os-build

3 Commits 1 Branch 0 Tags

Author	SHA1	Message	Date
Blake Ridgway	94ab6043e7	feat: add hardened base and per-edition image overlays Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.	2026-08-21 13:15:43 -05:00
Blake Ridgway	729f191950	feat: add server, workstation, and cloud edition manifests Define the three flagship editions as plain-text manifests: - server (bastion): production server - observability stack, containers. - workstation (forge): curated KDE Plasma + dev toolchains. - cloud (nimbus): cloud kernel, cloud-init, guest agents. Each manifest carries metadata (services to enable/mask), a package list, a hardened kernel cmdline, and a btrfs fstab template.	2026-08-21 13:15:43 -05:00
Blake Ridgway	14e5ea9e1e	feat: scaffold Arcline OS build system Scaffold the Arcline OS build system ("the wires"): a transparent, auditable pipeline that turns a Debian bookworm base into hardened OS images for the server, workstation, and cloud editions. - Makefile orchestrates everything (make iso-<edition>, check, test, toolchain, clean); versions.mk is the single source of truth for versions and paths. - scripts/ is the plain-bash pipeline: debootstrap -> install packages -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs archive along the way. - ARCLINE_TOOLCHAIN=auto\|skip\|require controls whether the 11 Go tools are bundled into an image (auto by default; minimal builds available via make iso-<edition>-minimal). - GPL-3.0 licensed, sponsored by Arcline IT LLC.	2026-08-21 13:15:43 -05:00

Author

SHA1

Message

Date

Blake Ridgway

94ab6043e7

feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

2026-08-21 13:15:43 -05:00

Blake Ridgway

729f191950

feat: add server, workstation, and cloud edition manifests

Define the three flagship editions as plain-text manifests:

- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.

Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.

2026-08-21 13:15:43 -05:00

Blake Ridgway

14e5ea9e1e

feat: scaffold Arcline OS build system

Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.

- Makefile orchestrates everything (make iso-<edition>, check, test,
  toolchain, clean); versions.mk is the single source of truth for
  versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
  -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
  archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
  are bundled into an image (auto by default; minimal builds available
  via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.

2026-08-21 13:15:43 -05:00