Chris Lamb has a good [[http://www.chris-lamb.co.uk/2009/06/03/checklist-configuring-debian-system/|Debian installation checklist]], from which I stole most of this list.

{{{#!highlight sh

# Configure sudo, adding my user to the sudo group so I don't get password prompts
apt install sudo
adduser xjjk sudo
echo '%sudo ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group

# Disable installation of recommended packages
echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends

# Configure locales to prevent harassment about it later
apt install locales
export LANGUAGE=en_US.UTF-8
export LANG=en_US.UTF-8
export LC_ALL=en_US.UTF-8
locale-gen en_US.UTF-8
dpkg-reconfigure -plow locales
# …or install all locales so they don't need to be configured/reinstalled
apt install locales-all

# Enable log compression with date suffixed extension
cat /etc/logrotate.conf | sed "s/#compress/compress\ndateext/" > /etc/logrotate.conf.tmp
mv /etc/logrotate.conf.tmp /etc/logrotate.conf

# Disable root login—public key access only!
sed -i \
    -e "s/[#]*PermitRootLogin yes/PermitRootLogin without-password/g" \
    -e "s/AcceptEnv LANG LC_\*$/AcceptEnv LANG LC_\* TZ/" \
    /etc/ssh/sshd_config
service ssh restart

# Prevent PAM from allowing easily-crackable passwords
apt install libpam-cracklib

# Install essential utilities
sudo apt install \
openssh-server screen \
rsync \
atool lzma rzip xz-utils \
htop dstat iotop \
manpages manpages-dev \
strace tcpdump lsof \
less moreutils \
mosh \
dnsutils \
vim vim-pathogen vim-addon-manager vim-scripts \
bash-completion \
direnv \
sysfsutils procps \
vnstat \
unattended-upgrades \
ncurses-term \
molly-guard

# Optional stuff…
sudo apt install \
chrony \
cpufrequtils powertop

# Ensure enough entropy is always available
sudo apt install \
haveged rng-tools

# I hate rm
sudo apt install \
trash-cli

# Reduce bufferbloat
echo 'net.core.default_qdisc=fq_codel' > /etc/sysctl.d/reduce-bufferbloat.conf

# Enable automatic security updates (careful!)
sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure -plow unattended-upgrades

# HDD Temperature/SMART monitoring utilities
apt install hddtemp smartmontools
sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
/etc/init.d/smartmontools start

# Configure rsyslog for daily archival logging
cat << EOF > /etc/rsyslog.d/51-cron.conf
# Enable cron logging
cron.* /var/log/cron.log
EOF
cat << EOF > /etc/rsyslog.d/99-archive.conf
\$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log"
# Archive logging
*.* -?DailyLogs
EOF
cat << EOF > /etc/cron.daily/rsyslog-archive
#!/bin/sh
# Compress *.log-files not changed in more than 24 hours
find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
EOF
chmod +x /etc/cron.daily/rsyslog-archive

# Async logging for rsync (commit every 30m)
cat << EOF > /etc/rsyslog.d/98-async.conf
\$OMFileFlushInterval 1800
\$OMFileASyncWriting on
EOF

# Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
cat << EOF >> /etc/default/rcS
RAMRUN=yes
RAMLOCK=yes
EOF

# Allow running X11 apps remotely
sudo apt install xbase-clients

# Add noatime,commit=900 to entries in /etc/fstab

# Enable SATA ALPM
echo SATA_ALPM_ENABLE=true | sudo tee /etc/pm/config.d/sata_alpm

# Switch to systemd
sudo apt install systemd-sysv libpam-systemd
}}}

Other sources:

https://feeding.cloud.geek.nz/posts/usual-server-setup/

== New account setup ==

=== Remote ===

{{{#!highlight sh
# Quiet login
touch .hushlogin
cd ~
mkdir -p .ssh/controls
mkdir -p .vim/tmp
chmod -R 755 .ssh
chmod 644 .ssh/authorized_keys
}}}

=== Locally ===

{{{#!highlight sh
# Setup dot files
mkdir -p ~/src/git.other/
cd ~/src/git.other/
git clone https://github.com/samatjain/dotfiles.git
cd dotfiles
source init-dots
dots groups set base # Set addtl groups as necessary
dots install
}}}

=== Raspberry Pi stuff ===

{{{#!highlight sh
# Switch from wheezy to testing
cd /etc/apt/
sed -i 's/wheezy/testing/g' /etc/apt/sources.list
#sudo find . -type f -exec sed -i 's/wheezy/testing/g' {} \;

# Disable tty2–tty6
sed -i '/[2-6]:23:respawn:\/sbin\/getty 38400 tty[2-6]/s%^%#%g' /etc/inittab
# Disable tty on serial line
sed -i '/T0:23:respawn:\/sbin\/getty -L ttyAMA0 115200 vt100/s%^%#%g' /etc/inittab

# Optimize mounts
sed -i 's/defaults,noatime/defaults,noatime,nodiratime/g' /etc/fstab

# Overclock to 800 Mhz (no overvolting required). Overclocking not forced, but keep it on for the first 2 min during boot
echo -e "arm_freq=800\nsdram_freq=400\ncore_freq=300\nforce_turbo=0\ninitial_turbo=120" >> /boot/config.txt

# Use only 16 MiB for GPU (only run after updating firmware!)
echo -e "gpu_mem=16" >> /boot/config.txt

# Enable IPv6 for Avahi
sudo sed -i 's/mdns4_minimal/mdns_minimal/g' /etc/nsswitch.conf

# Delete default 'pi' user
sudo deluser --remove-all-files pi

}}}

Some of these are from [[https://extremeshok.com/1081/raspberry-pi-raspbian-tuning-optimising-optimizing-for-reduced-memory-usage/|Raspberry Pi Raspbian tuning / optimising / optimizing for reduced memory usage]]