Raspberry Pi Zero W - clean up default Raspbian install

rpizerow-raspbian-clean.sh

#!/bin/sh
#
# Clean up a Raspberry Pi Zero W
#
# Refs:
#   - https://www.dzombak.com/blog/2023/12/considerations-for-a-long-running-raspberry-pi/
#   - https://www.dzombak.com/blog/2023/12/disable-or-remove-unneeded-services-and-software-to-help-keep-your-raspberry-pi-online/
#   - https://www.dzombak.com/blog/2024/03/running-a-raspberry-pi-with-a-read-only-root-filesystem/
#   - ChatGPT

set -eu -o pipefail

if [ "$(id -u)" -ne 0 ]; then
  echo "Not running as root user - exiting"
  exit 1
fi

# Disable unneeded kernel modules - sound, bluetooth, etc.
cat <EOF >/etc/modprobe.d/raspi-blacklist.conf
# Disable Bluetooth stack
blacklist bluetooth
blacklist hci_uart
blacklist btbcm
blacklist rfcomm
blacklist bnep
blacklist ecdh_generic
blacklist ecc
blacklist libaes

# Disable sound (ALSA and SoC)
blacklist snd_bcm2835
blacklist snd_seq
blacklist snd_seq_device
blacklist snd_seq_dummy
blacklist snd_hrtimer
blacklist snd_pcm
blacklist snd_pcm_dmaengine
blacklist snd_timer
blacklist snd
blacklist snd_soc_core
blacklist snd_soc_hdmi_codec
blacklist snd_compress

# Disable GPU video encode/decode, V4L2 camera stack
blacklist bcm2835_codec
blacklist bcm2835_v4l2
blacklist bcm2835_isp
blacklist bcm2835_mmal_vchiq
blacklist vc_sm_cma
blacklist v4l2_mem2mem
blacklist videodev
blacklist videobuf2_common
blacklist videobuf2_vmalloc
blacklist videobuf2_dma_contig
blacklist videobuf2_memops
blacklist videobuf2_v4l2
blacklist mc

# Disable HDMI graphics stack (VC4 + DRM)
blacklist vc4
blacklist drm_kms_helper
blacklist drm_dma_helper
blacklist drm_display_helper
blacklist drm
blacklist drm_panel_orientation_quirks
blacklist cec
blacklist backlight

# Disable GPIO and I2C user interfaces
blacklist i2c_dev
blacklist raspberrypi_gpiomem

# Disable NFS
blacklist nfs
EOF

# Disable services
systemctl disable --now polkit cups rtkit-daemon

# Disable rebuilding manpage cache
rm -v /var/lib/man-db/auto-update

# Disable daily apt updates
systemctl mask apt-daily-upgrade
systemctl mask apt-daily
systemctl disable apt-daily-upgrade.timer
systemctl disable apt-daily.timer
systemctl mask man-db.timer

# Disable NFS stuff
systemctl stop nfs-client.target
systemctl disable nfs-client.target --now
systemctl mask nfs-client.target
systemctl stop rpcbind.socket
systemctl disable rpcbind.socket --now
rmmod -fs nfs


# Disable bluetooth
systemctl disable bluetooth.service
systemctl disable hciuart.service

# Remove graphical packages, unused services, and unused kernels
apt -y remove --purge triggerhappy xserver-common lightdm vlc chromium firefox pipewire bluez modemmanager avahi-daemon \
  'linux-image-6.*rpi-v7*' 'linux-image-6.*rpi-v8*' 'linux-headers-6.*rpi-v7*' 'linux-headers-6.*rpi-v8*' \
  qt5-* wf-* wayvnc pulse* pipewire* dillo* \
gir1.2-gdkpixbuf-2.0 \
gstreamer1.0-plugins-bad \
gstreamer1.0-plugins-good \
imagemagick-6-common \
libavif15 \
libdjvulibre-text \
libdjvulibre21 \
libegl-mesa0 \
libgbm1 \
libgdk-pixbuf-2.0-0 \
libgdk-pixbuf2.0-common \
libgl1-mesa-dev \
libgl1-mesa-dri \
libglapi-mesa \
libgstreamer-plugins-bad1.0-0 \
libjxl0.7 \
libmagickcore-6.q16-6-extra \
libmagickcore-6.q16-6 \
libmagickwand-6.q16-6 \
libpipewire-0.3-0 \
libpipewire-0.3-common \
libpoppler-cpp0v5 \
libpoppler-glib8 \
libpoppler126 \
libqt5core5a \
libqt5dbus5 \
libqt5gui5 \
libqt5network5 \
libqt5printsupport5 \
libqt5sql5-sqlite \
libqt5sql5 \
libqt5test5 \
libqt5widgets5 \
libqt5xml5 \
libspa-0.2-modules \
libvpx7 \
libwayland-client0 \
libwayland-cursor0 \
libwayland-egl1 \
libwayland-server0 \
mesa-libgallium \
mesa-vdpau-drivers \
mesa-vulkan-drivers \
pastebinit \
pcmanfm \
poppler-utils \
python3-picamera2 \
python3-pidng \
wireless-regdb

# Remove related packages
apt -y autoremove --purge

# Disable swap
dphys-swapfile swapoff
dphys-swapfile uninstall
apt -y remove --purge dphys-swapfile
apt -y autoremove --purge

# Update initramfs
update-initramfs -u

# Put non-essential writes on tmpfs
cat <EOF >>/etc/fstab
tmpfs  /tmp      tmpfs  defaults,noatime,nosuid,nodev   0  0
tmpfs  /var/tmp  tmpfs  defaults,noatime,nosuid,nodev   0  0
tmpfs  /var/log  tmpfs  defaults,noatime,nosuid,nodev,noexec,size=50m  0  0
tmpfs  /var/spool/mail  tmpfs  defaults,noatime,nosuid,nodev,noexec,size=25m  0  0
tmpfs  /var/spool/rsyslog  tmpfs  defaults,noatime,nosuid,nodev,noexec,size=25m  0  0
tmpfs  /var/lib/logrotate  tmpfs  defaults,noatime,nosuid,nodev,noexec,size=1m,mode=0755  0  0
tmpfs  /var/lib/sudo  tmpfs  defaults,noatime,nosuid,nodev,noexec,size=1m,mode=0700  0  0
EOF

echo "Now, reboot to see much less resource utilisation"