feat: add server, workstation, and cloud edition manifests
Define the three flagship editions as plain-text manifests: - server (bastion): production server - observability stack, containers. - workstation (forge): curated KDE Plasma + dev toolchains. - cloud (nimbus): cloud kernel, cloud-init, guest agents. Each manifest carries metadata (services to enable/mask), a package list, a hardened kernel cmdline, and a btrfs fstab template.
This commit is contained in:
Blake Ridgway
9
editions/cloud/fstab
Normal file
9
editions/cloud/fstab
Normal file
@@ -0,0 +1,9 @@
|
||||
# Arcline Cloud — /etc/fstab template
|
||||
# Same layout as the other editions; btrfs-init.sh resolves the root UUID.
|
||||
|
||||
UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0
|
||||
UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0
|
||||
UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0
|
||||
UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
|
||||
|
||||
/swap/swapfile none swap sw 0 0
|
||||
28
editions/cloud/kernel.cmdline
Normal file
28
editions/cloud/kernel.cmdline
Normal file
@@ -0,0 +1,28 @@
|
||||
# Arcline Cloud — kernel command line
|
||||
# Same hardening baseline, serial console for cloud serial ports, no graphics.
|
||||
|
||||
console=tty0
|
||||
console=ttyS0,115200n8
|
||||
quiet
|
||||
loglevel=3
|
||||
systemd.show_status=auto
|
||||
|
||||
# hardening
|
||||
init_on_alloc=1
|
||||
init_on_free=1
|
||||
slab_nomerge
|
||||
page_poison=1
|
||||
pti=on
|
||||
spectre_v2=on
|
||||
spec_store_bypass=on
|
||||
tsx=off
|
||||
lockdown=integrity
|
||||
oops=panic
|
||||
panic=-1
|
||||
|
||||
# cloud / disk
|
||||
net.ifnames=0
|
||||
biosdevname=0
|
||||
|
||||
# btrfs / storage
|
||||
rootflags=subvol=@
|
||||
36
editions/cloud/metadata.yaml
Normal file
36
editions/cloud/metadata.yaml
Normal file
@@ -0,0 +1,36 @@
|
||||
# Edition manifest: Arcline Cloud
|
||||
# Codename: nimbus
|
||||
edition: cloud
|
||||
codename: nimbus
|
||||
summary: Minimal base images optimized for cloud infrastructures.
|
||||
description: >
|
||||
Designed for AWS, GCP, Azure, or your own private cloud. Uses the cloud
|
||||
kernel, cloud-init for first-boot provisioning, and a networkd-first
|
||||
network stack. Same hardening baseline as server.
|
||||
|
||||
image:
|
||||
type: iso
|
||||
boot: bios+efi
|
||||
filesystem: btrfs
|
||||
compression: zstd:3
|
||||
|
||||
packages:
|
||||
extra_repos: []
|
||||
|
||||
users:
|
||||
- arcline
|
||||
|
||||
services:
|
||||
enabled:
|
||||
- systemd-networkd
|
||||
- systemd-resolved
|
||||
- cloud-init
|
||||
- cloud-init-local
|
||||
- ssh
|
||||
- nftables
|
||||
- apparmor
|
||||
- qemu-guest-agent
|
||||
- arcline-snapshot.timer
|
||||
masked:
|
||||
- apt-daily.timer
|
||||
- apt-daily-upgrade.timer
|
||||
60
editions/cloud/packages.list
Normal file
60
editions/cloud/packages.list
Normal file
@@ -0,0 +1,60 @@
|
||||
# Arcline Cloud — package set
|
||||
# Minimal footprint: cloud kernel, cloud-init, guest agents, storage tooling.
|
||||
|
||||
# ── base system ─────────────────────────────────────────────────────────────
|
||||
systemd
|
||||
systemd-sysv
|
||||
dbus
|
||||
libpam-systemd
|
||||
ca-certificates
|
||||
locales
|
||||
tzdata
|
||||
|
||||
# ── boot ────────────────────────────────────────────────────────────────────
|
||||
grub-pc
|
||||
grub-efi-amd64
|
||||
shim-signed
|
||||
|
||||
# ── kernel (cloud variant) ──────────────────────────────────────────────────
|
||||
linux-image-cloud-amd64
|
||||
|
||||
# ── filesystem ──────────────────────────────────────────────────────────────
|
||||
btrfs-progs
|
||||
zstd
|
||||
xz-utils
|
||||
|
||||
# ── cloud provisioning ──────────────────────────────────────────────────────
|
||||
cloud-init
|
||||
cloud-guest-utils
|
||||
cloud-image-utils
|
||||
open-vm-tools
|
||||
qemu-guest-agent
|
||||
|
||||
# ── storage / block devices ─────────────────────────────────────────────────
|
||||
nvme-cli
|
||||
open-iscsi
|
||||
multipath-tools
|
||||
lvm2
|
||||
mdadm
|
||||
|
||||
# ── security / hardening ────────────────────────────────────────────────────
|
||||
openssh-server
|
||||
nftables
|
||||
apparmor
|
||||
apparmor-utils
|
||||
|
||||
# ── observability (Debian-main components) ─────────────────────────────────
|
||||
prometheus-node-exporter
|
||||
|
||||
# ── minimal admin tooling ───────────────────────────────────────────────────
|
||||
curl
|
||||
jq
|
||||
git
|
||||
rsync
|
||||
htop
|
||||
vim-tiny
|
||||
|
||||
# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
|
||||
# arcline-uptime arcline-check arcline-audit arcline-dns
|
||||
# arcline-vault arcline-email arcline-migrate arcline-billing
|
||||
# arcline-portal arcline-website arcline-status
|
||||
16
editions/server/fstab
Normal file
16
editions/server/fstab
Normal file
@@ -0,0 +1,16 @@
|
||||
# Arcline Server — /etc/fstab template
|
||||
#
|
||||
# This is a TEMPLATE. btrfs-init.sh resolves the real root device UUID at
|
||||
# install/first-boot time and writes /etc/fstab. The subvolume layout matches
|
||||
# docs/btrfs.md.
|
||||
#
|
||||
# Device UUID is substituted by the installer.
|
||||
|
||||
# <file system> <mount point> <type> <options> <dump> <pass>
|
||||
UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0
|
||||
UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0
|
||||
UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0
|
||||
UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
|
||||
|
||||
# swap
|
||||
/swap/swapfile none swap sw 0 0
|
||||
35
editions/server/kernel.cmdline
Normal file
35
editions/server/kernel.cmdline
Normal file
@@ -0,0 +1,35 @@
|
||||
# Arcline Server — kernel command line
|
||||
# Hardening flags + console config. Kept explicit and auditable.
|
||||
#
|
||||
# Security notes:
|
||||
# init_on_alloc / init_on_free — zero freshly allocated/freed memory
|
||||
# slab_nomerge — disable merging of similar slab objects
|
||||
# page_poison=1 — fill freed pages to catch use-after-free
|
||||
# pti=on — kernel page-table isolation
|
||||
# spectre_v2=on spec_store_bypass=on — mitigations on (no auto-off)
|
||||
# tsx=off — disable TSX (TAA mitigations)
|
||||
# lockdown=integrity — block unsigned kernel modifications
|
||||
# oops=panic panic=-1 — panic (and stay down) on oops
|
||||
# quiet loglevel=3 — quiet serial console boot
|
||||
|
||||
console=tty0
|
||||
console=ttyS0,115200n8
|
||||
quiet
|
||||
loglevel=3
|
||||
systemd.show_status=auto
|
||||
|
||||
# hardening
|
||||
init_on_alloc=1
|
||||
init_on_free=1
|
||||
slab_nomerge
|
||||
page_poison=1
|
||||
pti=on
|
||||
spectre_v2=on
|
||||
spec_store_bypass=on
|
||||
tsx=off
|
||||
lockdown=integrity
|
||||
oops=panic
|
||||
panic=-1
|
||||
|
||||
# btrfs / storage
|
||||
rootflags=subvol=@
|
||||
37
editions/server/metadata.yaml
Normal file
37
editions/server/metadata.yaml
Normal file
@@ -0,0 +1,37 @@
|
||||
# Edition manifest: Arcline Server
|
||||
# Codename: bastion
|
||||
edition: server
|
||||
codename: bastion
|
||||
summary: Hardened, production-ready server OS with built-in observability and zero telemetry.
|
||||
description: >
|
||||
Runs applications on bare metal or in the cloud. Ships with a default-deny
|
||||
nftables firewall, AppArmor + seccomp, btrfs root with snapshot rollback,
|
||||
Docker + Podman, and a pre-configured Prometheus / Grafana / Loki stack.
|
||||
|
||||
image:
|
||||
type: iso
|
||||
boot: bios+efi
|
||||
filesystem: btrfs
|
||||
compression: zstd:3
|
||||
|
||||
packages:
|
||||
# Upstream repos added before package install (name -> [url, suite, component]).
|
||||
extra_repos: []
|
||||
|
||||
users:
|
||||
# Accounts created at first boot by the installer/configure hook.
|
||||
- arcline
|
||||
|
||||
services:
|
||||
# systemd units enabled by default.
|
||||
enabled:
|
||||
- systemd-networkd
|
||||
- systemd-resolved
|
||||
- ssh
|
||||
- nftables
|
||||
- apparmor
|
||||
- prometheus-node-exporter
|
||||
- arcline-snapshot.timer
|
||||
masked:
|
||||
- apt-daily.timer
|
||||
- apt-daily-upgrade.timer
|
||||
74
editions/server/packages.list
Normal file
74
editions/server/packages.list
Normal file
@@ -0,0 +1,74 @@
|
||||
# Arcline Server — package set
|
||||
# Debian bookworm packages. Lines beginning with # are notes/optional.
|
||||
# The configure hook installs the Arcline toolchain and observability
|
||||
# components that are not in Debian main (grafana, loki).
|
||||
|
||||
# ── base system ─────────────────────────────────────────────────────────────
|
||||
systemd
|
||||
systemd-sysv
|
||||
dbus
|
||||
libpam-systemd
|
||||
ca-certificates
|
||||
locales
|
||||
tzdata
|
||||
|
||||
# ── boot ────────────────────────────────────────────────────────────────────
|
||||
grub-pc
|
||||
grub-efi-amd64
|
||||
shim-signed
|
||||
os-prober
|
||||
|
||||
# ── kernel / firmware ───────────────────────────────────────────────────────
|
||||
linux-image-amd64
|
||||
firmware-linux-free
|
||||
|
||||
# ── filesystem ──────────────────────────────────────────────────────────────
|
||||
btrfs-progs
|
||||
snapper
|
||||
zstd
|
||||
xz-utils
|
||||
|
||||
# ── security / hardening ────────────────────────────────────────────────────
|
||||
openssh-server
|
||||
nftables
|
||||
apparmor
|
||||
apparmor-utils
|
||||
fail2ban
|
||||
unattended-upgrades
|
||||
libpam-pwquality
|
||||
|
||||
# ── containers ──────────────────────────────────────────────────────────────
|
||||
docker.io
|
||||
podman
|
||||
runc
|
||||
containernetworking-plugins
|
||||
fuse-overlayfs
|
||||
slirp4netns
|
||||
|
||||
# ── observability (Debian-main components) ─────────────────────────────────
|
||||
prometheus
|
||||
prometheus-node-exporter
|
||||
prometheus-alertmanager
|
||||
# grafana + loki are fetched from upstream repos by configure-system.sh
|
||||
|
||||
# ── admin tooling ───────────────────────────────────────────────────────────
|
||||
curl
|
||||
wget
|
||||
jq
|
||||
git
|
||||
make
|
||||
rsync
|
||||
htop
|
||||
tmux
|
||||
vim-tiny
|
||||
unzip
|
||||
file
|
||||
ethtool
|
||||
sysstat
|
||||
chrony
|
||||
needrestart
|
||||
|
||||
# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
|
||||
# arcline-uptime arcline-check arcline-audit arcline-dns
|
||||
# arcline-vault arcline-email arcline-migrate arcline-billing
|
||||
# arcline-portal arcline-website arcline-status
|
||||
10
editions/workstation/fstab
Normal file
10
editions/workstation/fstab
Normal file
@@ -0,0 +1,10 @@
|
||||
# Arcline Workstation — /etc/fstab template
|
||||
# See editions/server/fstab for the layout notes. btrfs-init.sh resolves the
|
||||
# root UUID at install time.
|
||||
|
||||
UUID=__ROOT_UUID__ / btrfs rw,noatime,compress=zstd:3,subvol=@ 0 0
|
||||
UUID=__ROOT_UUID__ /home btrfs rw,noatime,compress=zstd:3,subvol=@home 0 0
|
||||
UUID=__ROOT_UUID__ /var/log btrfs rw,noatime,compress=zstd:3,subvol=@log 0 0
|
||||
UUID=__ROOT_UUID__ /.snapshots btrfs rw,noatime,compress=zstd:3,subvol=@snapshots 0 0
|
||||
|
||||
/swap/swapfile none swap sw 0 0
|
||||
24
editions/workstation/kernel.cmdline
Normal file
24
editions/workstation/kernel.cmdline
Normal file
@@ -0,0 +1,24 @@
|
||||
# Arcline Workstation — kernel command line
|
||||
# Same hardening baseline as server, without the serial console and with
|
||||
# graphics-friendly settings.
|
||||
|
||||
console=tty0
|
||||
quiet
|
||||
loglevel=3
|
||||
systemd.show_status=auto
|
||||
|
||||
# hardening
|
||||
init_on_alloc=1
|
||||
init_on_free=1
|
||||
slab_nomerge
|
||||
page_poison=1
|
||||
pti=on
|
||||
spectre_v2=on
|
||||
spec_store_bypass=on
|
||||
tsx=off
|
||||
lockdown=integrity
|
||||
oops=panic
|
||||
panic=-1
|
||||
|
||||
# btrfs / storage
|
||||
rootflags=subvol=@
|
||||
33
editions/workstation/metadata.yaml
Normal file
33
editions/workstation/metadata.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
# Edition manifest: Arcline Workstation
|
||||
# Codename: forge
|
||||
edition: workstation
|
||||
codename: forge
|
||||
summary: Same hardened base with a lightweight KDE Plasma desktop and pre-configured dev toolchains.
|
||||
description: >
|
||||
A hardened daily driver. Lightweight KDE Plasma, privacy-hardened browser
|
||||
profiles, pre-configured Go / Rust / Python / Node toolchains, and the same
|
||||
zero-telemetry, default-deny firewall as the server edition.
|
||||
|
||||
image:
|
||||
type: iso
|
||||
boot: bios+efi
|
||||
filesystem: btrfs
|
||||
compression: zstd:3
|
||||
|
||||
packages:
|
||||
extra_repos: []
|
||||
|
||||
users:
|
||||
- arcline
|
||||
|
||||
services:
|
||||
enabled:
|
||||
- systemd-networkd
|
||||
- systemd-resolved
|
||||
- nftables
|
||||
- apparmor
|
||||
- sddm
|
||||
- arcline-snapshot.timer
|
||||
masked:
|
||||
- apt-daily.timer
|
||||
- apt-daily-upgrade.timer
|
||||
101
editions/workstation/packages.list
Normal file
101
editions/workstation/packages.list
Normal file
@@ -0,0 +1,101 @@
|
||||
# Arcline Workstation — package set
|
||||
# Curated KDE Plasma desktop (not the full task-* meta-package) plus a
|
||||
# complete developer toolchain.
|
||||
|
||||
# ── base system ─────────────────────────────────────────────────────────────
|
||||
systemd
|
||||
systemd-sysv
|
||||
dbus
|
||||
libpam-systemd
|
||||
ca-certificates
|
||||
locales
|
||||
tzdata
|
||||
|
||||
# ── boot ────────────────────────────────────────────────────────────────────
|
||||
grub-pc
|
||||
grub-efi-amd64
|
||||
shim-signed
|
||||
os-prober
|
||||
|
||||
# ── kernel / firmware ───────────────────────────────────────────────────────
|
||||
linux-image-amd64
|
||||
firmware-linux-free
|
||||
firmware-misc-nonfree # broadcom/intel wifi + gpu firmware
|
||||
|
||||
# ── filesystem ──────────────────────────────────────────────────────────────
|
||||
btrfs-progs
|
||||
snapper
|
||||
zstd
|
||||
xz-utils
|
||||
|
||||
# ── desktop: X + KDE Plasma ─────────────────────────────────────────────────
|
||||
xserver-xorg
|
||||
xinit
|
||||
plasma-desktop
|
||||
sddm
|
||||
konsole
|
||||
dolphin
|
||||
kate
|
||||
ark
|
||||
gwenview
|
||||
plasma-discover
|
||||
network-manager
|
||||
network-manager-gnome
|
||||
pipewire
|
||||
pipewire-pulse
|
||||
wireplumber
|
||||
pulseaudio-utils
|
||||
|
||||
# ── display / audio / input extras ──────────────────────────────────────────
|
||||
fonts-noto-core
|
||||
fonts-liberation
|
||||
firefox-esr
|
||||
|
||||
# ── security / hardening ────────────────────────────────────────────────────
|
||||
openssh-server
|
||||
nftables
|
||||
apparmor
|
||||
apparmor-utils
|
||||
fail2ban
|
||||
|
||||
# ── developer toolchain ─────────────────────────────────────────────────────
|
||||
build-essential
|
||||
gcc
|
||||
g++
|
||||
clang
|
||||
clang-format
|
||||
llvm
|
||||
lld
|
||||
gdb
|
||||
cmake
|
||||
ninja-build
|
||||
pkg-config
|
||||
golang-go
|
||||
rustc
|
||||
cargo
|
||||
python3
|
||||
python3-pip
|
||||
python3-venv
|
||||
nodejs
|
||||
npm
|
||||
git
|
||||
make
|
||||
curl
|
||||
wget
|
||||
jq
|
||||
vim
|
||||
nano
|
||||
htop
|
||||
tmux
|
||||
ripgrep
|
||||
fd-find
|
||||
bat
|
||||
docker.io
|
||||
podman
|
||||
runc
|
||||
containernetworking-plugins
|
||||
|
||||
# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
|
||||
# arcline-uptime arcline-check arcline-audit arcline-dns
|
||||
# arcline-vault arcline-email arcline-migrate arcline-billing
|
||||
# arcline-portal arcline-website arcline-status
|
||||
Reference in New Issue
Block a user