Cross-platform setup installer

A single script that takes a fresh machine from stock to usable:

• switches system package mirrors to USTC mirrors
• installs basic packages: curl, git, htop, neovim
• sets up virtualization on headless servers: libvirt/QEMU with KVM acceleration (virsh, virt-install) on Debian, bhyve/vm-bhyve on FreeBSD — skipped on macOS
• sets up Homebrew / Linuxbrew with BFSU mirrors
• installs the Nix package manager (Linux: multi-user daemon, macOS: default)
• initializes an ed25519 SSH key for the target user (if missing)
• bootstraps sudo for the target user (minimal installs)
• supports a server/client profile: client skips the virtualization stack and grants passwordless sudo; server (default) installs everything

One-line install

No clone needed — pipe the script straight from GitHub. Each platform has its own prerequisite step (bootstrap curl, sudo, etc. via its package manager) followed by the script itself. A single URL is shared:

https://raw.githubusercontent.com/cassiuscai/config/master/install.sh

Debian

Both steps must run as root (via sudo or a root shell). The script itself requires root on Debian — it rewrites apt sources, installs packages, and writes /etc/sudoers.d/.

Step 1 — apt prerequisites (only needed on a minimal install that lacks curl/sudo; skip if they're already present). Run as root:

# run as root: sudo -i  (or prefix with sudo)
apt-get update && apt-get install -y sudo curl

Step 2 — run the script (already elevates via sudo). Replace <username> with your target user and <profile> with one of server / client:

# elevated to root automatically by sudo
curl -fsSL https://raw.githubusercontent.com/cassiuscai/config/master/install.sh \
  | sudo bash -s -- --username <username> --profile <profile>

If curl and sudo are already installed, step 1 can be omitted and you can pipe the script directly.

FreeBSD

Both steps must run as root — the script configures pkg mirrors, installs packages, and writes /usr/local/etc/sudoers.d/. Login as root directly or use su -.

Step 1 — pkg prerequisites (minimal installs without curl/sudo). Run as root:

# run in a root shell: su -   (or via doas/sudo)
pkg update -f && pkg install -y curl sudo

Step 2 — run the script as root:

# run as root: su -  (do NOT need sudo on FreeBSD — be root already)
curl -fsSL https://raw.githubusercontent.com/cassiuscai/config/master/install.sh \
  | bash -s -- --username <username> --profile <profile>

macOS

Run as your own (admin) user — no root required and no prerequisites. Homebrew installs into your user-owned directories (/opt/homebrew on Apple Silicon, /usr/local on Intel), so elevation is not needed; the Nix step may prompt for your password:

# run as your normal admin user; no sudo
curl -fsSL https://raw.githubusercontent.com/cassiuscai/config/master/install.sh | bash

The script uses bash features (arrays, [[ ]]), so pipe it to bash — not sh (on Debian sh is dash and will fail).

Both --username and --profile are optional:

• --username: without it, the target user is resolved from $SUDO_USER (when run via sudo) or the current user (macOS).
• --profile (server|client): without it, the script prompts. A piped (non-tty) install can't prompt, so pass --profile <value> explicitly when using curl | bash. When it can't prompt for a username either, pass both flags.

Supported platforms

Platform	Package manager	Mirror	Homebrew	Nix	Virtualization
Debian 12 (bookworm), 13 (trixie)	apt (deb822)	mirrors.ustc.edu.cn/debian	Linuxbrew at /home/linuxbrew/.linuxbrew	multi-user daemon	libvirt/QEMU + KVM (virsh, virt-install)
macOS (Intel & Apple Silicon)	Homebrew	mirrors.bfsu.edu.cn (brew / core / cask / bottles)	Native Homebrew	multi-user daemon	none — skipped
FreeBSD 14+	pkg	mirrors.ustc.edu.cn/freebsd-pkg	not supported — pkg covers packages	not supported	bhyve + vm-bhyve

FreeBSD: Homebrew/Linuxbrew and Nix do not support FreeBSD. The script keeps FreeBSD on its native pkg manager and skips both steps.

From a local checkout

# Debian / FreeBSD — REQUIRED: run as root, e.g. sudo ./install.sh ...
sudo ./install.sh [--username USER] [--profile server|client]

# macOS — run as your own (admin) user; NO root/sudo needed
./install.sh [--username USER] [--profile server|client]

On a minimal Debian/FreeBSD install without curl or sudo, run directly as root (a real root shell, since sudo may not exist yet) — the script installs both itself:

# must run in a root shell: sudo -i / su -   (sudo itself may be missing)
./install.sh [--username USER] [--profile server|client]

The target user is chosen in this order:

1. --username, if given
2. $SUDO_USER — the user who invoked sudo
3. the current user (macOS / direct non-root run)
4. an interactive prompt (root with no sudo context) — the sole login user is suggested

That user gets sudo privileges and owns the Homebrew/Linuxbrew install.

If --profile is not given, the script prompts to select a profile. The suggested default is detected automatically: client when running inside a virtual machine, server on bare metal. VM detection is cross-platform — Linux (systemd-detect-virt / DMI / cpuinfo), FreeBSD & DragonFly (sysctl kern.vm_guest), OpenBSD & NetBSD (hw.vendor/hw.product/DMI), and Solaris/illumos (smbios) — so the correct default is picked regardless of whether the host OS is Debian, a BSD, or Solaris.

Profiles

The --profile flag selects between two setup profiles, supported on every platform:

Profile	Virtualization (vmm)	sudo for target user
server	Installed	password-protected
client	Skipped (no VM management)	passwordless (NOPASSWD:ALL)

• server — full setup: packages, Homebrew, Nix, and the virtualization stack (libvirt/QEMU+KVM on Debian, bhyve/vm-bhyve on FreeBSD). sudo keeps the normal password prompt. Default on bare metal.
• client — a workstation/virtual-machine guest with no local VMs: skips the vmm step on all platforms (macOS has none anyway) and grants the target user passwordless sudo. Default inside a virtual machine.

All non-vmm steps (mirrors, packages, Homebrew, Nix, SSH key) run identically in both profiles.

What happens per platform

Debian — rewrites /etc/apt/sources.list.d/debian.sources (deb822 format) to mirrors.ustc.edu.cn for the detected release (trixie / bookworm), disables any legacy one-line sources.list, runs apt-get update, installs the basic packages, then installs Linuxbrew into /home/linuxbrew by cloning the BFSU brew installer (git/bottle/API mirrors all point at mirrors.bfsu.edu.cn; profile at /etc/profile.d/linuxbrew.sh), and finally installs Nix in multi-user daemon mode: curl ... https://mirrors.bfsu.edu.cn/nix/latest/install | sh -s -- --daemon.

Then it sets up the vmm stack — libvirt/QEMU with KVM acceleration (server profile only): libvirt-daemon-system, libvirt-clients, virtinst, qemu-system-x86, qemu-utils. It enables the libvirtd service, adds the user to the libvirt and kvm groups, and starts libvirt's default NAT network — so virsh and virt-install work out of the box on a headless server (no GUI tools are installed). If /dev/kvm is missing, a warning is printed and VMs fall back to software emulation. The client profile skips this step and grants the user passwordless sudo instead.

macOS — writes the HOMEBREW_* BFSU mirror exports into ~/.zprofile, installs Homebrew (if missing) from the cloned BFSU installer, then brew install curl git htop neovim just, and installs Nix with the official installer (defaults to the multi-user daemon via launchd; it may prompt for your sudo password). No virtualization stack is installed on macOS.

FreeBSD — configures /usr/local/etc/pkg.conf to use mirrors.ustc.edu.cn/freebsd-pkg (with ${ABI} substitution), runs pkg update -f, installs the basic packages, installs sudo and adds the user to the wheel group. It then sets up the vmm stack — bhyve (the native hypervisor, KVM's counterpart) with vm-bhyve and bhyve-firmware: loads the vmm kernel module now and at boot (/boot/loader.conf), enables tap interfaces (net.link.tap.up_on_open=1), enables the vm rc service, and initializes the VM directory with vm init. Homebrew and Nix are skipped (unsupported).

All three platforms run the same SSH step: if ~/.ssh/id_ed25519 doesn't exist, a passphrase-less ed25519 key is created for the target user, with no comment (email) embedded.

Extending: add a platform

The script is built around a small, explicit platform contract. To support a new OS:

1. Register the OS id in SUPPORTED_OS:

   SUPPORTED_OS=(debian macos freebsd arch)

2. Extend detect_os() to recognize it (usually via /etc/os-release).

3. Implement the six step functions — a step may be a no-op returning 0:

   platform_sudo_arch()      { ... }   # ensure <user> has sudo access
   platform_mirror_arch()    { ... }   # switch mirrors; nonzero aborts the rest
   platform_packages_arch()  { ... }   # install ${BASIC_PACKAGES[@]}
   platform_brew_arch()      { ... }   # set up Homebrew, or a no-op
   platform_nix_arch()       { ... }   # install Nix, or a no-op
   platform_ssh_arch()       { ... }   # init an SSH key, or a no-op

   Optionally, a virtualization stack (define only if the platform should get one — macOS deliberately omits it):

   platform_vmm_arch()       { ... }   # set up virsh/QEMU, vm-bhyve, etc.

4. Only if the platform does not need root:

   platform_requires_root_arch() { return 1; }

Dispatch is automatic — run_platform_step looks up <step>_<os> by name and skips (with a warning) any step that has no handler. See the Platform registry section in install.sh for the full contract.

Notes

• On Debian, the libvirt and kvm group memberships apply to new login sessions — log out and back in before using virsh as a non-root user.
• The script makes the host VM-ready; create machines afterwards with virt-install (Debian) or sudo vm create (FreeBSD). virsh runs without root after a fresh login; vm is run via sudo.
• Homebrew refuses to run as root. If you install as root, run sudo ./install.sh <non-root-user> so that user owns the Homebrew install.
• The macOS Nix installer may prompt for your sudo password interactively — run the script in a terminal, not from a non-interactive context.
• The SSH key is created passphrase-less and with no email comment so the bootstrap runs non-interactively; add a passphrase later with ssh-keygen -p.
• apt-get update / pkg update failures abort the remaining steps so you can fix network or keyring issues first.
• USTC mirror references: https://mirrors.ustc.edu.cn (system package mirrors)
• BFSU mirror references: https://mirrors.bfsu.edu.cn (Homebrew / Linuxbrew)

License

Apache-2.0 — see LICENSE.