Shell-Toolkit — Script Documentation

standalone/chmod/chmod-add-x.sh#⧉

Recursively adds the execute bit on all files under a given path.

• Usage: ./chmod-add-x.sh [--path <path>] [--dry-run] [--yes]
• If --path is omitted, the directory containing this script is used.
• No root required unless the target path requires elevated access

standalone/chmod/chmod-remove-x.sh#⧉

Recursively removes the execute bit from all files under a given path.

• Usage: ./chmod-remove-x.sh [--path <path>] [--dry-run] [--yes]
• If --path is omitted, the directory containing this script is used.
• No root required unless the target path requires elevated access

standalone/chmod/chmod-set-644.sh#⧉

Recursively sets file permissions to 644 under a given path.

• Usage: ./chmod-set-644.sh [--path <path>] [--dry-run] [--yes]
• If --path is omitted, the directory containing this script is used.
• No root required unless the target path requires elevated access

standalone/chmod/chmod-set-755.sh#⧉

Recursively sets file permissions to 755 under a given path.

• Usage: ./chmod-set-755.sh [--path <path>] [--dry-run] [--yes]
• If --path is omitted, the directory containing this script is used.
• No root required unless the target path requires elevated access

standalone/cleanup/cleanup-apt.sh#⧉

Runs apt-get autoremove, autoclean, and clean to free disk space.

• Usage: ./cleanup-apt.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-brave.sh#⧉

Stops Brave and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-brave.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-chrome.sh#⧉

Stops Google Chrome and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-chrome.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-chromium.sh#⧉

Stops Chromium and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-chromium.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-edge.sh#⧉

Stops Microsoft Edge and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-edge.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-firefox.sh#⧉

Stops Firefox and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-firefox.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-opera.sh#⧉

Stops Opera and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-opera.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-browser-vivaldi.sh#⧉

Stops Vivaldi and clears cookies, history, cache, etc.

• Usage: ./cleanup-browser-vivaldi.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-docker.sh#⧉

Prunes Docker system with confirmation prompts.

• Usage: ./cleanup-docker.sh [--yes] [--dry-run]
• Basic prune removes dangling images, stopped containers, and unused networks
• --yes also confirms the more destructive removal of unused images and volumes

standalone/cleanup/cleanup-flatpak.sh#⧉

Removes unused Flatpak runtimes with flatpak uninstall --unused and clears cached repository data under the user's and system's Flatpak cache directories.

• Usage: ./cleanup-flatpak.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-kernels.sh#⧉

Detects and optionally removes old Linux kernels.

• Usage: ./cleanup-kernels.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-logs.sh#⧉

Vacuums journald and removes rotated logs older than 7 days.

• Usage: ./cleanup-logs.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-temp.sh#⧉

Removes files older than 7 days from temporary directories.

• Usage: ./cleanup-temp.sh [--yes] [--dry-run]

standalone/cleanup/cleanup-thumbnails.sh#⧉

Removes thumbnail cache from all home directories.

• Usage: ./cleanup-thumbnails.sh [--yes] [--dry-run]

standalone/ffmpeg/convert-webm-mp4.sh#⧉

Recursively or non-recursively converts all .webm files in a target directory to .mp4 (H.264/AAC), skipping files that already have a converted output unless --force is given.

standalone/firewall/disable-firewalld.sh#⧉

Stops the Firewalld service and disables it from starting at boot.

standalone/firewall/disable-ufw.sh#⧉

Disables UFW.

standalone/firewall/enable-firewalld.sh#⧉

Enables and starts Firewalld.

• Enables the Firewalld service to start at boot.
• Starts the Firewalld service immediately.
• Note: if UFW is active, it should be disabled to avoid conflicting

netfilter rules; this script does not do that automatically.

standalone/firewall/enable-ufw.sh#⧉

Enables UFW (Uncomplicated Firewall).

• Enables UFW immediately.
• Note: if Firewalld is active, it should be disabled to avoid conflicting

netfilter rules; this script does not do that automatically.

standalone/firewall/remove-firewalld.sh#⧉

Completely removes Firewalld.

• Removes the Firewalld package
• Removes automatically installed unused dependencies

standalone/firewall/remove-ufw.sh#⧉

Completely removes UFW.

• Resets all UFW rules
• Removes the UFW package
• Removes automatically installed unused dependencies

standalone/firewall/firewalld/get-firewalld-list.sh#⧉

Lists configured ports and services for the public and home firewalld zones.

standalone/firewall/firewalld/ports/close-localsend.sh#⧉

Closes the port(s) used by LocalSend file transfer as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/close-minecraft.sh#⧉

Closes the port(s) used by Minecraft game server as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/close-plex.sh#⧉

Closes the port(s) used by Plex media server as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/close-syncthing.sh#⧉

Closes the port(s) used by Syncthing file synchronization as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/close-transmission.sh#⧉

Closes the port(s) used by Transmission BitTorrent client as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/close-wireguard.sh#⧉

Closes the port(s) used by WireGuard VPN as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-localsend.sh#⧉

Opens the port(s) used by LocalSend file transfer as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-minecraft.sh#⧉

Opens the port(s) used by Minecraft game server as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-plex.sh#⧉

Opens the port(s) used by Plex media server as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-syncthing.sh#⧉

Opens the port(s) used by Syncthing file synchronization as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-transmission.sh#⧉

Opens the port(s) used by Transmission BitTorrent client as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/ports/open-wireguard.sh#⧉

Opens the port(s) used by WireGuard VPN as permanent firewalld rule(s) and reloads firewalld.

standalone/firewall/firewalld/services/close-dns.sh#⧉

Closes the predefined firewalld service 'dns' (DNS resolution service) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/close-http.sh#⧉

Closes the predefined firewalld service 'http' (HTTP web server) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/close-https.sh#⧉

Closes the predefined firewalld service 'https' (HTTPS web server) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/close-mdns.sh#⧉

Closes the predefined firewalld service 'mdns' (mDNS/Avahi service discovery) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/close-samba.sh#⧉

Closes the predefined firewalld service 'samba' (Samba/CIFS file sharing) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/close-ssh.sh#⧉

Closes the predefined firewalld service 'ssh' (SSH remote access) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-dns.sh#⧉

Opens the predefined firewalld service 'dns' (DNS resolution service) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-http.sh#⧉

Opens the predefined firewalld service 'http' (HTTP web server) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-https.sh#⧉

Opens the predefined firewalld service 'https' (HTTPS web server) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-mdns.sh#⧉

Opens the predefined firewalld service 'mdns' (mDNS/Avahi service discovery) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-samba.sh#⧉

Opens the predefined firewalld service 'samba' (Samba/CIFS file sharing) as a permanent rule and reloads firewalld.

standalone/firewall/firewalld/services/open-ssh.sh#⧉

Opens the predefined firewalld service 'ssh' (SSH remote access) as a permanent rule and reloads firewalld.

standalone/firewall/ufw/ports/close-dns.sh#⧉

Closes the port(s) used by DNS resolution service via ufw.

standalone/firewall/ufw/ports/close-http.sh#⧉

Closes the port(s) used by HTTP web server via ufw.

standalone/firewall/ufw/ports/close-https.sh#⧉

Closes the port(s) used by HTTPS web server via ufw.

standalone/firewall/ufw/ports/close-localsend.sh#⧉

Closes the port(s) used by LocalSend file transfer via ufw.

standalone/firewall/ufw/ports/close-mdns.sh#⧉

Closes the port(s) used by mDNS/Avahi service discovery via ufw.

standalone/firewall/ufw/ports/close-minecraft.sh#⧉

Closes the port(s) used by Minecraft game server via ufw.

standalone/firewall/ufw/ports/close-plex.sh#⧉

Closes the port(s) used by Plex media server via ufw.

standalone/firewall/ufw/ports/close-samba.sh#⧉

Closes the port(s) used by Samba/CIFS file sharing via ufw.

standalone/firewall/ufw/ports/close-ssh.sh#⧉

Closes the port(s) used by SSH remote access via ufw.

standalone/firewall/ufw/ports/close-syncthing.sh#⧉

Closes the port(s) used by Syncthing file synchronization via ufw.

standalone/firewall/ufw/ports/close-transmission.sh#⧉

Closes the port(s) used by Transmission BitTorrent client via ufw.

standalone/firewall/ufw/ports/close-wireguard.sh#⧉

Closes the port(s) used by WireGuard VPN via ufw.

standalone/firewall/ufw/ports/open-dns.sh#⧉

Opens the port(s) used by DNS resolution service via ufw.

standalone/firewall/ufw/ports/open-http.sh#⧉

Opens the port(s) used by HTTP web server via ufw.

standalone/firewall/ufw/ports/open-https.sh#⧉

Opens the port(s) used by HTTPS web server via ufw.

standalone/firewall/ufw/ports/open-localsend.sh#⧉

Opens the port(s) used by LocalSend file transfer via ufw.

standalone/firewall/ufw/ports/open-mdns.sh#⧉

Opens the port(s) used by mDNS/Avahi service discovery via ufw.

standalone/firewall/ufw/ports/open-minecraft.sh#⧉

Opens the port(s) used by Minecraft game server via ufw.

standalone/firewall/ufw/ports/open-plex.sh#⧉

Opens the port(s) used by Plex media server via ufw.

standalone/firewall/ufw/ports/open-samba.sh#⧉

Opens the port(s) used by Samba/CIFS file sharing via ufw.

standalone/firewall/ufw/ports/open-ssh.sh#⧉

Opens the port(s) used by SSH remote access via ufw.

standalone/firewall/ufw/ports/open-syncthing.sh#⧉

Opens the port(s) used by Syncthing file synchronization via ufw.

standalone/firewall/ufw/ports/open-transmission.sh#⧉

Opens the port(s) used by Transmission BitTorrent client via ufw.

standalone/firewall/ufw/ports/open-wireguard.sh#⧉

Opens the port(s) used by WireGuard VPN via ufw.

standalone/git/bootstrap-git.sh#⧉

Configures Git user identity and optionally stores GitHub HTTPS credentials for automatic authentication.

• Sets global user name and email.
• Sets the default branch name.
• Optionally enables credential.helper store.
• Optionally stores a GitHub Personal Access Token (PAT).

standalone/git/git-clone-all.sh#⧉

Clones every public repository belonging to a GitHub user or organization.

• Usage: ./git-clone-all.sh <github-username-or-url> [--path <dir>]
• Accepts either a bare username or a full github.com/<user> URL
• Paginates through the GitHub API to fetch all repositories
• Clones each repo into the target directory (default ./<username>)
• Skips repositories that are already cloned locally

standalone/git/git-commit-all.sh#⧉

Stages changes and opens an editor to write a commit message for every Git repository located directly inside the target directory.

• Usage: ./git-commit-all.sh <github-username-or-url> [--path <dir>]
• Accepts either a bare username or a full github.com/<user> URL
• Defaults to the ./<username> directory produced by git-clone-all.sh
• Runs git add . then git commit in each existing Git repository
• Opens nano for the commit message unless the repo already sets its own editor
• Skips directories that are not Git repositories
• Skips repositories with no changes to commit

standalone/git/git-pull-all.sh#⧉

Updates every Git repository located directly inside the target directory.

• Usage: ./git-pull-all.sh <github-username-or-url> [--path <dir>]
• Accepts either a bare username or a full github.com/<user> URL
• Defaults to the ./<username> directory produced by git-clone-all.sh
• Pulls the latest changes for each existing Git repository
• Skips directories that are not Git repositories
• Skips repositories with uncommitted changes

standalone/git/git-push-all.sh#⧉

Pushes local commits from every Git repository located directly inside the target directory.

• Usage: ./git-push-all.sh <github-username-or-url> [--path <dir>]
• Accepts either a bare username or a full github.com/<user> URL
• Defaults to the ./<username> directory produced by git-clone-all.sh
• Pushes commits from each existing Git repository
• Skips directories that are not Git repositories
• Skips repositories with no commits to push

standalone/git/git-rewrite-identity.sh#⧉

Uses git-filter-repo to replace a given author/committer name and/or email with new values across the entire commit history of a repository. Useful when commits were made under an OS-level username instead of the intended account identity. Rewrites all refs; commit hashes change. The 'origin' remote is removed by git-filter-repo as a safety measure and is automatically re-added at the end if it was present.

standalone/group-management/grant-kvm.sh#⧉

Adds an existing local user to the kvm group required for hardware-assisted virtualization with QEMU/KVM.

• Usage: sudo ./grant-kvm.sh [username]

Safe to re-run — users already in the kvm group are skipped.

standalone/group-management/grant-libvirt.sh#⧉

Adds an existing local user to the libvirt group required for managing virtual machines with libvirt without root privileges.

• Usage: sudo ./grant-libvirt.sh [username]

Safe to re-run — users already in the libvirt group are skipped.

standalone/group-management/grant-sudo.sh#⧉

Adds an existing local user to the sudo group.

• Usage: sudo ./grant-sudo.sh [username]

Safe to re-run — users already in the sudo group are skipped.

standalone/group-management/grant-vboxusers.sh#⧉

Adds an existing local user to the vboxusers group required by VirtualBox for accessing USB devices and other VirtualBox features without root.

• Usage: sudo ./grant-vboxusers.sh [username]

Safe to re-run — users already in the vboxusers group are skipped.

standalone/group-management/revoke-kvm.sh#⧉

Removes an existing local user from the kvm group used for hardware-assisted virtualization with QEMU/KVM.

• Usage: sudo ./revoke-kvm.sh [username]

Safe to re-run — users not in the kvm group are skipped.

standalone/group-management/revoke-libvirt.sh#⧉

Removes an existing local user from the libvirt group used for managing virtual machines with libvirt without root privileges.

• Usage: sudo ./revoke-libvirt.sh [username]

Safe to re-run — users not in the libvirt group are skipped.

standalone/group-management/revoke-sudo.sh#⧉

Removes an existing local user from the sudo group.

• Usage: sudo ./revoke-sudo.sh [username]

Safe to re-run — users not in the sudo group are skipped.

standalone/group-management/revoke-vboxusers.sh#⧉

Removes an existing local user from the vboxusers group used by VirtualBox for accessing USB devices and other VirtualBox features without root.

• Usage: sudo ./revoke-vboxusers.sh [username]

Safe to re-run — users not in the vboxusers group are skipped.

standalone/install/install-java.sh#⧉

Downloads and installs multiple Eclipse Temurin (Adoptium) JDK/JRE builds. Install path: /opt/java/temurin/

• Supported versions: 8, 17, 21, 25
• Downloads both JDK and JRE variants
• Updates the current user's shell configuration
• Requires sudo only for system-wide installation

Usage: ./install-temurin.sh ./install-temurin.sh --force

standalone/install/install-nerd-fonts.sh#⧉

Downloads and installs several popular Nerd Fonts from the official Nerd Fonts GitHub releases. Install path: /usr/local/share/fonts/NerdFonts

Installed fonts:

• JetBrainsMono
• FiraCode
• Hack
• Meslo
• SourceCodePro

standalone/install/install-nvidia-driver.sh#⧉

Installs an NVIDIA GPU driver, either from the distro's apt repository or from a legacy/manual .run installer.

• Usage: sudo ./install-nvidia-driver.sh --detect (auto-detects the recommended package via ubuntu-drivers or nvidia-detect), --package <nvidia-driver-XXX>, or --run <path-to-.run>
• Blacklists the nouveau driver before installing
• Must be run from a text TTY (not from X11/Wayland)
• Refuses to continue if a graphical session is detected
• Warns if a process is still holding /dev/nvidia* before proceeding
• Installs via apt-get install (package mode) or runs the .run file with --silent --dkms --no-x-check (manual mode)

standalone/install/install-ranger-devicons.sh#⧉

Installs ranger_devicons into the current user's ranger configuration. Install path: $HOME/.config/ranger/plugins/ranger_devicons

• Downloads the latest plugin archive from GitHub.
• Enables default_linemode devicons in $HOME/.config/ranger/rc.conf.
• Requires a Nerd Font configured in your terminal.

standalone/install/install-tor-browser.sh#⧉

Installs Tor Browser via the official Tor Project apt repository. Install path: $HOME/.local/bin

standalone/install/install-vbox-guest-additions.sh#⧉

Installs VirtualBox Guest Additions by running the vendor installer from the mounted Guest Additions ISO.

• Run this inside the guest VM, not on the host.
• Before running: mount the Guest Additions ISO first. In the VirtualBox VM window, use Devices -> Insert Guest Additions CD image... (or attach VBoxGuestAdditions.iso manually), then re-run this script.
• Installs dkms, build-essential, and a matching kernel headers package via apt, then runs the vendor installer from the mounted image.

standalone/install/install-zafiro-icons.sh#⧉

Downloads the latest Zafiro Icons Dark and Light archives from the official GitHub releases and installs them into the user's local icon directory.

Install path:

• ${XDG_DATA_HOME:-$HOME/.local/share}/icons

Installed themes:

• Zafiro-Icons-Dark
• Zafiro-Icons-Light

standalone/install/apt/cli/install-cpp.sh#⧉

Installs build-essential, gcc, g++, clang, cmake, ninja-build, gdb, lldb.

standalone/install/apt/cli/install-docker.sh#⧉

Installs Docker Engine and the Docker Compose plugin from Docker's official apt repository (not the Debian/Ubuntu docker.io package); enables and starts the service.

standalone/install/apt/cli/install-firewalld-cli.sh#⧉

Installs firewalld.

• Note: if ufw is active, it should be disabled to avoid conflicting

netfilter rules; this script does not do that automatically.

standalone/install/apt/cli/install-flatpak.sh#⧉

Installs flatpak, adds the Flathub repository and configures Flatpak environment variables.

standalone/install/apt/cli/install-git.sh#⧉

Installs git via apt.

standalone/install/apt/cli/install-npm.sh#⧉

Installs nodejs, npm.

standalone/install/apt/cli/install-php.sh#⧉

Installs php, php-cli, php-fpm, and common PHP extensions.

standalone/install/apt/cli/install-pipx.sh#⧉

Installs pipx and ensures ~/.local/bin is on PATH.

standalone/install/apt/cli/install-pkgs-apps.sh#⧉

Installs firefox-esr, thunar, thunar-archive-plugin, thunar-volman, xarchiver, python3-pil, tty-clock, chafa, cmus, nsxiv, cava, vlc, flameshot, copyq, wl-clipboard, fastfetch.

standalone/install/apt/cli/install-pkgs-audio.sh#⧉

Installs pipewire, pipewire-pulse, wireplumber, alsa-utils.

This stack is required for the wpctl/pactl commands used in audio.conf and waybar.

standalone/install/apt/cli/install-pkgs-core.sh#⧉

Installs sudo, git, ranger, htop, tree, curl, wget, unzip, zip, p7zip-full, rsync, less, nano, ripgrep, fd-find, fzf, jq, bc, file, tar, xdg-user-dirs, zoxide, bash-completion, pciutils, usbutils, xdg-utils, acl.

standalone/install/apt/cli/install-pkgs-cryptsetup.sh#⧉

Installs cryptsetup, cryptsetup-bin, cryptsetup-initramfs, keyutils.

standalone/install/apt/cli/install-pkgs-graphics.sh#⧉

Installs libegl1, libgl1, libgles2, mesa-utils for software rendering support and GL diagnostics.

standalone/install/apt/cli/install-pkgs-network.sh#⧉

Installs network-manager, network-manager-gnome, blueman, bluez, bluez-tools, firewalld, firewall-config.

standalone/install/apt/cli/install-pkgs-notify.sh#⧉

Installs sway-notification-center, grim, slurp, speech-dispatcher, libnotify-bin.

standalone/install/apt/cli/install-pkgs-storage.sh#⧉

Installs udisks2, gvfs, gvfs-backends, gvfs-fuse, gnome-disk-utility, e2fsprogs, btrfs-progs, xfsprogs, dosfstools, ntfs-3g, smartmontools, nvme-cli.

standalone/install/apt/cli/install-pkgs-system-helpers.sh#⧉

Installs lxpolkit, brightnessctl.

lxpolkit is the polkit authentication agent, started in autostart.conf. brightnessctl backs the brightness hotkeys.

standalone/install/apt/cli/install-pkgs-theming.sh#⧉

Installs qt5ct, qt6ct, nwg-look, adwaita-qt, adwaita-qt6, kde-style-breeze.

standalone/install/apt/cli/install-pkgs-wayland-core.sh#⧉

Installs sway, swaybg, wofi, waybar, xwayland, xdg-desktop-portal-wlr, xdg-desktop-portal-gtk, fuse3, libfuse2t64, libnss3, qt6-wayland, qtwayland5.

standalone/install/apt/cli/install-python.sh#⧉

Installs python3, python3-pip, python3-venv.

standalone/install/apt/cli/install-qemu-kvm.sh#⧉

Installs the complete QEMU/KVM virtualization environment.

Includes:

• QEMU system emulator and utilities
• libvirt daemon and client tools
• Virt-Manager GUI
• UEFI firmware (OVMF) and SeaBIOS
• SPICE support
• TPM emulator (swtpm)
• Network bridge utilities
• Cloud image utilities

Enables and starts the libvirtd service after installation.

standalone/install/apt/cli/install-ranger.sh#⧉

Installs ranger via apt.

standalone/install/apt/cli/install-ufw.sh#⧉

Installs UFW.

• Note: if Firewalld is active, it should be disabled to avoid conflicting

netfilter rules; this script does not do that automatically.

standalone/install/apt/cli/install-veracrypt-cli.sh#⧉

Installs VeraCrypt CLI (Console Only) from the official PPA.

• Note: the CLI and GUI VeraCrypt packages are mutually exclusive. Install only one of them.

standalone/install/apt/gui/install-blender.sh#⧉

Installs Blender via apt.

standalone/install/apt/gui/install-firefox.sh#⧉

Installs Firefox via apt.

• Uses the firefox package where available (Ubuntu's apt repos install

the Snap transitional package on stock Ubuntu; Debian ships a real deb).

• Falls back to firefox-esr, the package name used on Debian stable

when the plain firefox package does not exist in the configured repos.

standalone/install/apt/gui/install-firewalld-gui.sh#⧉

Installs firewalld and firewall-config, its GTK graphical configuration tool.

• Enables and starts the firewalld service.
• Note: if ufw is active, it should be disabled to avoid conflicting

netfilter rules; this script does not do that automatically.

standalone/install/apt/gui/install-flameshot.sh#⧉

Installs Flameshot via apt.

standalone/install/apt/gui/install-ghostwriter.sh#⧉

Installs the Ghostwriter Markdown editor.

standalone/install/apt/gui/install-gimp.sh#⧉

Installs GIMP via apt.

standalone/install/apt/gui/install-inkscape.sh#⧉

Installs Inkscape via apt.

standalone/install/apt/gui/install-obs-studio.sh#⧉

Installs OBS Studio via apt.

standalone/install/apt/gui/install-protonvpn.sh#⧉

Installs the ProtonVPN from the official Proton apt repository.

standalone/install/apt/gui/install-qbittorrent.sh#⧉

Installs qBittorrent via apt.

standalone/install/apt/gui/install-qwinff.sh#⧉

Installs QwinFF via apt.

standalone/install/apt/gui/install-remmina.sh#⧉

Installs Remmina via apt.

standalone/install/apt/gui/install-veracrypt-gui.sh#⧉

Installs VeraCrypt GUI (Graphical Interface) from the official PPA.

• Note: the CLI and GUI VeraCrypt packages are mutually exclusive. Install only one of them.

standalone/install/apt/gui/install-virtualbox.sh#⧉

Installs VirtualBox from the official Oracle apt repository.

standalone/install/apt/gui/install-vlc.sh#⧉

Installs VLC via apt.

standalone/install/flatpak/install-discord.sh#⧉

Installs Discord from Flathub.

standalone/install/flatpak/install-steam.sh#⧉

Installs Steam from Flathub.

standalone/install/flatpak/install-telegram.sh#⧉

Installs Telegram Desktop from Flathub.

standalone/install/kde-plasma/install-kate.sh#⧉

Installs the Kate text editor.

standalone/install/kde-plasma/install-kdevelop.sh#⧉

Installs the KDevelop IDE.

standalone/install/kde-plasma/install-kio-admin.sh#⧉

Installs kio-admin for Dolphin root access (KDE-only utility).

standalone/install/kde-plasma/install-krusader.sh#⧉

Installs Krusader via apt.

standalone/install/kde-plasma/install-okular.sh#⧉

Installs the Okular document viewer.

standalone/install/lsp/install-bash-language-server.sh#⧉

Installs bash-language-server via npm. Install path: $HOME/.local/npm Marker block path: ~/.bashrc ~/.profile

standalone/install/lsp/install-clang-language-server.sh#⧉

Installs the LLVM Clang Language Server (clangd) from the Debian repositories.

• Installs via apt
• Provides LSP support for C, C++, Objective-C and Objective-C++
• Idempotent — skips installation if clangd is already available

standalone/install/lsp/install-markdown-language-server.sh#⧉

Installs marksman into for the current user. Install path: $HOME/.local/bin

• Adds ~/.local/bin to .bashrc and .profile
• Idempotent — skips installation if marksman is already present
• Requires curl to be available

standalone/install/lsp/install-python-language-server.sh#⧉

Installs python-lsp-server (pylsp) for the current user, with all optional providers (Rope, Pyflakes, McCabe, pycodestyle, pydocstyle, autopep8, YAPF) enabled via the [all] extra. Install path: $HOME/.local/npm Marker block path: ~/.bashrc ~/.profile

standalone/install/pipx/install-ansible.sh#⧉

Installs the latest Ansible using pipx with all command-line tools exposed, including ansible-playbook, ansible-galaxy, ansible-vault, ansible-config, ansible-doc, ansible-console, ansible-inventory, ansible-pull, and ansible-test.

If Ansible is already installed via pipx, it is removed and reinstalled with --include-deps to ensure all CLI tools are available.

standalone/install/pipx/install-gallery-dl.sh#⧉

Installs gallery-dl.

standalone/install/pipx/install-git-filter-repo.sh#⧉

Installs git-filter-repo.

standalone/install/pipx/install-spotdl.sh#⧉

Installs spotdl.

standalone/install/pipx/install-yt-dlp.sh#⧉

Installs yt-dlp.

standalone/inventory/network/get-bandwidth-summary.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Per-interface link speed, duplex, carrier state, and MTU

standalone/inventory/network/get-connectivity.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Same checks as network-summary.sh plus DNS query time and IPv6 internet reachability

standalone/inventory/network/get-dns-info.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• resolvectl status or /etc/resolv.conf, active nameservers, and search domains

standalone/inventory/network/get-established-connections.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Established TCP connections with local/remote endpoints and owning process

Running as sudo gives fuller process detail on this script; it still works without root, but with a warning and reduced detail.

standalone/inventory/network/get-firewall-status.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Status across UFW, Firewalld, nftables, and iptables — whichever are installed

Running as sudo gives fuller process detail on this script; it still works without root, but with a warning and reduced detail.

standalone/inventory/network/get-interface-statistics.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Per-interface RX/TX bytes, packets, errors, drops, and collisions from /sys/class/net

standalone/inventory/network/get-listening-ports.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Listening TCP/UDP ports with the owning process, via ss

Running as sudo gives fuller process detail on this script; it still works without root, but with a warning and reduced detail.

standalone/inventory/network/get-neighbors.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• ARP table (IPv4) and neighbor cache (IPv6)

standalone/inventory/network/get-network-interfaces.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Per-interface state, MAC, MTU, driver, speed, and IPv4/IPv6 addresses

standalone/inventory/network/get-network-services.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Active state of NetworkManager, systemd-networkd/-resolved, dhcpcd, wpa_supplicant, iwd

standalone/inventory/network/get-network-statistics.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• TCP congestion control algorithm, IPv4/IPv6 forwarding, and BBR status via sysctl

standalone/inventory/network/get-network-summary.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• One-shot pass/fail overview: gateway, DNS, internet, public IPv4/IPv6

standalone/inventory/network/get-public-ip.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• Public IPv4/IPv6 via ipify, falling back to ifconfig.me/ifconfig.co

standalone/inventory/network/get-routing.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• IPv4/IPv6 routing tables and the default gateway/interface

standalone/inventory/network/get-vpn-status.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• WireGuard/TUN/TAP interfaces, Tailscale status, and ZeroTier status

standalone/inventory/network/get-wifi-status.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; colored output degrades gracefully to plain text when not attached to a terminal.

• SSID, signal, bitrate, and frequency for wireless interfaces via iw or nmcli

standalone/inventory/system/get-cpu-info.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects architecture, model name, core/thread counts via lscpu.

standalone/inventory/system/get-directory-tree.sh#⧉

Read-only status and diagnostic script. Works without root.

• Displays a 2-level deep tree for /srv, /opt, and /var/www.

Running as sudo prevents "Permission denied" errors in restricted folders.

standalone/inventory/system/get-disk-health.sh#⧉

Read-only status and diagnostic script.

• Enumerates physical disks via lsblk and reports SMART overall

health, temperature, power-on hours, and reallocated/pending sector counts via smartctl (SATA, SAS, and NVMe).

• Complements get-storage-info.sh, which reports filesystem usage

rather than drive health.

Running as sudo is required; smartctl returns limited or no
data for non-root users.

standalone/inventory/system/get-dmi-info.sh#⧉

Read-only status and diagnostic script.

• Collects system manufacturer/model/serial info via dmidecode -t system.

Running as sudo is required; dmidecode returns no data for non-root users.

standalone/inventory/system/get-docker-info.sh#⧉

Read-only status and diagnostic script.

• Collects docker ps, network ls, volume ls, and docker info.

Running as sudo is required unless the user is part of the docker group.

standalone/inventory/system/get-gpu-info.sh#⧉

Read-only status and diagnostic script. Works without root.

• Detects GPU devices via lspci (VGA/3D/display controllers).
• If nvidia-smi is present, also shows driver/CUDA version, per-GPU

temperature, utilization, memory usage, power draw, and active compute processes.

If no NVIDIA driver is found, run install-nvidia-driver.sh first.

standalone/inventory/system/get-host-info.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root.

• Collects hostnamectl, /etc/os-release, uname -a, and uptime.

standalone/inventory/system/get-installed-packages.sh#⧉

Read-only status and diagnostic script. Works without root.

• Counts installed packages via dpkg-query (Debian/Ubuntu) or rpm fallback.

standalone/inventory/system/get-journal-errors.sh#⧉

Read-only status and diagnostic script.

• Collects the last 15 critical/error priority events via journalctl -p 3 -xb.

Running as sudo is required to read full system journal logs.

standalone/inventory/system/get-kernel-log.sh#⧉

Read-only status and diagnostic script — does not modify system configuration.

• Collects the last 20 lines of dmesg.

Running as sudo is required on systems with kernel.dmesg_restrict enabled.

standalone/inventory/system/get-kernel-parameters.sh#⧉

Read-only status and diagnostic script — does not modify system configuration. Works without root; some restricted parameters may be hidden.

• Collects the first 20 lines of sysctl -a for a quick preview.

standalone/inventory/system/get-local-users.sh#⧉

Read-only status and diagnostic script. Works without root.

• Lists local users with UID >= 1000 (excluding nobody) from /etc/passwd.

standalone/inventory/system/get-logged-in-users.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects currently logged-in users (w) and the last 10 logins (last).

standalone/inventory/system/get-memory-info.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects RAM and swap usage via free -h.

standalone/inventory/system/get-nginx-info.sh#⧉

Read-only status and diagnostic script.

• Collects nginx -V and checks config syntax.

Running as sudo is required to read SSL certificates or specific config files during nginx -t.

standalone/inventory/system/get-pci-devices.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects the PCI device list via lspci.

standalone/inventory/system/get-services-info.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects currently running services and enabled systemd units.

standalone/inventory/system/get-ssl-cert-expiry.sh#⧉

Read-only status and diagnostic script. Works without root.

• Connects to each domain (default port 443, or host:port) via

openssl s_client and reports the certificate's expiry date and days remaining.

• Domains are given as CLI arguments, or edited into the domains

array at the top of the script.

standalone/inventory/system/get-storage-info.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects filesystem usage via df -h and block device layout via lsblk.

standalone/inventory/system/get-systemd-timers.sh#⧉

Read-only status and diagnostic script. Works without root.

• Lists every systemd timer via systemctl list-timers, showing next

and last run times and the unit each one activates.

• Cross-checks each activated unit and flags any currently in a

failed state.

• Complements crontab-based scheduling reports, which do not cover

systemd timers.

standalone/inventory/system/get-top-processes.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects the top 10 processes by CPU usage via ps aux --sort=-%cpu.

standalone/inventory/system/get-usb-devices.sh#⧉

Read-only status and diagnostic script. Works without root.

• Collects the USB device list via lsusb.

standalone/inventory/system/get-user-crontab.sh#⧉

Read-only status and diagnostic script.

• Collects the crontab entries for the current user via crontab -l.

Running as sudo reads root's crontab instead of the invoking user's.

standalone/maintenance/create-swap.sh#⧉

Creates and activates a swap file at /swapfile.

• Usage: ./create-swap.sh --size <size> [--dry-run] [--yes]
• --size accepts G, GB, GiB, M, MB, MiB, T, TB, TiB units (e.g. 4G, 8192M, 2GiB)
• --dry-run shows what would be done without making any changes
• --yes skips the confirmation prompt when creating/resizing the swap file
• Detects and safely handles an existing swap file, prompting for confirmation

before a destructive create/resize (unless --yes or --dry-run is used)

• Enables the new swap immediately and persists it via /etc/fstab

standalone/maintenance/create-user.sh#⧉

Creates a new local user and optionally sets a password.

• Usage: ./create-user.sh <username> [password]
• Password is optional; omit it to create the user without one.

Safe to re-run — existing users are skipped.

standalone/maintenance/purge-virtualbox.sh#⧉

Removes all installed VirtualBox packages from both Debian and Oracle repositories, purges leftover configuration files, removes all installed VirtualBox Extension Packs, and cleans unused dependencies.

This script does not remove VirtualBox repositories, GPG keys, virtual machines, or user data.

standalone/maintenance/restore-bashrc.sh#⧉

Restores ~/.bashrc to the distro default.

• Usage: ./restore-bashrc.sh [--yes]
• Backs up the current ~/.bashrc with a timestamp before overwriting
• Restores the file from /etc/skel/.bashrc
• Requires explicit confirmation before making changes, unless --yes is passed

standalone/maintenance/restore-profile.sh#⧉

Restores ~/.profile to the distro default.

• Usage: ./restore-profile.sh [--yes]
• Backs up the current ~/.profile with a timestamp before overwriting
• Restores the file from /etc/skel/.profile
• Requires explicit confirmation before making changes, unless --yes is passed

standalone/sources/edit-sources-list-d-list.sh#⧉

Opens every APT source file with the .list extension found in /etc/apt/sources.list.d/ using the Nano text editor.

• Verifies the script is run as root
• Verifies that Nano is installed
• Verifies that at least one .list file exists
• Opens all matching files in Nano

standalone/sources/edit-sources-list-d-sources.sh#⧉

Opens every APT source file with the .sources extension found in /etc/apt/sources.list.d/ using the Nano text editor.

• Verifies the script is run as root
• Verifies that Nano is installed
• Verifies that at least one .sources file exists
• Opens all matching files in Nano

standalone/sources/edit-sources-list.sh#⧉

Opens the main APT sources file in the Nano text editor.

• Verifies the script is run as root
• Verifies that Nano is installed
• Verifies that the sources.list file exists
• Opens the file in Nano

standalone/sources/get-sources-list.sh#⧉

Displays every configured APT repository from the standard source locations.

• Shows the contents of /etc/apt/sources.list
• Shows every .list file in /etc/apt/sources.list.d/
• Shows every .sources file in /etc/apt/sources.list.d/
• Skips files that do not exist

standalone/update/update-apt.sh#⧉

Runs apt-get update to refresh the package index, then apt-get upgrade -y to install all available updates.

standalone/update/update-docker-compose-stacks.sh#⧉

Updates and redeploys every Docker Compose stack detected on the system.

• Lists currently running containers before starting
• Automatically discovers Docker Compose projects via Docker labels
• Runs docker compose pull followed by docker compose up -d for each stack
• Detects whether new images were actually pulled
• Skips stacks where the pull fails
• Prints a final summary of updated, unchanged, and skipped stacks

standalone/update/update-flatpak.sh#⧉

Runs flatpak update -y to upgrade every installed Flatpak application and runtime to its latest available version.

standalone/update/update-grub.sh#⧉

Regenerates the GRUB configuration file by detecting installed kernels and operating systems. Useful after kernel updates, bootloader changes, or modifying GRUB settings.

standalone/update/update-pipx.sh#⧉

Runs pipx upgrade-all to upgrade every application installed through pipx to its latest available version.

standalone/yt-dlp/yt-dlp-all-formats.sh#⧉

Checks that yt-dlp is installed, uses Firefox cookies and a Node.js JS runtime for restricted videos, and retries up to 100 times with randomized sleep intervals. Output filenames always include uploader, upload date, title, and video ID.

• Usage: ./yt-dlp-all-formats.sh <URL> [extra yt-dlp options]
• Targets 480p, 720p, 1080p, 1440p, 2160p (4K), and 4320p (8K) with bestaudio[ext=m4a]
• Falls back to best[ext=mp4] / best if no matching tier is available
• Output filename also includes the resolution

standalone/yt-dlp/yt-dlp-audio-only.sh#⧉

Checks that yt-dlp is installed, uses Firefox cookies and a Node.js JS runtime for restricted videos, and retries up to 100 times with randomized sleep intervals. Output filenames always include uploader, upload date, title, and video ID.

• Usage: ./yt-dlp-audio-only.sh <URL> [extra yt-dlp options]
• Extracts audio at the best available quality (--audio-quality 0) and converts to MP3

standalone/yt-dlp/yt-dlp-best-format.sh#⧉

Checks that yt-dlp is installed, uses Firefox cookies and a Node.js JS runtime for restricted videos, and retries up to 100 times with randomized sleep intervals. Output filenames always include uploader, upload date, title, and video ID.

• Usage: ./yt-dlp-best-format.sh <URL> [extra yt-dlp options]
• Prefers bestvideo[ext=mp4]+bestaudio[ext=m4a], falling back to the best overall format

standalone/yt-dlp/yt-dlp-playlist-480p.sh#⧉

Checks that yt-dlp is installed, uses Firefox cookies and a Node.js JS runtime for restricted videos, and retries up to 100 times with randomized sleep intervals. Output filenames always include uploader, upload date, title, and video ID where applicable.

• Usage: ./yt-dlp-playlist-480p.sh <URL> [extra yt-dlp options]
• Downloads every video in a playlist
• Limits video quality to 480p or lower
• Prefers separate video/audio streams, falling back to the best available format
• Saves videos into a directory named after the playlist
• Prefixes filenames with the playlist index

workflows/cleanup-system.sh#⧉

Executes cleanup scripts from the standalone/cleanup directory.

• Multiple cleanup tasks may be specified at once.
• --all runs every available cleanup script.
• --yes and --dry-run are forwarded to each cleanup subscript.

Example: ./cleanup-system.sh --all --yes ./cleanup-system.sh --all --dry-run ./cleanup-system.sh --all --dry-run --yes

workflows/setup-development-environment.sh#⧉

Installs a complete development environment by chaining scripts from apt/ and lsp/.

• Runs in order: install-cpp.sh, install-python.sh, install-php.sh, install-npm.sh
• Then installs install-bash-language-server.sh, install-markdown-language-server.sh, install-python-language-server.sh and install-clang-language-server.sh

workflows/setup-downloaders.sh#⧉

Installs a curated set of Python CLI tools via pipx in one step.

• Runs in order: install-pipx.sh, install-gallery-dl.sh, install-yt-dlp.sh, install-spotdl.sh

workflows/setup-firewalld.sh#⧉

Installs Firewalld and enables the service.

• Runs in order: install-firewalld-cli.sh, enable-firewalld.sh

workflows/setup-git.sh#⧉

Sets up a complete Git environment by chaining standalone scripts.

• Installs Git from the distribution repositories.
• Runs the Git bootstrap configuration.

Example: ./setup-git.sh \ --username USERNAME \ --email EMAIL \ --default-branch main \ --token ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \ --store-credentials

workflows/setup-proprietary-software.sh#⧉

Installs Flatpak and a standard set of GUI applications in one step.

• Runs in order: install-flatpak.sh (Flatpak + Flathub), install-telegram.sh, install-discord.sh, install-steam.sh

workflows/setup-qemu-kvm.sh#⧉

Installs QEMU/KVM and adds an existing user to the required virtualization groups.

• Runs in order: install-qemu-kvm.sh, grant-libvirt.sh, grant-kvm.sh

workflows/setup-ranger.sh#⧉

Installs a complete ranger environment by chaining standalone scripts.

• Installs ranger.
• Installs popular Nerd Fonts.
• Installs and configures ranger_devicons.

workflows/setup-ufw.sh#⧉

Installs UFW and enables the firewall.

• Runs in order: install-ufw.sh, enable-ufw.sh

workflows/setup-virtualbox.sh#⧉

Installs VirtualBox and adds an existing user to the vboxusers group.

• Runs in order: install-virtualbox.sh, grant-vboxusers.sh

workflows/uninstall-firewalld.sh#⧉

Disables the Firewalld service and removes the package.

• Runs in order: disable-firewalld.sh, remove-firewalld.sh

workflows/uninstall-ufw.sh#⧉

Disables UFW and removes the package.

• Runs in order: disable-ufw.sh, remove-ufw.sh

workflows/update-system.sh#⧉

Updates all supported package managers by chaining standalone update scripts.

• Runs in order: update-apt.sh, update-flatpak.sh, update-pipx.sh