feat: add server, workstation, and cloud edition manifests

Define the three flagship editions as plain-text manifests:

- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.

Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.

editions/cloud/fstab

@@ -0,0 +1,9 @@
+# Arcline Cloud — /etc/fstab template
+# Same layout as the other editions; btrfs-init.sh resolves the root UUID.
+
+UUID=__ROOT_UUID__ /             btrfs   rw,noatime,compress=zstd:3,subvol=@       0 0
+UUID=__ROOT_UUID__ /home         btrfs   rw,noatime,compress=zstd:3,subvol=@home   0 0
+UUID=__ROOT_UUID__ /var/log      btrfs   rw,noatime,compress=zstd:3,subvol=@log    0 0
+UUID=__ROOT_UUID__ /.snapshots   btrfs   rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
+
+/swap/swapfile                  none    swap    sw                          0      0

editions/cloud/kernel.cmdline

@@ -0,0 +1,28 @@
+# Arcline Cloud — kernel command line
+# Same hardening baseline, serial console for cloud serial ports, no graphics.
+
+console=tty0
+console=ttyS0,115200n8
+quiet
+loglevel=3
+systemd.show_status=auto
+
+# hardening
+init_on_alloc=1
+init_on_free=1
+slab_nomerge
+page_poison=1
+pti=on
+spectre_v2=on
+spec_store_bypass=on
+tsx=off
+lockdown=integrity
+oops=panic
+panic=-1
+
+# cloud / disk
+net.ifnames=0
+biosdevname=0
+
+# btrfs / storage
+rootflags=subvol=@

editions/cloud/metadata.yaml

@@ -0,0 +1,36 @@
+# Edition manifest: Arcline Cloud
+# Codename: nimbus
+edition: cloud
+codename: nimbus
+summary: Minimal base images optimized for cloud infrastructures.
+description: >
+  Designed for AWS, GCP, Azure, or your own private cloud. Uses the cloud
+  kernel, cloud-init for first-boot provisioning, and a networkd-first
+  network stack. Same hardening baseline as server.
+
+image:
+  type: iso
+  boot: bios+efi
+  filesystem: btrfs
+  compression: zstd:3
+
+packages:
+  extra_repos: []
+
+users:
+  - arcline
+
+services:
+  enabled:
+    - systemd-networkd
+    - systemd-resolved
+    - cloud-init
+    - cloud-init-local
+    - ssh
+    - nftables
+    - apparmor
+    - qemu-guest-agent
+    - arcline-snapshot.timer
+  masked:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer

editions/cloud/packages.list

@@ -0,0 +1,60 @@
+# Arcline Cloud — package set
+# Minimal footprint: cloud kernel, cloud-init, guest agents, storage tooling.
+
+# ── base system ─────────────────────────────────────────────────────────────
+systemd
+systemd-sysv
+dbus
+libpam-systemd
+ca-certificates
+locales
+tzdata
+
+# ── boot ────────────────────────────────────────────────────────────────────
+grub-pc
+grub-efi-amd64
+shim-signed
+
+# ── kernel (cloud variant) ──────────────────────────────────────────────────
+linux-image-cloud-amd64
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+btrfs-progs
+zstd
+xz-utils
+
+# ── cloud provisioning ──────────────────────────────────────────────────────
+cloud-init
+cloud-guest-utils
+cloud-image-utils
+open-vm-tools
+qemu-guest-agent
+
+# ── storage / block devices ─────────────────────────────────────────────────
+nvme-cli
+open-iscsi
+multipath-tools
+lvm2
+mdadm
+
+# ── security / hardening ────────────────────────────────────────────────────
+openssh-server
+nftables
+apparmor
+apparmor-utils
+
+# ── observability (Debian-main components) ─────────────────────────────────
+prometheus-node-exporter
+
+# ── minimal admin tooling ───────────────────────────────────────────────────
+curl
+jq
+git
+rsync
+htop
+vim-tiny
+
+# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
+# arcline-uptime arcline-check arcline-audit arcline-dns
+# arcline-vault arcline-email arcline-migrate arcline-billing
+# arcline-portal arcline-website arcline-status

editions/server/fstab

@@ -0,0 +1,16 @@
+# Arcline Server — /etc/fstab template
+#
+# This is a TEMPLATE. btrfs-init.sh resolves the real root device UUID at
+# install/first-boot time and writes /etc/fstab. The subvolume layout matches
+# docs/btrfs.md.
+#
+# Device UUID is substituted by the installer.
+
+# <file system>  <mount point>  <type>  <options>                              <dump> <pass>
+UUID=__ROOT_UUID__ /             btrfs   rw,noatime,compress=zstd:3,subvol=@   0      0
+UUID=__ROOT_UUID__ /home         btrfs   rw,noatime,compress=zstd:3,subvol=@home 0    0
+UUID=__ROOT_UUID__ /var/log      btrfs   rw,noatime,compress=zstd:3,subvol=@log 0    0
+UUID=__ROOT_UUID__ /.snapshots   btrfs   rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
+
+# swap
+/swap/swapfile                  none    swap    sw                          0      0

editions/server/kernel.cmdline

@@ -0,0 +1,35 @@
+# Arcline Server — kernel command line
+# Hardening flags + console config. Kept explicit and auditable.
+#
+# Security notes:
+#   init_on_alloc / init_on_free  — zero freshly allocated/freed memory
+#   slab_nomerge                  — disable merging of similar slab objects
+#   page_poison=1                 — fill freed pages to catch use-after-free
+#   pti=on                        — kernel page-table isolation
+#   spectre_v2=on spec_store_bypass=on — mitigations on (no auto-off)
+#   tsx=off                       — disable TSX (TAA mitigations)
+#   lockdown=integrity            — block unsigned kernel modifications
+#   oops=panic panic=-1           — panic (and stay down) on oops
+#   quiet loglevel=3              — quiet serial console boot
+
+console=tty0
+console=ttyS0,115200n8
+quiet
+loglevel=3
+systemd.show_status=auto
+
+# hardening
+init_on_alloc=1
+init_on_free=1
+slab_nomerge
+page_poison=1
+pti=on
+spectre_v2=on
+spec_store_bypass=on
+tsx=off
+lockdown=integrity
+oops=panic
+panic=-1
+
+# btrfs / storage
+rootflags=subvol=@

editions/server/metadata.yaml

@@ -0,0 +1,37 @@
+# Edition manifest: Arcline Server
+# Codename: bastion
+edition: server
+codename: bastion
+summary: Hardened, production-ready server OS with built-in observability and zero telemetry.
+description: >
+  Runs applications on bare metal or in the cloud. Ships with a default-deny
+  nftables firewall, AppArmor + seccomp, btrfs root with snapshot rollback,
+  Docker + Podman, and a pre-configured Prometheus / Grafana / Loki stack.
+
+image:
+  type: iso
+  boot: bios+efi
+  filesystem: btrfs
+  compression: zstd:3
+
+packages:
+  # Upstream repos added before package install (name -> [url, suite, component]).
+  extra_repos: []
+
+users:
+  # Accounts created at first boot by the installer/configure hook.
+  - arcline
+
+services:
+  # systemd units enabled by default.
+  enabled:
+    - systemd-networkd
+    - systemd-resolved
+    - ssh
+    - nftables
+    - apparmor
+    - prometheus-node-exporter
+    - arcline-snapshot.timer
+  masked:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer

editions/server/packages.list

@@ -0,0 +1,74 @@
+# Arcline Server — package set
+# Debian bookworm packages. Lines beginning with # are notes/optional.
+# The configure hook installs the Arcline toolchain and observability
+# components that are not in Debian main (grafana, loki).
+
+# ── base system ─────────────────────────────────────────────────────────────
+systemd
+systemd-sysv
+dbus
+libpam-systemd
+ca-certificates
+locales
+tzdata
+
+# ── boot ────────────────────────────────────────────────────────────────────
+grub-pc
+grub-efi-amd64
+shim-signed
+os-prober
+
+# ── kernel / firmware ───────────────────────────────────────────────────────
+linux-image-amd64
+firmware-linux-free
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+btrfs-progs
+snapper
+zstd
+xz-utils
+
+# ── security / hardening ────────────────────────────────────────────────────
+openssh-server
+nftables
+apparmor
+apparmor-utils
+fail2ban
+unattended-upgrades
+libpam-pwquality
+
+# ── containers ──────────────────────────────────────────────────────────────
+docker.io
+podman
+runc
+containernetworking-plugins
+fuse-overlayfs
+slirp4netns
+
+# ── observability (Debian-main components) ─────────────────────────────────
+prometheus
+prometheus-node-exporter
+prometheus-alertmanager
+# grafana + loki are fetched from upstream repos by configure-system.sh
+
+# ── admin tooling ───────────────────────────────────────────────────────────
+curl
+wget
+jq
+git
+make
+rsync
+htop
+tmux
+vim-tiny
+unzip
+file
+ethtool
+sysstat
+chrony
+needrestart
+
+# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
+# arcline-uptime arcline-check arcline-audit arcline-dns
+# arcline-vault arcline-email arcline-migrate arcline-billing
+# arcline-portal arcline-website arcline-status

editions/workstation/fstab

@@ -0,0 +1,10 @@
+# Arcline Workstation — /etc/fstab template
+# See editions/server/fstab for the layout notes. btrfs-init.sh resolves the
+# root UUID at install time.
+
+UUID=__ROOT_UUID__ /             btrfs   rw,noatime,compress=zstd:3,subvol=@       0 0
+UUID=__ROOT_UUID__ /home         btrfs   rw,noatime,compress=zstd:3,subvol=@home   0 0
+UUID=__ROOT_UUID__ /var/log      btrfs   rw,noatime,compress=zstd:3,subvol=@log    0 0
+UUID=__ROOT_UUID__ /.snapshots   btrfs   rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
+
+/swap/swapfile                  none    swap    sw                          0      0

editions/workstation/kernel.cmdline

@@ -0,0 +1,24 @@
+# Arcline Workstation — kernel command line
+# Same hardening baseline as server, without the serial console and with
+# graphics-friendly settings.
+
+console=tty0
+quiet
+loglevel=3
+systemd.show_status=auto
+
+# hardening
+init_on_alloc=1
+init_on_free=1
+slab_nomerge
+page_poison=1
+pti=on
+spectre_v2=on
+spec_store_bypass=on
+tsx=off
+lockdown=integrity
+oops=panic
+panic=-1
+
+# btrfs / storage
+rootflags=subvol=@

editions/workstation/metadata.yaml

@@ -0,0 +1,33 @@
+# Edition manifest: Arcline Workstation
+# Codename: forge
+edition: workstation
+codename: forge
+summary: Same hardened base with a lightweight KDE Plasma desktop and pre-configured dev toolchains.
+description: >
+  A hardened daily driver. Lightweight KDE Plasma, privacy-hardened browser
+  profiles, pre-configured Go / Rust / Python / Node toolchains, and the same
+  zero-telemetry, default-deny firewall as the server edition.
+
+image:
+  type: iso
+  boot: bios+efi
+  filesystem: btrfs
+  compression: zstd:3
+
+packages:
+  extra_repos: []
+
+users:
+  - arcline
+
+services:
+  enabled:
+    - systemd-networkd
+    - systemd-resolved
+    - nftables
+    - apparmor
+    - sddm
+    - arcline-snapshot.timer
+  masked:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer

editions/workstation/packages.list

@@ -0,0 +1,101 @@
+# Arcline Workstation — package set
+# Curated KDE Plasma desktop (not the full task-* meta-package) plus a
+# complete developer toolchain.
+
+# ── base system ─────────────────────────────────────────────────────────────
+systemd
+systemd-sysv
+dbus
+libpam-systemd
+ca-certificates
+locales
+tzdata
+
+# ── boot ────────────────────────────────────────────────────────────────────
+grub-pc
+grub-efi-amd64
+shim-signed
+os-prober
+
+# ── kernel / firmware ───────────────────────────────────────────────────────
+linux-image-amd64
+firmware-linux-free
+firmware-misc-nonfree        # broadcom/intel wifi + gpu firmware
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+btrfs-progs
+snapper
+zstd
+xz-utils
+
+# ── desktop: X + KDE Plasma ─────────────────────────────────────────────────
+xserver-xorg
+xinit
+plasma-desktop
+sddm
+konsole
+dolphin
+kate
+ark
+gwenview
+plasma-discover
+network-manager
+network-manager-gnome
+pipewire
+pipewire-pulse
+wireplumber
+pulseaudio-utils
+
+# ── display / audio / input extras ──────────────────────────────────────────
+fonts-noto-core
+fonts-liberation
+firefox-esr
+
+# ── security / hardening ────────────────────────────────────────────────────
+openssh-server
+nftables
+apparmor
+apparmor-utils
+fail2ban
+
+# ── developer toolchain ─────────────────────────────────────────────────────
+build-essential
+gcc
+g++
+clang
+clang-format
+llvm
+lld
+gdb
+cmake
+ninja-build
+pkg-config
+golang-go
+rustc
+cargo
+python3
+python3-pip
+python3-venv
+nodejs
+npm
+git
+make
+curl
+wget
+jq
+vim
+nano
+htop
+tmux
+ripgrep
+fd-find
+bat
+docker.io
+podman
+runc
+containernetworking-plugins
+
+# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
+# arcline-uptime arcline-check arcline-audit arcline-dns
+# arcline-vault arcline-email arcline-migrate arcline-billing
+# arcline-portal arcline-website arcline-status