Commit Graph

4 Commits

Author SHA1 Message Date
Blake Ridgway
36d0c5b9d1 feat: add btrfs subvolume, snapshot, and rollback tooling
- init.sh: creates the @ / @home / @log / @snapshots subvolume layout
  on a target device (the installer step).
- snapshot.sh: scheduled read-only snapshots with pruning, installed as
  /usr/local/sbin/arcline-snapshot.
- rollback.sh: safe boot-to-snapshot rollback that refuses to touch the
  live @ and promotes a snapshot atomically.
2026-08-21 13:15:43 -05:00
Blake Ridgway
94ab6043e7 feat: add hardened base and per-edition image overlays
Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.
2026-08-21 13:15:43 -05:00
Blake Ridgway
729f191950 feat: add server, workstation, and cloud edition manifests
Define the three flagship editions as plain-text manifests:

- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.

Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.
2026-08-21 13:15:43 -05:00
Blake Ridgway
14e5ea9e1e feat: scaffold Arcline OS build system
Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.

- Makefile orchestrates everything (make iso-<edition>, check, test,
  toolchain, clean); versions.mk is the single source of truth for
  versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
  -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
  archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
  are bundled into an image (auto by default; minimal builds available
  via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.
2026-08-21 13:15:43 -05:00