debian-setup.sh

#!/bin/bash
set -e
set -o pipefail

# --- System and Time Configuration ---
# Set system timezone to Tokyo, Japan
sudo timedatectl set-timezone Asia/Tokyo

# Configure hardware clock to use UTC (recommended for Linux)
sudo timedatectl set-local-rtc 0

# Display current time and date settings
timedatectl

# Reference for dual-booting with Windows 11 (requires Windows to use UTC)
# https://gist.github.com/HackingGate/180aafbc6342ad4b1cb31309fa83c91a

# --- Core Package Installation ---
# Update package lists and upgrade the system
sudo apt update
sudo apt upgrade -y

# Remove CLI web browser
sudo apt purge lynx

# Install essential development tools, utilities, and Nvidia dependencies
sudo apt install emacs-nox vim-nox neovim curl wget gh git ripgrep build-essential zsh efibootmgr jq fastfetch htop openssh-client dkms linux-headers-$(uname -r) firmware-misc-nonfree -y

# zsh
chsh -s $(which zsh)

# --- GitHub CLI and Codex CLI Setup ---
# GitHub CLI is installed above as `gh`; run `gh auth login` manually if needed.
gh --version

# Install Node.js LTS with the latest nvm release tag
NVM_TAG=$(git ls-remote --refs --tags --sort='version:refname' https://github.com/nvm-sh/nvm.git 'refs/tags/v*' | awk -F/ 'END { print $NF }')
if [[ -z "$NVM_TAG" ]]; then
  echo "Could not determine latest nvm tag" >&2
  exit 1
fi
curl -o- "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_TAG}/install.sh" | bash
export NVM_DIR="$HOME/.nvm"
. "$NVM_DIR/nvm.sh"
nvm install --lts
nvm use --lts
nvm alias default 'lts/*'
node -v
npm -v

# Install OpenAI Codex CLI through user-level npm
npm install -g @openai/codex
codex --version

# Configure Codex shell commands so gh ignores stale inherited token variables
CODEX_CONFIG="$HOME/.codex/config.toml"
mkdir -p "$(dirname "$CODEX_CONFIG")"
touch "$CODEX_CONFIG"
if grep -Fq '[shell_environment_policy]' "$CODEX_CONFIG"; then
  if ! grep -Fq 'GH_TOKEN' "$CODEX_CONFIG"; then
    echo "Review $CODEX_CONFIG: existing shell_environment_policy should exclude GH_TOKEN and GITHUB_TOKEN."
  fi
else
  cat >> "$CODEX_CONFIG" <<'EOF'

[shell_environment_policy]
exclude = ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"]
EOF
fi

# --- Nvidia Driver Installation (Debian 13 "Trixie" Method) ---
# Support for GeForce 700 series and newer GPUs (Version 550.163.01)
# For older devices, consider Version 535.216.03 or nouveau

# Configure APT sources to include contrib, non-free, and non-free-firmware for drivers
echo "Adding contrib, non-free, and non-free-firmware components to sources..."
sudo tee /etc/apt/sources.list.d/debian.sources > /dev/null <<'EOF'
Types: deb deb-src
URIs: http://deb.debian.org/debian
Suites: trixie
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb deb-src
URIs: http://security.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
EOF

# Check if system uses dracut and configure it for nvidia
if command -v dracut &> /dev/null; then
  echo "System uses dracut - configuring for NVIDIA..."
  sudo mkdir -p /etc/dracut.conf.d
  sudo tee /etc/dracut.conf.d/10-nvidia.conf > /dev/null <<'EOF'
install_items+=" /etc/modprobe.d/nvidia-blacklists-nouveau.conf /etc/modprobe.d/nvidia.conf /etc/modprobe.d/nvidia-options.conf "
EOF
  echo "Dracut configuration for NVIDIA created."
fi

# Update package lists
echo "Updating package lists..."
sudo apt update

# Install linux-headers for current kernel (required for DKMS)
echo "Installing linux headers for kernel $(uname -r)..."
sudo apt install linux-headers-$(uname -r) -y

# Install Nvidia proprietary drivers and DKMS
sudo apt install nvidia-kernel-dkms nvidia-driver firmware-misc-nonfree -y

# Verify DKMS build status
echo "Checking DKMS build status..."
sudo dkms status

# Configure NVIDIA options for Wayland support and suspend/hibernate (if applicable)
echo "Configuring NVIDIA options for Wayland and power management..."

# Enable kernel modesetting for NVIDIA Wayland support
echo "Enabling NVIDIA kernel modesetting for Wayland..."
NVIDIA_GRUB_CONFIG="/etc/default/grub.d/nvidia-modeset.cfg"
NVIDIA_CMDLINE='GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nvidia-drm.modeset=1 nvidia-drm.fbdev=1"'

if [ ! -f "$NVIDIA_GRUB_CONFIG" ]; then
  sudo mkdir -p "$(dirname "$NVIDIA_GRUB_CONFIG")"
  echo "$NVIDIA_CMDLINE" | sudo tee "$NVIDIA_GRUB_CONFIG" > /dev/null
  echo "Created NVIDIA modeset configuration in GRUB"
elif ! grep -q "nvidia-drm.modeset=1" "$NVIDIA_GRUB_CONFIG"; then
  echo "$NVIDIA_CMDLINE" | sudo tee "$NVIDIA_GRUB_CONFIG" > /dev/null
  echo "Updated NVIDIA modeset configuration in GRUB"
else
  echo "NVIDIA modeset configuration already exists in GRUB"
fi

# Configure NVIDIA power management for suspend/hibernate support
echo "Configuring NVIDIA power management..."
NVIDIA_PM_CONFIG="/etc/modprobe.d/nvidia-power-management.conf"
NVIDIA_PM_OPTION="options nvidia NVreg_PreserveVideoMemoryAllocations=1"

if [ ! -f "$NVIDIA_PM_CONFIG" ]; then
  echo "$NVIDIA_PM_OPTION" | sudo tee "$NVIDIA_PM_CONFIG" > /dev/null
  echo "Created NVIDIA power management configuration"
elif ! grep -q "NVreg_PreserveVideoMemoryAllocations=1" "$NVIDIA_PM_CONFIG"; then
  # Remove any existing conflicting line and add the correct one
  sudo sed -i '/NVreg_PreserveVideoMemoryAllocations=/d' "$NVIDIA_PM_CONFIG"
  echo "$NVIDIA_PM_OPTION" | sudo tee -a "$NVIDIA_PM_CONFIG" > /dev/null
  echo "Updated NVIDIA power management configuration"
else
  echo "NVIDIA power management configuration already exists"
fi

# Install and enable NVIDIA suspend/hibernate services
echo "Installing NVIDIA suspend/hibernate support..."
sudo apt install nvidia-suspend-common -y

# Enable NVIDIA power management services
echo "Enabling NVIDIA power management services..."
sudo systemctl enable nvidia-suspend.service 2>/dev/null || echo "nvidia-suspend.service already enabled or not available"
sudo systemctl enable nvidia-hibernate.service 2>/dev/null || echo "nvidia-hibernate.service already enabled or not available"
sudo systemctl enable nvidia-resume.service 2>/dev/null || echo "nvidia-resume.service already enabled or not available"

# Update GRUB configuration to apply kernel modesetting changes
sudo update-grub

# Update the initial ramdisk to include the new drivers
if command -v dracut &> /dev/null; then
  echo "Updating dracut initrd..."
  sudo dracut --regenerate-all --force
else
  echo "Updating initramfs..."
  sudo update-initramfs -u
fi

# Clean up any old, uninstalled Nvidia packages
if dpkg -l | grep -q '^rc.*nvidia'; then
  echo "Purging old Nvidia package configurations..."
  dpkg -l | awk '/^rc/ && /nvidia/ { print $2 }' | xargs sudo apt purge -y
fi

echo "NVIDIA driver installation complete."

# --- Shell and Package Manager Setup ---
# Install Oh My Zsh for a better terminal experience
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

# Install Homebrew package manager for Linux
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
echo >> ~/.zshrc
echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> ~/.zshrc
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
brew install gcc

# Configure Flatpak for application management
sudo apt install flatpak gnome-software-plugin-flatpak -y
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
sudo flatpak update

# --- Desktop Application Installation ---
# Install GNOME Extensions utility and Extension Manager
sudo flatpak install flathub org.gnome.Extensions -y
sudo flatpak install flathub com.mattjakeman.ExtensionManager -y

# Replace Firefox ESR with the latest Flatpak version
# Note: Snap is not installed by default on Debian, so 'snap remove' may be unnecessary.
if command -v snap &> /dev/null; then sudo snap remove firefox; fi
sudo apt purge firefox-esr -y
sudo flatpak install flathub org.mozilla.firefox

# Install Brave browser
sudo apt install curl -y
sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main"|sudo tee /etc/apt/sources.list.d/brave-browser-release.list
sudo apt update
sudo apt install brave-browser -y

# Debloat Brave browser by disabling certain features via policy
sudo mkdir -p /etc/brave/policies/managed/ && sudo chmod 755 /etc/brave/policies/managed/
sudo tee /etc/brave/policies/managed/00_debloat.json > /dev/null << 'EOF'
{
  "TorDisabled": true,
  "BraveRewardsDisabled": true,
  "BraveWalletDisabled": true,
  "BraveVPNDisabled": true,
  "BraveAIChatEnabled": false
}
EOF

# Install Thunderbird email client
sudo flatpak install flathub org.mozilla.Thunderbird

# Set Flatpak Firefox as the default web browser
xdg-settings set default-web-browser org.mozilla.firefox.desktop

# Refresh snap packages if snapd is installed
if command -v snap &> /dev/null; then sudo snap refresh; fi

# --- User Environment and Tool Configuration ---
# Configure Emacs as the default text editor
sudo update-alternatives --set editor /usr/bin/emacs
echo '
# Set default editor to Emacs
export EDITOR="/usr/bin/emacs"
export VISUAL="/usr/bin/emacs"
' >> ~/.zshrc

# Install 1Password password manager (CLI)
# https://developer.1password.com/docs/cli/get-started/
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg && \
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/$(dpkg --print-architecture) stable main" | \
sudo tee /etc/apt/sources.list.d/1password.list && \
sudo mkdir -p /etc/debsig/policies/AC2D62742012EA22/ && \
curl -sS https://downloads.1password.com/linux/debian/debsig/1password.pol | \
sudo tee /etc/debsig/policies/AC2D62742012EA22/1password.pol && \
sudo mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22 && \
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
sudo gpg --dearmor --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg && \
sudo apt update && sudo apt install 1password-cli

# Install 1Password password manager (Desktop)
# https://support.1password.com/install-linux/#debian-or-ubuntu
curl -sS https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/amd64 stable main' | sudo tee /etc/apt/sources.list.d/1password.list
sudo mkdir -p /etc/debsig/policies/AC2D62742012EA22/
curl -sS https://downloads.1password.com/linux/debian/debsig/1password.pol | sudo tee /etc/debsig/policies/AC2D62742012EA22/1password.pol
sudo mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22
curl -sS https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg
sudo apt update && sudo apt install 1password -y
op --version

# Setup SSH key from 1Password
mkdir -p ~/.ssh
# Sign in to 1Password CLI
eval "$(op signin)"
# Retrieve and install SSH key with specific fingerprint
echo "Retrieving SSH key with fingerprint SHA256:dsPhhaQhifJccmUhI2ZZIoSnEOUIWYRbSe1TWZs2JuA"
ITEM_ID="mijcwmynssrwh33ad3mknt77fy"
op item get "$ITEM_ID" --format json | jq -r '.fields[] | select(.label == "private key") | .value' > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub
chmod 644 ~/.ssh/id_ed25519.pub
echo "SSH private and public keys saved to ~/.ssh/"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Setup git global configuration
git config --global user.name "HackingGate"
git config --global user.email "i@hackinggate.com"
git config --global core.editor "emacs"
git config --global init.defaultBranch main
git config --global gpg.format ssh
git config --global commit.gpgSign true
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global submodule.recurse true

# Setup 1Password browser integration for Flatpak
# https://gist.github.com/LinuxSBC/7c39374130d2d443871ddde64cba18a3 1password-flatpak-browser-integration.sh
curl -L https://gist.githubusercontent.com/LinuxSBC/7c39374130d2d443871ddde64cba18a3/raw/1password-flatpak-browser-integration.sh -o 1password-flatpak-browser-integration.sh
chmod +x 1password-flatpak-browser-integration.sh
./1password-flatpak-browser-integration.sh

# Auto start 1Password for GNOME Shell
mkdir -p ~/.config/autostart
cat > ~/.config/autostart/1password.desktop << 'EOF'
[Desktop Entry]
Name=1Password
Exec=/usr/bin/1password --silent %U
Terminal=false
Type=Application
Icon=1password
StartupWMClass=1Password
Comment=Password manager and secure wallet
MimeType=x-scheme-handler/onepassword;
Categories=Office;
EOF
chmod +x ~/.config/autostart/1password.desktop
echo "1Password autostart configured"

# --- Networking and System Customization ---
# Install Tailscale for secure networking
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# Install and configure Starship prompt
brew install starship
echo 'eval "$(starship init zsh)"' >> ~/.zshrc

# Install essential fonts including CJK support
sudo apt install -y fonts-firacode fonts-noto fonts-noto-cjk-extra fonts-noto-extra fonts-noto-ui-core fonts-noto-ui-extra fonts-noto-unhinted

# NOTE: The 'mainline' PPA for kernel management is specific to Ubuntu and has been removed.
# For newer kernels on Debian, consider using the 'backports' repository or manual installation.

# Update firmware
sudo fwupdmgr refresh --force
sudo fwupdmgr update -y

# Install rEFInd boot manager
sudo apt install refind -y

# Configure rEFInd boot timeout
echo "Configuring rEFInd timeout to 5 seconds..."
if [ -f /boot/efi/EFI/refind/refind.conf ]; then
  CURRENT_TIMEOUT=$(grep -oP 'timeout \K[0-9]+' /boot/efi/EFI/refind/refind.conf || echo "not set")
  sudo sed -i 's/timeout [0-9]\+/timeout 5/' /boot/efi/EFI/refind/refind.conf
  echo "rEFInd timeout successfully changed from $CURRENT_TIMEOUT to 5 seconds"
else
  echo "Warning: rEFInd configuration file not found at /boot/efi/EFI/refind/refind.conf"
fi

# Configure GRUB boot timeout
echo "Configuring GRUB timeout to 5 seconds..."
if [ -f /etc/default/grub ]; then
  sudo sed -i 's/GRUB_TIMEOUT=[0-9]*/GRUB_TIMEOUT=5/' /etc/default/grub
  sudo update-grub
  echo "GRUB timeout successfully set to 5 seconds"
else
  echo "Warning: GRUB configuration file not found at /etc/default/grub"
fi

# --- GNOME Desktop Tweaks ---
# Enable Emacs keybindings across GTK applications
gsettings set org.gnome.desktop.interface gtk-key-theme "Emacs"

# Enable Emacs daemon for better performance for the current user
systemctl --user enable --now emacs

# Configure Caps Lock as an additional Ctrl key
echo "Setting Caps Lock to function as Ctrl..."
current_options=$(gsettings get org.gnome.desktop.input-sources xkb-options)
if [[ $current_options == "@as []" ]]; then
  gsettings set org.gnome.desktop.input-sources xkb-options "['ctrl:nocaps']"
else
  # Avoid adding if already present
  if [[ $current_options != *"ctrl:nocaps"* ]]; then
    current_options=${current_options:5:-1}
    gsettings set org.gnome.desktop.input-sources xkb-options "[$current_options, 'ctrl:nocaps']"
  fi
fi

echo "--- Debian setup script finished ---"
echo "Please reboot your system to apply all changes, especially for the new drivers and kernel modules."

NetBird firewalld firewall zone

firewall-cmd --zone=trusted --add-interface=wt0 --permanent && firewall-cmd --reload && firewall-cmd --get-active-zones
firewall-cmd --zone=trusted --list-all

Change the priority of GSM network interface

Lower metric values means higher priority.
Interface name is wwu1u1i4 (auto named by systemd-udevd).
Naming breakdown: ww (Wireless Wan) + u1 (USB bus 1) + u1 (Port 1) + i4 (Interface 4) = wwu1u1i4.
Corresponding nmcli con-name is "gsm" if you have created and named to it from device /dev/cdc-wdm0.
Using command like this sudo nmcli connection add type gsm con-name gsm ifname cdc-wdm0.

# Set metric for con gsm
sudo nmcli connection modify gsm ipv4.route-metric "500" ipv6.route-metric "500"
# Reflect changes
sudo nmcli connection up gsm
# Verify metrics
ip -4 route
ip -6 route

# Clear metric for con gsm
sudo nmcli connection modify gsm ipv4.route-metric "" ipv6.route-metric ""
# Reflect changes
sudo nmcli connection up gsm
# Verify metrics
ip -4 route
ip -6 route

Reduce thermal by lock it to 4G LTE or a certain Band

# Check modem number
mmcli -L
# Set it to 4g mode only
sudo mmcli -m 2 --set-allowed-modes='4g' --set-preferred-mode='4g'
# Lock to band 18
sudo mmcli -m 2 --set-current-bands='eutran-18'
# Verify
sudo mmcli -m 2

# Undo
sudo mmcli -m 2 --set-current-bands='any'
sudo mmcli -m 2 --set-allowed-modes='any' --set-preferred-mode='none'

Modem standby

sudo nmcli radio wwan off
nmcli radio

WIFI-HW  WIFI     WWAN-HW  WWAN     
enabled  enabled  enabled  disabled 

Install VS Code and Enable Code Tunnel

sudo apt-get install wget gpg &&
wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg &&
sudo install -D -o root -g root -m 644 microsoft.gpg /usr/share/keyrings/microsoft.gpg &&
rm -f microsoft.gpg

sudo tee /etc/apt/sources.list.d/vscode.sources > /dev/null << 'EOF'
Types: deb
URIs: https://packages.microsoft.com/repos/code
Suites: stable
Components: main
Architectures: amd64,arm64,armhf
Signed-By: /usr/share/keyrings/microsoft.gpg
EOF

sudo apt install apt-transport-https &&
sudo apt update &&
sudo apt install code # or code-insiders

sudo -u $USER code tunnel user login
# Complete login

sudo -u $USER code tunnel service install
sudo loginctl enable-linger $USER

Dev Tools installation

# Cargo rust
curl https://sh.rustup.rs -sSf | sh

# zig
ZIG_VERSION=$(curl -s https://ziglang.org/download/index.json | grep -Eo '"[0-9]+\.[0-9]+\.[0-9]+"' | head -1 | tr -d '"')

# Use -n to check if the variable is NOT empty
if [ -n "$ZIG_VERSION" ]; then
    ZIG_ARCH=$(uname -m)
    wget -O "/tmp/zig-${ZIG_ARCH}-linux-${ZIG_VERSION}.tar.xz" \
      "https://ziglang.org/download/${ZIG_VERSION}/zig-${ZIG_ARCH}-linux-${ZIG_VERSION}.tar.xz"
    tar -xf "/tmp/zig-${ZIG_ARCH}-linux-${ZIG_VERSION}.tar.xz" -C /tmp
    sudo mv "/tmp/zig-${ZIG_ARCH}-linux-${ZIG_VERSION}" "/usr/local/zig-${ZIG_VERSION}"
    sudo ln -sf "/usr/local/zig-${ZIG_VERSION}/zig" "/usr/local/bin/zig"
fi

# Nodejs
# Download and install nvm:
NVM_LATEST_VERSION=$(curl -s https://api.github.com/repos/nvm-sh/nvm/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
echo "Fetching NVM version: $NVM_LATEST_VERSION..."

# Download and install the dynamically found version
curl -o- "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_LATEST_VERSION}/install.sh" | bash

# in lieu of restarting the shell
\. "$HOME/.nvm/nvm.sh"

# Download and install Node.js:
nvm install 24

# Verify the Node.js version:
node -v

# Verify npm version:
npm -v

# Add Docker's official GPG key:
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

LLM CLI agent

# claude
curl -fsSL https://claude.ai/install.sh | bash

# gemini
npm install -g @google/gemini-cli

# codex
npm install -g @openai/codex

Setup 8GB swap with swapfile

# 1. CLEANUP: Remove the broken fstab entries generated by the failed scripts
sudo sed -i '/PARTLABEL=systemd-swap-8g/d' /etc/fstab
sudo sed -i '/UUID= none swap/d' /etc/fstab

# 2. Create the 8GB file safely inside your existing partition
sudo fallocate -l 8G /swapfile

# 3. Restrict permissions (required for security and swap to work)
sudo chmod 600 /swapfile

# 4. Format the file as swap space
sudo mkswap /swapfile

# 5. Enable the swap space
sudo swapon /swapfile

# 6. Safely add it to fstab so it survives a reboot
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# 7. Verify your system is now using the new 8GB swap (Total swap should be ~9.9G)
free -h