My Debian Desktop post-installation steps

debian-gnome-post-installation.md

Debian GNOME Desktop post-installation steps

Make sure you do not set a root password during installation, so that your user is automatically added to the sudo group.

Cleaning

Clean up unused packages:

sudo apt -o 'Apt::AutoRemove::SuggestsImportant=false' autopurge evolution im-config nano vim+

Flatpak

Set up flatpak, flathub and install bitwarden and signal as flatpak:

sudo apt install flatpak gnome-software-plugin-flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install app/com.bitwarden.desktop/x86_64/stable app/org.signal.Signal/x86_64/stable

Fancy boot

Reset GRUB menu colours, remove Debian's blue menu colour:

echo 'set menu_color_normal="white/black"' | sudo tee -a /etc/grub.d/40_custom
echo 'set menu_color_highlight="black/light-gray"' | sudo tee -a /etc/grub.d/40_custom

Set up Plymouth and quiet boot for a nice boot animation, and configure GRUB (remember to adjust the resolution in GRUB_GFXMODE if necessary):

sudo apt install plymouth-themes
sudo plymouth-set-default-theme -R bgrt
sudo mkdir -p /etc/default/grub.d
sudo tee /etc/default/grub.d/50-custom-settings.cfg << 'END'
# Append the following parameters to GRUB_CMDLINE_LINUX_DEFAULT to enable Plymouth and hide errors at boot time
GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT loglevel=3 splash"

# Disable the default GRUB wallpaper
GRUB_BACKGROUND=""
END

sudo update-grub

Optional

Locales

Enable any additional system locales. Adapt to your needs:

sudo dpkg-reconfigure locales
sudo apt install task-german task-german-desktop
sudo flatpak config languages --set 'en;de' && flatpak update

and then adjust the locale and language settings in GNOME, Firefox, Libreoffice, etc.

Easy updates

Enable easy updates without restarting your computer:

echo "%sudo	ALL=(ALL:ALL) NOPASSWD:/usr/bin/apt update, /usr/bin/apt upgrade" | sudo tee /etc/sudoers.d/update

and now create a new shortcut with the following command:

gnome-terminal -- bash -c 'sudo apt update && sudo apt upgrade && flatpak update; exec bash'

Unlock encrypted root using TPM 2.0 and an optional PIN

Install and clean up necessary packages (we will be switching to dracut):

sudo apt install dracut systemd-cryptsetup tpm2-tools
sudo apt -o 'Apt::AutoRemove::SuggestsImportant=false' autopurge

Enroll LUKS key in TPM (replace <crypt_root> with your device):

sudo systemd-cryptenroll --tpm2-device=auto --tpm2-with-pin=yes /dev/<crypt_root>

Add the rd.auto kernel parameter:

sudoedit /etc/default/grub.d/50-custom-settings.cfg
sudo update-grub

Remove or uncomment the root device in /etc/crypttab:

sudoedit /etc/crypttab

Regenerate initrd for the currently running kernel and reboot to test the changes. Make sure you have other kernels with unmodified initrds installed in case of boot problems:

sudo dracut -f
sudo reboot

Kernel backports

If running on very new hardware: enable the backports repository and install a later kernel from it:

source /etc/os-release
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" | sudo tee /etc/apt/sources.list.d/backports.list
sudo apt update && sudo apt install -t ${VERSION_CODENAME}-backports linux-image-amd64

AMDGPU power saving

Add a udev rule to automatically set the GPU to a low-power profile:

echo 'KERNEL=="card0", SUBSYSTEM=="drm", DRIVERS=="amdgpu", ATTR{device/power_dpm_force_performance_level}="manual", ATTR{device/pp_power_profile_mode}="2"' | sudo tee /etc/udev/rules.d/50-amdgpu-powersave.rules

Apply new rule:

sudo udevadm control --reload
sudo udevadm trigger

Check the result:

cat /sys/class/drm/card0/device/pp_power_profile_mode