this server
Common /etc/samba/smb.conf entries to a directory share:
write list = <USER>
force user = <SMB_USER>
force group = <SMB_USER>
AI prompt
Generate a Bash script for the task “Samba install - setup directory”. Parameterise the share path, user and group; create the user with /sbin/nologin as its shell, set ownership, add the SELinux fcontext and run restorecon, append a share block with write list / force user / force group to smb.conf, and validate it with testparm. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,pass…
Mounts a Samba share with the username and password passed on the command line.
Commands
mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,password=<SMB_PASSWORD>
AI prompt
Generate a Bash script for the task “mount -t cifs //samba/sw /mnt/usb -o username=<GROUP>,pass…”. Parameterise the share, mount point and username; read the password from a root-only credentials file via credentials= instead of the command line, create the mount point if needed, and show the matching /etc/fstab entry. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup SELinux for directories
Sets SELinux file contexts and booleans so a service (Samba, libvirt, a custom SSH port) can use a directory or port without being denied.
Commands
http://danwalsh.livejournal.com/14195.html Directory to use: /data1/bak
chcon -R -t samba_share_t /data1/bak
semanage fcontext -a -t samba_share_t '/data1/bak(/.*)?'
restorecon -R -v /data1/bak
# share home directories
setsebool -P samba_enable_home_dirs 1
# share public directories
semanage fcontext -a -t public_content_rw_t '/data1/bak(/.*)?'
restorecon -R -v /data1/bak
setsebool -P allow_smbd_anon_write 1
# share public NFS files
setsebool -P samba_share_nfs 1
AI prompt
Generate a Bash script for the task “Setup SELinux for directories”. Take a path and a target type (e.g. samba_share_t, public_content_rw_t); add the fcontext rule, restorecon -Rv, and set any needed boolean with setsebool -P. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Set clock to UTC
Puts the system clock on UTC and enables NTP synchronisation with timedatectl.
Commands
timedatectl set-local-rtc no
timedatectl set-ntp yes
timedatectl set-timezone UTC
AI prompt
Generate a Bash script for the task “Set clock to UTC”. Emit timedatectl set-local-rtc no, set-ntp yes, set-timezone UTC, then timedatectl to confirm. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SSH local forwarding
Forwards a local port through a bastion host with ssh -L to reach an internal machine’s SSH, then connects through the tunnel.
Generate a Bash script for the task “SSH local forwarding”. Parameterise the bastion host, port and key, the internal target host:port and the local port; open the tunnel with ssh -fN -L, connect through localhost, and show the equivalent ProxyJump config. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Serial Port connection
Opens a serial console to a device with minicom on the given tty.
Commands
minicom -D /dev/ttyS0
AI prompt
Generate a Bash script for the task “Serial Port connection”. Take the device path (default /dev/ttyS0) and baud rate and launch minicom -D <dev> -b <baud>. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SSH Connect two machines
Exposes a local port on a remote host with a reverse tunnel (ssh -R), so two machines can reach each other through a shared server.
Commands
On the primary machine: On the client machine:
ssh -R 9000:localhost:3000 -p 22022 <SSH_USER>@<REMOTE_HOST> ssh -R 9000:localhost:22 -p 22022 <SSH_USER>@<REMOTE_HOST>
AI prompt
Generate a Bash script for the task “SSH Connect two machines”. Parameterise the remote host and port and the local and remote ports; open the reverse tunnel with ssh -fN -R, keep it alive with ServerAliveInterval or autossh, and note the GatewayPorts setting needed to expose it beyond localhost. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.