Complete set of steps for Debian installation with an NVidia card as of October 2024

[Willavu]

1. Check the health of your hard-drive

Code: Select all

sudo apt install smartmontools
sudo smartctl -t short -a /dev/sda
sudo smartctl -a /dev/sda

Look for the "Wear_Leveling_Count", which starts at 100 (healthy) and decreases toward 0 (dead). If it's well below 100, order a new NVMe or SATA SSD and postpone the installation until the replacement arrives.

2. Download and burn the ISO image from https://www.debian.org/distrib/netinst
# Insert a USB, learn its device, check that its space is sufficient for the image

Code: Select all

df -h

And write the ISO to USB:

Code: Select all

sudo dd status=progress if=<path-to-iso> of=/dev/<device>

3. BIOS

1) Disable PCIe power management entirely, to prevent Nvidia drivers from adjusting the voltage and cooling parameters:
Inside "Platform Misc Config", switch off all { PCE Express, PCH, ASPM, L1, ... , PEG-ASPM } -> [Disabled]
If this is not done, the video card might shut down shortly after waking up, rendering the entire system dysfunctional.
2) Enable re-bar 4G access:
1. PCI Subsystem
1. Above 4G -> Enabled
2. Re-Size BAR -> Auto
3. SR-IOV -> Disabled
3) Enable booting from the USB drive.

4. Boot up from USB and install Debian
1) The very first thing you've got to do once the Debian installation commences is press CTRL-ALT-F2 to drop into a text console, press ENTER to log in as an admin, and

Code: Select all

swapoff -a

If this is not done, the installation will refuse to proceed after specifying a password during the disk encryption setup step.
2) Make sure to encrypt your primary partition. Encrypted LVM is a sensible choice.
3) Do enter the root password during the installation.
4) Pick KDE plasma together with Debian desktop experience.
Now, this one begs some explanation. If you've tried KDE before and concluded that it's a complete clown fiesta with all its animations and inane graphical widgets wasting memory, CPU/GPU resources, and your time, I can assure you that you are absolutely 100% correct. I kid you not; they actually play an animation of a jumping app icon right on your mouse cursor every time you launch an application - it simply can't possibly get any worse. Well, just bear with me on this one: after turning off almost all of its functionality, it'll turn out to be a decent and performant desktop environment, with solid font rendering.
5) Wait for the installation to finish and boot up.

5. First things after booting up Debian for the first time
It loads up with the Nouveau Nvidia drivers, which either freezes or switches off your Nvidia card after suspend/resume. Therefore, the very first thing you need to do is to click Power Management on the system bar, and select "Manually block sleep and screen locking". This buys you some time to set things up.

1) Start with small things first like

1.1) System settings:
Input Devices > Keyboard > Advanced > Caps lock is Ctrl

1.2) Enable sudo for your user account:
CTRL-ALT-F2, log in under root

Code: Select all

usermod -aG sudo <username>

CTRL-ALT-F1 to return back to GUI

1.3) Ensure you have "noatime" for each partition in /etc/fstab (https://serverfault.com/questions/19969 ... filesystem)

Code: Select all

vi /etc/fstab

add "noatime" to ext4/ext3/ext2 options, e.g. "noatime,errors=remount-ro", "noatime,defaults"

1.4) Animation speed to instant. Replace wallpapers with a solid color of your choosing.

1.5) Desktop Effects: Give in to your reflexes, and when you see anything with the word "animation" in it, nuke it from orbit without thinking twice. If you do it properly, you'll have exactly 4 effects enabled:
1.5.1) "Invert", you can rebind the hotkeys to match the compiz negate plugin.
1.5.2) "Desaturate Unresponsive Applications"
1.5.3) "Dialog Parent"
1.5.4) "Overview", triggered by win-W.

2) Fonts and mc

Code: Select all

sudo apt install fonts-liberation mc

mc -> appearance -> "modarin256-defbg" -> save setup
You want to download and install monospace fonts for software engineering, like "ubuntu mono", "DejaVuLGCSansMono", "DroidFamily", "Inconsolata", "ProggyLcean", "monof55". All of them are available online for free.



6. Nvidia drivers
Follow the Debian wiki page to check if your Nvidia card is supported by the proprietary drivers. Assuming that you sport the latest RTX capable of running CUDA workload,

Code: Select all

sudo apt install build-essential
sudo vi /etc/apt/sources.list

Append "contrib" and "non-free" to every line, e.g.
deb http://deb.debian.org/debian/ bookworm main non-free-firmware contrib non-free

Code: Select all

sudo apt install linux-headers-$(uname -r)
sudo apt update

Install the NVIDIA drivers (do not reboot yet):

Code: Select all

sudo apt install nvidia-driver

Edit /etc/modprobe.d/nvidia-options.conf

Code: Select all

sudo vi /etc/modprobe.d/nvidia-options.conf

And ensure it has the following lines:

#options nvidia-current NVreg_DeviceFileUID=0 NVreg_DeviceFileGID=44 NVreg_DeviceFileMode=0660
options nvidia-drm fbdev=1
# To grant performance counter access to unprivileged users, uncomment the following line:
options nvidia-current NVreg_RestrictProfilingToAdminUsers=0
# Uncomment to enable this power management feature:
options nvidia-current NVreg_PreserveVideoMemoryAllocations=1
options nvidia NVreg_TemporaryFilePath=/var/tmp
# Uncomment to enable this power management feature:
options nvidia-current NVreg_EnableS0ixPowerManagement=1

Enable NVidia suspend/resume services:

Code: Select all

sudo systemctl status nvidia-suspend.service
# Run if the first command indicates these services are disabled.
sudo systemctl enable nvidia-suspend.service
sudo systemctl enable nvidia-hibernate.service
sudo systemctl enable nvidia-resume.service
sudo systemctl status nvidia-suspend.service

It should indicate the the service is enabled:

○ nvidia-suspend.service - NVIDIA system suspend actions
Loaded: loaded (/lib/systemd/system/nvidia-suspend.service; *enabled*; preset: enabled)

Now you can finally reboot your system to load the drivers

Code: Select all

sudo shutdown -r now

Make sure that you boot into an X11/Plasma session; Wayland will not work with these drivers.

Verify that the proprietary driver is now active:

Code: Select all

nvidia-smi

7. Set up Firefox extensions
7.1) uBlock Origin, add custom filter to block Google sign in popups:
"accounts.google.com/gsi/*"
7.2) adguard adblocker, flip all its settings on on except for "unlock advanced features"
7.3) Stylus to cut out unwanted divs and styles.

8. Set up ssh screen scrolling

Code: Select all

vi ~/.screenrc

Add the following lines:

shell "/usr/bin/bash"
termcapinfo xterm* ti@:te@

9. Set up CUDA drivers and miniconda. Miniconda will corrupt you $PATH in .bashrc file, make sure to edit it to, at the very least, swap the sequence. Setup a miniconda python environment with numpy, XGBoost, Optuna, Pytorch, etc

10. Install Node.js
Start by installing the nodejs package:

Code: Select all

sudo apt install nodejs npm

Now, you don't have to chown /usr/local, it's a habit I'm still trying to break. However, if running [n <arbitrary version to match the server setup>] is a must, and setting it all up locally has its own downsides, proceed with:

Code: Select all

sudo chown -R user /usr/local
mkdir /usr/local/n; sudo chown user /usr/local/n
npm install -g n
n lts

Once "n" is installed, it takes over Node.js management, so we can remove the Debian's nodejs packages:

Code: Select all

sudo apt purge nodejs
sudo apt autoremove
npm install -g pnpm

11. Attaching another encrypted disk

Code: Select all

sudo apt install smartmontools
sudo smartctl -t short -a /dev/sda
sudo smartctl -a /dev/sda

Look at "VALUE" of "Wear_Leveling_Count", it should be 100 or slightly below. Ignore "RAW_VALUE". 0=dead .. 100=healthy

Check the speed, compare against the promised throughput:

Code: Select all

sudo hdparm -tT /dev/sdb1

E.g. /dev/sdb1:
Timing cached reads: 39114 MB in 2.00 seconds = 19588.95 MB/sec
Timing buffered disk reads: 1466 MB in 3.00 seconds = 488.45 MB/sec

Code: Select all

# Erase everything
sudo wipefs -a /dev/sdc
# Optionally wipe all data before starting, to avoid damage from e.g. e2fsck erroneously recognizing former disk records.
# This takes forever (5+ hours), make sure it doesn't fall asleep
sudo dd status=progress oflag=sync if=/dev/urandom of=/dev/sdc bs=16M
# Create LUKS container
sudo cryptsetup luksFormat --type luks2 /dev/sdc
# Attach the device
sudo cryptsetup luksOpen /dev/sdc enc_sdc
# Ensure it exists
ls /dev/mapper
# Check the configured ext4 settings
less /etc/mke2fs.conf
sudo mke2fs -t ext4 /dev/mapper/enc_sdc
# Mount the file system
sudo mount /dev/mapper/enc_sdc /storage2

# Look up UUID
sudo blkid
#    UUID="15492e6e-890d-44b2-a581-805d1c287376"
sudo mkdir /etc/keys

# You can't edit files with the encryption key with "vi" because it'll auto-append new lines.
# You must enable mc's built-in editor in the option, then press SHIFT-F4 to create a file. E.g. create and edit the file  /etc/keys/crucial_key.key
sudo mc 
# Once the file is created, save it, and open the viewer, where you can switch to hexidecimal representation to ensure that the file contain exactly all characters of your key and nothing else.
# Ensure no trailing whitespaces or newlines.
sudo chmod 400 /etc/keys/crucial_key.key

# Attach the decrypted disk automatically during startup
sudo vi /etc/crypttab
#  ENTRY      UUID                                       KEY                       OPTIONS
# enc_sdb  UUID=15492e6e-890d-44b2-a581-805d1c287376  /etc/keys/crucial_key.key  luks,discard
systemctl daemon-reload
systemctl restart cryptsetup.target

sudo vi /etc/fstab
# /dev/mapper/enc_sdc  /storage   ext4  noatime,defaults   0   2
systemctl daemon-reload
sudo mount /storage

12. top
V = # toggle tree view & remove filter
o COMMAND=node # filter out all processes except those including "node"

0 # suppress zeros
t # cpu toggle
m # memory/swap toggle
z # enable color
c # full command line
f # fields: PID %CPU %MEM RES COMMAND TIME
S => off # no cumulative time reporting
W # write-config

13. Check and increase vm.max_map_count 65530 -> 1048576

Code: Select all

sysctl vm.max_map_count
sudo vi /etc/sysctl.conf

Append the line:

vm.max_map_count=1048576

And that, ladies and gentlemen, is exactly how you install Debian with an Nvidia card in October 2024.

[stevepusser]

Bullseye is not the current stable release.

[Willavu]

Bullseye is not the current stable release.

Oh, that was merely an example from my previous install. Updated in-place.

[stevepusser]

OK, but users will still need to install "build-essential" to get the compilers necessary to build the source code of the DKMS Nvidia packages.

Also, users will need to run nvidia-check to make sure they can use the 535 set of drivers; otherwise they'll need to use one of the legacy set of Nvidia drivers from the repos.

[Willavu]

Yes, sir, you're absolutely correct on all accounts. I remember that I did those steps indeed. I updated that section to refer to Debian wiki instead.

[sunrat]

Please edit your posts to enclose code in code tags. It makes it more readable and distinguishes code from other text in the post.

While this may be the way you set up your system, there are a few steps which are not necessary for a lot of users. Many people do not encrypt drives, and for me moving caps lock to Ctrl key would be terribly confusing. Fonts are a personal choice, vim is an advanced text editor and nano is the default for simple text edits. Node.js is certainly not needed for most users. I've never had to do the BIOS tweaks you mention.
Still, an interesting take on how one person sets up their system.

[Willavu]

Please edit your posts to enclose code in code tags. It makes it more readable and distinguishes code from other text in the post.

You've got it.

Many people do not encrypt drives

It's akin to not locking the door of your house, or leaving your car hood open. Although I admit that not locking your house doors is kinda customary where I live. I bet they'd get half of the account passwords auto-filled in Chrome, and Gmail won't even ask for a password, just boot up and you've got a few trophies. Linux's drive encryption has become easy and convenient, I know quite a few folks who routinely encrypt their USB sticks.

for me moving caps lock to Ctrl key would be

Man, you're missing on a lot of opportunities there!

Fonts are a personal choice

Those are monospace fonts specifically for software engineering, to read and write code. The standard fonts are lacking in that respect.

vim is an advanced text editor and nano is the default for simple text edits.

And I'm going to argue that we could do much better than that. Imagine the possibilities, we could replace all texts to use vi exclusively, and may be update the dns resolver to reroute all those stack overflow answers about how to exit vi to the standard VI documentation.
You can't exit the damn thing once you're there unless you know how, it's a perfect trap. You gotta hook them on the first dope while they are young, as my grandpa used to say!

I've never had to do the BIOS tweaks you mention.

Yeah, I spent 2 days trying out various options to successfully bring it back from suspend, and these steps worked for me. I know, it's a big problem for many people with Nvidia cards.

[enesha]

I think the previous posters were just trying to be explicit.

You make many changes...i.e. encryption. I will neither agree with or expound against, but many of those chages are non-functional for other people. Encryption is good. Blah blah leaving your door open, blah blah. Not your call for EVERYONE else - THEN you contradict yourself by negating the door thing by saying where you life unlocking doors is normal...So really who afre you to be judgy? You didn't say setup machine with key remap and encryption and blah blah, Would be more useful to people. Try saying In this section I will try encryption...Then I can ignore it. Yes you can DD a.iso...Is that really the most efficient? Ventoy or something else maybe? I ran along this as I had troubles switching the proprietary + cuda. Your post was simply useless.
Just warn people and don't have the arrogance that what you do is obviously the only way and no other way is possible. Many poeple come to linux so as to NOT be told what they can and can not do or install etc, and not be judged for those choices...

As Always
YMMV

Thx

[Willavu]

I will try encryption...Then I can ignore it.

I think you missed the point. If you're setting up a server that needs to start automatically, you don't use encryption (unless you have specialized hardware capable of handling startup).
If you're setting up a personal machine, you want to keep your W-2s, letters of your corporation formation, receipts for IRS, exchanges with your partners and customers, databases, etc private.
If your hard drive is not encrypted and your machine gets stolen (or breaks, and you forget to extract and destroy the hard drive), you'll leak all your documents with potentially devastating outcome.

It's as easy as that.

I ran along this as I had troubles switching the proprietary + cuda. Your post was simply useless.

When it comes to CUDA, nothing beats the official guide, CUDA installation
There's no point in reproducing any of its parts here, as it constantly changes.

What problems did you run into with CUDA?