arcline-project/os-build
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add hardened base and per-edition image overlays

Browse Source 
Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.
This commit is contained in:
Blake Ridgway
2026-08-21 13:15:43 -05:00
parent 729f191950
commit 94ab6043e7
19 changed files with 516 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
overlays/base/etc/motd Normal file
View File

@@ -0,0 +1,8 @@
Welcome to Arcline OS
Secure by default. Zero telemetry. Self-hosted by principle.
* hardening guide: man arcline-hardening (or docs/hardening.md)
* manage snapshots: arcline-snapshot snapshot|list|prune
* check firewall: nft list ruleset