# Edition manifest: Arcline Server
# Codename: bastion
edition: server
codename: bastion
summary: Hardened, production-ready server OS with built-in observability and zero telemetry.
description: >
  Runs applications on bare metal or in the cloud. Ships with a default-deny
  nftables firewall, AppArmor + seccomp, btrfs root with snapshot rollback,
  Docker + Podman, and a pre-configured Prometheus / Grafana / Loki stack.

image:
  type: iso
  boot: bios+efi
  filesystem: btrfs
  compression: zstd:3

packages:
  # Upstream repos added before package install (name -> [url, suite, component]).
  extra_repos: []

users:
  # Accounts created at first boot by the installer/configure hook.
  - arcline

services:
  # systemd units enabled by default.
  enabled:
    - systemd-networkd
    - systemd-resolved
    - ssh
    - nftables
    - apparmor
    - prometheus-node-exporter
    - arcline-snapshot.timer
  masked:
    - apt-daily.timer
    - apt-daily-upgrade.timer