julien
1d11db9f36
## Summary Follow-up on [#220](#220). [`10-base-packages.sh`](docs/setup/scripts/10-base-packages.sh) fails on a fresh Debian 13 Trixie VM with `E: Impossible de trouver le paquet software-properties-common`. The package is no longer shipped on Trixie — and it was never used by any of our downstream scripts in the first place. Drop three deprecated / unused packages from the install list. Add an inline comment explaining each kept package's purpose so a drive-by addition doesn't reintroduce the dropped ones. ## What lands | File | Change | | --- | --- | | `docs/setup/scripts/10-base-packages.sh` | Drop `software-properties-common`, `apt-transport-https`, `lsb-release`. Remaining minimal set: `curl wget git ca-certificates gnupg build-essential pkg-config`. Inline comment lists which downstream script consumes each kept package + which three were deliberately removed and why. | | `docs/setup/01-dev-debian-vm-setup.md` | Step-3 table row for `10-base-packages.sh` updated to match the new package list. | ## Why each removed package wasn't needed | Package | Why removed | | --- | --- | | `software-properties-common` | Drops `add-apt-repository`. We don't use it — [`50-docker.sh`](docs/setup/scripts/50-docker.sh) writes `/etc/apt/sources.list.d/docker.list` manually with the keyring-pinned `signed-by=` form. Also no longer in Trixie. | | `apt-transport-https` | Transitional package since apt 1.5 (2018) — apt has native HTTPS. Intermittently absent on Trixie. | | `lsb-release` | Shell scripts read `/etc/os-release` directly (see `50-docker.sh`'s `. /etc/os-release && echo "${VERSION_CODENAME}"`). | ## Unblock path (manual, if you're stuck mid-bootstrap) The user can either pull this PR and re-run, or shortcut manually: ```bash sudo apt-get install -y curl wget git ca-certificates gnupg build-essential pkg-config ./docs/setup/scripts/20-zsh.sh # continue from the next step ``` Scripts are idempotent — re-running `bootstrap.sh` after pulling this PR is also safe. ## Test plan - [ ] On a fresh Trixie VM, `./docs/setup/scripts/10-base-packages.sh` exits successfully. - [ ] Verify each downstream script still has the binaries it expects (curl in 40-node.sh, gpg in 50-docker.sh, build-essential in pnpm install, …). - [x] `pnpm exec prettier --check` clean on the touched files. - [x] `bash -n docs/setup/scripts/10-base-packages.sh` clean. --------- Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr> Reviewed-on: #223
Setup guides
Step-by-step setup procedures for new contributors. Each file is self-contained and idempotent — they document the state a developer should reach, not the order in which it must be done.
| # | File | Audience |
|---|---|---|
| 01 | Debian 13 dev-VM setup | Default — a dev who has just received a fresh dev VM from the infra team. Covers the full path: zsh + Oh My Zsh + Powerlevel10k, modern CLI tooling, Node via nvm, Docker CE, system tuning, optional VM hardening, project clones, the two IDE flows (VSCode Remote-SSH and Devcontainer), the hybrid (local + VM) mode. |
| 02 | WSL terminal setup | Legacy — the original Windows-WSL flow. Kept for reference for devs still on that path until the org migrates to the VM-based flow. |
| 03 | Dev web stack | Notes on the web-side tooling. |
| 04 | Angular + Nx monorepo | Reference notes on the Angular + Nx workspace layout. |
scripts/
Modular setup scripts called from the doc above. Each is idempotent, each can be re-run safely. Run via the orchestrator (bootstrap.sh) or individually.
| Script | Purpose |
|---|---|
bootstrap.sh |
Run every numbered script in order with a confirmation prompt at each step. |
lib.sh |
Common helpers — colour logging, idempotent apt_install / ensure_line. |
10-base-packages.sh |
apt + base packages every other script assumes (curl wget git build-essential …). |
20-zsh.sh |
zsh + Oh My Zsh + Powerlevel10k + autosuggestions + syntax-highlighting. Patches ~/.zshrc (theme / plugins / fzf hook) and ~/.bashrc (exec zsh — chsh blocked on corp VM). |
30-cli-tools.sh |
bat eza fd-find ripgrep fzf zoxide ncdu keychain + dev extras (jq yq httpie make tree htop tmux direnv). |
40-node.sh |
nvm + Node from the repo's .nvmrc + corepack pinned to package.json#packageManager's pnpm version. |
50-docker.sh |
Docker CE + compose plugin from docker.com apt repo + user added to docker group + service enabled at boot. |
60-tuning.sh |
inotify watches → 524288, optional 4 GB swapfile, optional hostname rename (only prompts if generic). |
70-hardening.sh |
Best-effort UFW + unattended-upgrades + fail2ban (opt-in) + sshd hardening drop-in. Probes before applying — skips done items, prompts before each install. |
80-dotfiles.sh |
Symlinks notes/aliases.zsh → ~/.oh-my-zsh/custom/aliases.zsh. Copies notes/gitconfig.txt to ~/.gitconfig with prompted identity. |
systemd/
| File | Purpose |
|---|---|
apf-portal-infra@.service |
Template unit auto-starting ./infra/local/dev.sh up at boot for a given user. |