diff --git a/editions/cloud/fstab b/editions/cloud/fstab new file mode 100644 index 0000000..2559d28 --- /dev/null +++ b/editions/cloud/fstab @@ -0,0 +1,9 @@ +# Arcline Cloud — /etc/fstab template +# Same layout as the other editions; btrfs-init.sh resolves the root UUID. + +UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0 +UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0 +UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0 +UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0 + +/swap/swapfile none swap sw 0 0 diff --git a/editions/cloud/kernel.cmdline b/editions/cloud/kernel.cmdline new file mode 100644 index 0000000..c793ad9 --- /dev/null +++ b/editions/cloud/kernel.cmdline @@ -0,0 +1,28 @@ +# Arcline Cloud — kernel command line +# Same hardening baseline, serial console for cloud serial ports, no graphics. + +console=tty0 +console=ttyS0,115200n8 +quiet +loglevel=3 +systemd.show_status=auto + +# hardening +init_on_alloc=1 +init_on_free=1 +slab_nomerge +page_poison=1 +pti=on +spectre_v2=on +spec_store_bypass=on +tsx=off +lockdown=integrity +oops=panic +panic=-1 + +# cloud / disk +net.ifnames=0 +biosdevname=0 + +# btrfs / storage +rootflags=subvol=@ diff --git a/editions/cloud/metadata.yaml b/editions/cloud/metadata.yaml new file mode 100644 index 0000000..acdf155 --- /dev/null +++ b/editions/cloud/metadata.yaml @@ -0,0 +1,36 @@ +# Edition manifest: Arcline Cloud +# Codename: nimbus +edition: cloud +codename: nimbus +summary: Minimal base images optimized for cloud infrastructures. +description: > + Designed for AWS, GCP, Azure, or your own private cloud. Uses the cloud + kernel, cloud-init for first-boot provisioning, and a networkd-first + network stack. Same hardening baseline as server. + +image: + type: iso + boot: bios+efi + filesystem: btrfs + compression: zstd:3 + +packages: + extra_repos: [] + +users: + - arcline + +services: + enabled: + - systemd-networkd + - systemd-resolved + - cloud-init + - cloud-init-local + - ssh + - nftables + - apparmor + - qemu-guest-agent + - arcline-snapshot.timer + masked: + - apt-daily.timer + - apt-daily-upgrade.timer diff --git a/editions/cloud/packages.list b/editions/cloud/packages.list new file mode 100644 index 0000000..a808b59 --- /dev/null +++ b/editions/cloud/packages.list @@ -0,0 +1,60 @@ +# Arcline Cloud — package set +# Minimal footprint: cloud kernel, cloud-init, guest agents, storage tooling. + +# ── base system ───────────────────────────────────────────────────────────── +systemd +systemd-sysv +dbus +libpam-systemd +ca-certificates +locales +tzdata + +# ── boot ──────────────────────────────────────────────────────────────────── +grub-pc +grub-efi-amd64 +shim-signed + +# ── kernel (cloud variant) ────────────────────────────────────────────────── +linux-image-cloud-amd64 + +# ── filesystem ────────────────────────────────────────────────────────────── +btrfs-progs +zstd +xz-utils + +# ── cloud provisioning ────────────────────────────────────────────────────── +cloud-init +cloud-guest-utils +cloud-image-utils +open-vm-tools +qemu-guest-agent + +# ── storage / block devices ───────────────────────────────────────────────── +nvme-cli +open-iscsi +multipath-tools +lvm2 +mdadm + +# ── security / hardening ──────────────────────────────────────────────────── +openssh-server +nftables +apparmor +apparmor-utils + +# ── observability (Debian-main components) ───────────────────────────────── +prometheus-node-exporter + +# ── minimal admin tooling ─────────────────────────────────────────────────── +curl +jq +git +rsync +htop +vim-tiny + +# ── Arcline toolchain (built from toolchain/) ─────────────────────────────── +# arcline-uptime arcline-check arcline-audit arcline-dns +# arcline-vault arcline-email arcline-migrate arcline-billing +# arcline-portal arcline-website arcline-status diff --git a/editions/server/fstab b/editions/server/fstab new file mode 100644 index 0000000..73d1e24 --- /dev/null +++ b/editions/server/fstab @@ -0,0 +1,16 @@ +# Arcline Server — /etc/fstab template +# +# This is a TEMPLATE. btrfs-init.sh resolves the real root device UUID at +# install/first-boot time and writes /etc/fstab. The subvolume layout matches +# docs/btrfs.md. +# +# Device UUID is substituted by the installer. + +# +UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0 +UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0 +UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0 +UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0 + +# swap +/swap/swapfile none swap sw 0 0 diff --git a/editions/server/kernel.cmdline b/editions/server/kernel.cmdline new file mode 100644 index 0000000..ad7226f --- /dev/null +++ b/editions/server/kernel.cmdline @@ -0,0 +1,35 @@ +# Arcline Server — kernel command line +# Hardening flags + console config. Kept explicit and auditable. +# +# Security notes: +# init_on_alloc / init_on_free — zero freshly allocated/freed memory +# slab_nomerge — disable merging of similar slab objects +# page_poison=1 — fill freed pages to catch use-after-free +# pti=on — kernel page-table isolation +# spectre_v2=on spec_store_bypass=on — mitigations on (no auto-off) +# tsx=off — disable TSX (TAA mitigations) +# lockdown=integrity — block unsigned kernel modifications +# oops=panic panic=-1 — panic (and stay down) on oops +# quiet loglevel=3 — quiet serial console boot + +console=tty0 +console=ttyS0,115200n8 +quiet +loglevel=3 +systemd.show_status=auto + +# hardening +init_on_alloc=1 +init_on_free=1 +slab_nomerge +page_poison=1 +pti=on +spectre_v2=on +spec_store_bypass=on +tsx=off +lockdown=integrity +oops=panic +panic=-1 + +# btrfs / storage +rootflags=subvol=@ diff --git a/editions/server/metadata.yaml b/editions/server/metadata.yaml new file mode 100644 index 0000000..47fc7dc --- /dev/null +++ b/editions/server/metadata.yaml @@ -0,0 +1,37 @@ +# Edition manifest: Arcline Server +# Codename: bastion +edition: server +codename: bastion +summary: Hardened, production-ready server OS with built-in observability and zero telemetry. +description: > + Runs applications on bare metal or in the cloud. Ships with a default-deny + nftables firewall, AppArmor + seccomp, btrfs root with snapshot rollback, + Docker + Podman, and a pre-configured Prometheus / Grafana / Loki stack. + +image: + type: iso + boot: bios+efi + filesystem: btrfs + compression: zstd:3 + +packages: + # Upstream repos added before package install (name -> [url, suite, component]). + extra_repos: [] + +users: + # Accounts created at first boot by the installer/configure hook. + - arcline + +services: + # systemd units enabled by default. + enabled: + - systemd-networkd + - systemd-resolved + - ssh + - nftables + - apparmor + - prometheus-node-exporter + - arcline-snapshot.timer + masked: + - apt-daily.timer + - apt-daily-upgrade.timer diff --git a/editions/server/packages.list b/editions/server/packages.list new file mode 100644 index 0000000..7d65a09 --- /dev/null +++ b/editions/server/packages.list @@ -0,0 +1,74 @@ +# Arcline Server — package set +# Debian bookworm packages. Lines beginning with # are notes/optional. +# The configure hook installs the Arcline toolchain and observability +# components that are not in Debian main (grafana, loki). + +# ── base system ───────────────────────────────────────────────────────────── +systemd +systemd-sysv +dbus +libpam-systemd +ca-certificates +locales +tzdata + +# ── boot ──────────────────────────────────────────────────────────────────── +grub-pc +grub-efi-amd64 +shim-signed +os-prober + +# ── kernel / firmware ─────────────────────────────────────────────────────── +linux-image-amd64 +firmware-linux-free + +# ── filesystem ────────────────────────────────────────────────────────────── +btrfs-progs +snapper +zstd +xz-utils + +# ── security / hardening ──────────────────────────────────────────────────── +openssh-server +nftables +apparmor +apparmor-utils +fail2ban +unattended-upgrades +libpam-pwquality + +# ── containers ────────────────────────────────────────────────────────────── +docker.io +podman +runc +containernetworking-plugins +fuse-overlayfs +slirp4netns + +# ── observability (Debian-main components) ───────────────────────────────── +prometheus +prometheus-node-exporter +prometheus-alertmanager +# grafana + loki are fetched from upstream repos by configure-system.sh + +# ── admin tooling ─────────────────────────────────────────────────────────── +curl +wget +jq +git +make +rsync +htop +tmux +vim-tiny +unzip +file +ethtool +sysstat +chrony +needrestart + +# ── Arcline toolchain (built from toolchain/) ─────────────────────────────── +# arcline-uptime arcline-check arcline-audit arcline-dns +# arcline-vault arcline-email arcline-migrate arcline-billing +# arcline-portal arcline-website arcline-status diff --git a/editions/workstation/fstab b/editions/workstation/fstab new file mode 100644 index 0000000..99515e5 --- /dev/null +++ b/editions/workstation/fstab @@ -0,0 +1,10 @@ +# Arcline Workstation — /etc/fstab template +# See editions/server/fstab for the layout notes. btrfs-init.sh resolves the +# root UUID at install time. + +UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0 +UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0 +UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0 +UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0 + +/swap/swapfile none swap sw 0 0 diff --git a/editions/workstation/kernel.cmdline b/editions/workstation/kernel.cmdline new file mode 100644 index 0000000..beb1480 --- /dev/null +++ b/editions/workstation/kernel.cmdline @@ -0,0 +1,24 @@ +# Arcline Workstation — kernel command line +# Same hardening baseline as server, without the serial console and with +# graphics-friendly settings. + +console=tty0 +quiet +loglevel=3 +systemd.show_status=auto + +# hardening +init_on_alloc=1 +init_on_free=1 +slab_nomerge +page_poison=1 +pti=on +spectre_v2=on +spec_store_bypass=on +tsx=off +lockdown=integrity +oops=panic +panic=-1 + +# btrfs / storage +rootflags=subvol=@ diff --git a/editions/workstation/metadata.yaml b/editions/workstation/metadata.yaml new file mode 100644 index 0000000..61b31f2 --- /dev/null +++ b/editions/workstation/metadata.yaml @@ -0,0 +1,33 @@ +# Edition manifest: Arcline Workstation +# Codename: forge +edition: workstation +codename: forge +summary: Same hardened base with a lightweight KDE Plasma desktop and pre-configured dev toolchains. +description: > + A hardened daily driver. Lightweight KDE Plasma, privacy-hardened browser + profiles, pre-configured Go / Rust / Python / Node toolchains, and the same + zero-telemetry, default-deny firewall as the server edition. + +image: + type: iso + boot: bios+efi + filesystem: btrfs + compression: zstd:3 + +packages: + extra_repos: [] + +users: + - arcline + +services: + enabled: + - systemd-networkd + - systemd-resolved + - nftables + - apparmor + - sddm + - arcline-snapshot.timer + masked: + - apt-daily.timer + - apt-daily-upgrade.timer diff --git a/editions/workstation/packages.list b/editions/workstation/packages.list new file mode 100644 index 0000000..69ed45d --- /dev/null +++ b/editions/workstation/packages.list @@ -0,0 +1,101 @@ +# Arcline Workstation — package set +# Curated KDE Plasma desktop (not the full task-* meta-package) plus a +# complete developer toolchain. + +# ── base system ───────────────────────────────────────────────────────────── +systemd +systemd-sysv +dbus +libpam-systemd +ca-certificates +locales +tzdata + +# ── boot ──────────────────────────────────────────────────────────────────── +grub-pc +grub-efi-amd64 +shim-signed +os-prober + +# ── kernel / firmware ─────────────────────────────────────────────────────── +linux-image-amd64 +firmware-linux-free +firmware-misc-nonfree # broadcom/intel wifi + gpu firmware + +# ── filesystem ────────────────────────────────────────────────────────────── +btrfs-progs +snapper +zstd +xz-utils + +# ── desktop: X + KDE Plasma ───────────────────────────────────────────────── +xserver-xorg +xinit +plasma-desktop +sddm +konsole +dolphin +kate +ark +gwenview +plasma-discover +network-manager +network-manager-gnome +pipewire +pipewire-pulse +wireplumber +pulseaudio-utils + +# ── display / audio / input extras ────────────────────────────────────────── +fonts-noto-core +fonts-liberation +firefox-esr + +# ── security / hardening ──────────────────────────────────────────────────── +openssh-server +nftables +apparmor +apparmor-utils +fail2ban + +# ── developer toolchain ───────────────────────────────────────────────────── +build-essential +gcc +g++ +clang +clang-format +llvm +lld +gdb +cmake +ninja-build +pkg-config +golang-go +rustc +cargo +python3 +python3-pip +python3-venv +nodejs +npm +git +make +curl +wget +jq +vim +nano +htop +tmux +ripgrep +fd-find +bat +docker.io +podman +runc +containernetworking-plugins + +# ── Arcline toolchain (built from toolchain/) ─────────────────────────────── +# arcline-uptime arcline-check arcline-audit arcline-dns +# arcline-vault arcline-email arcline-migrate arcline-billing +# arcline-portal arcline-website arcline-status