This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
To setup a new subversion server
Stands up an Apache-backed Subversion server on RHEL/CentOS — packages, the mod_dav_svn config, the auth file, the repo root and the firewall port.
Commands
scp -P 2227 /etc/httpd/conf.d/subversion.conf localhost:/etc/httpd/conf.d localhost
# As root
scp -P 2227 /etc/svn-serve.conf localhost:/etc
scp -P 2227 /etc/svn-auth-file localhost:/etc
# On new server as root
yum -y install subversion
yum -y install mod_dav_svn
chmod /etc/svn-auth-file 644
chmod /etc/svn-serve.conf 640
chown root.apache /etc/svn-serve.conf
mkdir /var/svn
Open port 443 in IP Tables
Set the ServerName directive to the hostname in /etc/httpd/conf/httpd.conf
# Add users to svn
htpasswd -m /etc/svn-auth-file <USER> Use -c if you are creating this file
# Set repository directory ACLs (if needed)
nano /etc/svnserve.conf
svn checkout https://<SVN_HOST>/svn/opt-scripts scripts Must be the same as the server's ServerName directive
AI prompt
Generate a Bash script for the task “To setup a new subversion server”. Parameterise the repo root and ServerName; install subversion + mod_dav_svn, drop in subversion.conf, create the htpasswd auth file, open 443, and create /var/svn. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Dump all repositories
Iterates over Subversion repositories to dump each to a dated backup file and reload them onto another server, plus one-off checkout / create helpers.
Commands
for file in /var/svn/*; do if [[ -d "$file" ]]; then echo "$file"; fi; done
for file in `find /var/svn -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do echo "$file"; done
for file in `find /opt/csvn/data/repositories -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do svnadmin dump "/opt/csvn/data/repositories/$file" > "/opt/csvn/data/dumps/$file.$HOSTNAME.`date +%y%m%d`.svn"; done
# Echo the result (for testing)
for file in `find /opt/csvn/data/repositories -mindepth 1 -maxdepth 1 -type d -printf "%f\n"`; do echo "/opt/csvn/data/repositories/$file > /opt/csvn/data/dumps/$file.$HOSTNAME.`date +%y%m%d`.svn"; done
# To get just the repository names for a restore
for file in `ls -1`; do echo ${file%".<SVN_HOST>.180409.dmp"}; done
# To restore from the contents of a whole directory
for file in `ls -1 /opt/csvn/data/dumps`; do echo ${file%".<SVN_HOST>.180409.dmp"}; /opt/scripts/svnRepositoryFunctions.sh create ${file%".<SVN_HOST>.180409.dmp"};svnadmin load /opt/csvn/data/repositories/${file%".<SVN_HOST>.180409.dmp"} < /opt/csvn/data/dumps/${file}; done
for file in /var/svn/*; do if [[ -d "$file" ]]; then svnadmin dump "$file" > "$file.$HOSTNAME.`date +%y%m%d`.svn"; fi; done
# To load the repository
/opt/scripts/svnRepositoryFunctions.sh create MyRepo;svnadmin load /opt/csvn/data/repositories/ < /opt/csvn/data/dumps/<SVN_HOST>.MyRepo.180409.dmp
for file in /opt/csvn/data/dumps/*; do if [[ -d "$file" ]]; then svnadmin dump "$file" > "$file.$HOSTNAME.`date +%y%m%d`.dmp"; fi; done
cd /opt/csvn/data/repositories; export PATH=$PATH:/opt/csvn/bin # Start here for a full restore of everything in the /opt/csvn/data/dumps directory.
for file in /opt/csvn/data/dumps/*; do myfile="${file:25}"; echo "${myfile%.*}"; done
for file in /opt/csvn/data/dumps/*; do myfile="${file:21}"; repo="${myfile%.<SVN_HOST>.200622.dmp}"; svnadmin create $repo; svnadmin load /opt/csvn/data/repositories/$repo < $file; done
file:21 if name is svn, else 25 for svnedge as the server name prefix.
Date 180409 180409
IP <INTERNAL_IP>
Repository name MyRepo <SVN_HOST>.MyRepo.180409.dmp
Existing server name <SVN_HOST> <SVN_HOST>.180409.dmp
Path to existing repository /opt/csvn/data/repositories /opt/csvn/data/repositories/
Path to dump existing repository to /opt/csvn/data/dumps /opt/csvn/data/dumps/
Path to dump files on new server /opt/csvn/data/dumps /opt/csvn/data/dumps/<SVN_HOST>.MyRepo.180409.dmp
Path to SVN repository on new server /opt/csvn/data/repositories /opt/csvn/data/repositories/
AI prompt
Generate a Bash script for the task “Dump all repositories”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Setup certs for SVN Edge
Converts the Apache certificate and key into a PKCS#12 file with the svnedge alias for Subversion Edge.
Commands
# Convert the Apache certificate into PKCS#12 format
openssl pkcs12 -export -in /opt/<SVN_HOST>/<GROUP>.com.crt -inkey /opt/<SVN_HOST>/<GROUP>.com.key -name svnedge -out /opt/<SVN_HOST>/<GROUP>.com.p12
AI prompt
Generate an openssl command sequence for the task “Setup certs for SVN Edge”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion
Builds the SVN Edge PKCS#12 file including the intermediate chain, for certificates issued through an intermediate CA.
Commands
# Convert the Apache certificate into PKCS#12 format when using intermediate certificates
openssl pkcs12 -export -in /opt/<SVN_HOST>/<GROUP>.com.crt -inkey /opt/<SVN_HOST>/<GROUP>.com.key -name svnedge -certfile /opt/<SVN_HOST>/gd_bundle-g2.crt -out /opt/<SVN_HOST>/<GROUP>.com.p12
AI prompt
Generate an openssl command sequence for the task “Certificate format conversion”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion (2)
Imports the PKCS#12 file into SVN Edge’s Java keystore with keytool, using SVN Edge’s default password.
Commands
# For SVN Edge - use svnedge as the password. It's the default for SVN Edge.
#${JAVA_HOME}/bin/keytool -importkeystore -srckeystore /opt/<SVN_HOST>/<GROUP>.com.p12 -srcstoretype PKCS12 -destkeystore /opt/csvn/data/conf/svnedge.jks
${JAVA_HOME}/bin/keytool -importkeystore -srckeystore /opt/<SVN_HOST>/<GROUP>.com.p12 -srcstoretype PKCS12 -destkeystore /opt/csvn/appserver/etc/svnedge.jks
AI prompt
Generate an openssl command sequence for the task “Certificate format conversion (2)”. Parameterise the PKCS#12 path and the SVN Edge install directory; back up the existing svnedge.jks, import with keytool -importkeystore, and restart SVN Edge. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SVN Edge Apache SSL directives
The Apache SSL directives that point SVN Edge at the certificate, key and intermediate chain.
Generate a Bash script for the task “SVN Edge Apache SSL directives”. Parameterise the certificate, key and chain paths; write the SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile lines into SVN Edge’s Apache config and check it with apachectl configtest before restarting. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion Edge certificate creation and install.
End-to-end SVN Edge certificate install: builds the PKCS#12 with its chain, recreates svnedge.jks with keytool, and copies it into the app server.
Generate an openssl command sequence for the task “Subversion Edge certificate creation and install”. Parameterise the certificate files and SVN Edge directory; build the PKCS#12 with the chain, back up and recreate svnedge.jks, copy it into appserver/etc, and restart SVN Edge. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
SVN Edge private key and PKCS#12 install
Copies the PKCS#12 file into SVN Edge’s config directory and writes an unencrypted copy of the private key as server.key.
Generate a Bash script for the task “SVN Edge private key and PKCS#12 install”. Parameterise the certificate name and SVN Edge data directory; copy the PKCS#12 into data/conf, write the decrypted key with openssl rsa, and set the key file to mode 600, owned by the SVN Edge user. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Generate password for svnedge-ssl.xml in appserver dir
Converts the PEM key and certificate to DER for import, writes the keystore into place, and generates the obfuscated OBF: password Jetty needs in svnedge-ssl.xml.
Commands
openssl pkcs8 -topk8 -nocrypt -in <GROUP>.com.pem -inform PEM -out key.der -outform DER
openssl x509 -in <GROUP>.com.pem -inform PEM -out cert.der -outform DER
cat /root/keystore.ImportKey > /opt/csvn/appserver/etc/svnedge.jks
java -cp lib/jetty-http-8.1.9.v20130131.jar:lib/jetty-util-8.1.9.v20130131.jar org.eclipse.jetty.util.security.Password importkey
Edit the svnedge-ssl.xml with the OBF: password returned
AI prompt
Generate an openssl command sequence for the task “Generate password for svnedge-ssl.xml in appserver dir”. Parameterise the PEM file and the SVN Edge app server directory; convert the key (openssl pkcs8 -topk8 -nocrypt) and certificate to DER, install the keystore, run Jetty’s Password utility to produce the OBF: string, and show where it goes in svnedge-ssl.xml. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion → Git migration (collect authors)
Lists every author in the Subversion log as the start of a users.txt mapping file for git svn.
Commands
<GROUP>.com 1
# Get all of the users from svn
svn log --xml --quiet | grep author | sort -u | perl -pe 's/.*>(.*?)<.*/$1 = /'
AI prompt
Generate a Bash script for the task “Subversion → Git migration (collect authors)”. Take the SVN URL and an email domain; collect the unique authors from svn log --xml --quiet and write a users.txt with one svnuser = Name <email> line each, ready for git svn clone --authors-file. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Subversion → Git migration (git svn clone)
Migrates a Subversion repository to Git with git svn, converting remote tag/branch refs into real Git tags and branches and pushing to a new origin.
Commands
# https://git-scm.com/book/en/v2/Git-and-Other-Systems-Migrating-to-Git
git svn clone https://<SVN_HOST>/svn/<GROUP>.com --authors-file=users.txt --no-metadata --prefix="" --stdlayout
cd <GROUP>.com
#git svn show-ignore > .gitignore
for t in $(git for-each-ref --format='%(refname:short)' refs/remotes/tags); do git tag ${t/tags\//} $t && git branch -D -r $t; done
for b in $(git for-each-ref --format='%(refname:short)' refs/remotes); do git branch $b refs/remotes/$b && git branch -D -r $b; done
#git branch -d trunk
git remote add origin https://github.com/<GROUP>/<GROUP>.com.git
git branch -d git-svn
git push origin --all
git push origin --tags
cd ..
AI prompt
Generate a Bash script for the task “Subversion → Git migration (git svn clone)”. Take the SVN URL, an authors file and the new Git remote; run git svn clone --stdlayout --no-metadata, rewrite refs/remotes/tags and branches, then git push --all --tags. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Per-repository backup & restore
The per-repository pattern for checkout, create, dump and restore, repeated for each of the 128 repositories in the source workbook.
Commands
# One row per Subversion repository — checkout, create, dump, restore.
svn checkout https://<SVN_HOST>/svn/<repo> .
/opt/scripts/svnRepositoryFunctions.sh create <repo>
svnadmin create <repo>
svnadmin dump /opt/csvn/data/repositories/<repo> > /opt/csvn/data/dumps/<repo>.<date>.dmp
svnadmin create <repo>; svnadmin load /opt/csvn/data/repositories/<repo> < /opt/csvn/data/dumps/<repo>.<date>.dmp
# … the source workbook lists 128 repositories following this exact pattern.
AI prompt
Generate a Bash script for the task “Per-repository backup & restore”. Parameterise the repositories root, the dumps dir and the server-name prefix; loop over each repo dir, svnadmin dump to <repo>.<host>.<date>.dmp, and provide the create+load restore loop. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.