Debian
Boring on purpose. What I run on my desktops and my servers.
Debian runs everywhere, and every VPS host has an image for it, Hetzner included. That’s most of the reason right there. I want the same system on the laptop in front of me and on a machine in a rack somewhere, so a toolchain I set up once works in both places and I’m not maintaining two of everything. It stays light enough for that to be comfortable, and it still has drivers for hardware old enough that other distributions have stopped caring.
I came from Alpine Linux and left for two specific reasons. musl kept getting in the way of software that assumes glibc, Minecraft among it. And I could never get Plymouth working there, which matters to me because Owl is supposed to boot straight into an editor, and a wall of kernel messages is not that.
The packages are old and boring. I love this and I resent it, usually in the same week. Old means what I installed keeps working and nothing surprises me on a Tuesday. Boring means that when I want a current version of something, I’m the one who has to go get it.
Rust Comes from apt
That trade in miniature. Trixie ships rustc 1.85 and that’s what I build with, no rustup, because the whole point of running Debian everywhere is that the toolchain is the same everywhere.
The cost shows up as pins. Two of Owl’s transitive dependencies are held back in its lockfile because their newer versions want a compiler Debian doesn’t have yet. wasm-bindgen isn’t packaged at all, which is why Owl’s browser build reaches WebAssembly over a boundary I wrote by hand, and why the Rust web frameworks are all out of reach for now.
Trixie Dropped i386
Debian 13 stopped putting out i386 ISOs, so genuinely old 32-bit hardware goes to AntiX instead. AntiX is Debian-derived, so apt behaves the same and what builds on one builds on the other.
Installing
The quickest way in is the text-based installer. Debian’s installer has decent support for a lot of WiFi hardware, but it’s still worth having a USB adapter on hand that you know works. I’ve had luck with the BrosTrend 650Mbps.
Reset the SSH Host Keys
Especially on a VPS, generate the host’s keys yourself rather than trusting whatever the image shipped with.
rm -v /etc/ssh/ssh_host_*
dpkg-reconfigure openssh-server
systemctl restart ssh
Vim
It’s easiest for me to edit files in Vim, so that goes on early.
sudo apt install vim
sudo update-alternatives --config editor
Keys and Dotfiles
My private keys live on a Yubikey, so GPG has to be set up and told to act as the SSH agent.
sudo apt install gpg scdaemon yubikey-manager
wget -qO - https://jeremyboles.com/public.pgp | gpg --import -
Add to .gnupg/gpg-agent.conf:
enable-ssh-support
Add to .bashrc:
GPG_TTY="$(tty)"
export GPG_TTY
SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
export SSH_AUTH_SOCK
Then chezmoi for the dotfiles and pass for the secrets. chezmoi is the one thing here that doesn’t come from apt.
sh -c "$(wget -qO- get.chezmoi.io/lb)"
sudo apt install pass
Sound
sudo apt install pipewire-audio
sudo reboot
Log back in as your normal user. The quickest way to tell whether it worked is to play something:
sudo apt install mpg123
mpg123 test.mp3
A Graphical Environment
The window manager and its setup live on the Awesome page. The one piece that belongs here is a graphical pinentry, so GPG can prompt you outside a terminal.
sudo apt install pinentry-gtk2
Bluetooth
sudo apt install bluetooth bluez
bluetoothctl
scan on
pair [DEVICE ID]
trust [DEVICE ID]
quit
The Boot Splash
A fresh install puts Plymouth on the disk and then doesn’t tell GRUB to use it, so the first boot is a wall of text and a graceless password prompt to unlock the disk. Add splash to GRUB_CMDLINE_LINUX_DEFAULT:
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
Editing that file changes nothing on its own. Regenerate the config so it takes:
sudo update-grub
Every machine needs this. It’s a Debian thing, not a per-machine thing.
Spellbook
Add a User
sudo adduser jeremy
sudo usermod -aG sudo jeremy
Delete a User and Their Files
sudo deluser --remove-all-files --remove-home jeremy
Upgrade to the Next Release
Swap the codename, then pull the whole thing forward. This one was bookworm to trixie.
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
sudo apt update
sudo apt dist-upgrade --autoremove
sudo reboot
After the reboot, move the sources file to the newer format:
sudo apt modernize-sources
Allow GPG Agent Forwarding
In 20_stream_local_bind_unlink.conf:
StreamLocalBindUnlink yes
Each of these was one bad afternoon, once. That’s the bargain: Debian asks for the afternoon up front and then leaves you alone for years.