# Editions

Three flavours, one hardened base. Each is defined entirely by its manifest
under `editions/<name>/`.

| Edition | Codename | Purpose | Kernel | Notes |
|---------|----------|---------|--------|-------|
| `server` | bastion | production server | generic (`linux-image-amd64`) | full observability stack, containers |
| `workstation` | forge | hardened daily driver | generic | KDE Plasma, dev toolchains |
| `cloud` | nimbus | cloud images | cloud (`linux-image-cloud-amd64`) | cloud-init, guest agents |

## What an edition manifest contains

```
editions/<name>/
├── metadata.yaml    # codename, summary, image type, services to enable/mask
├── packages.list    # Debian packages (comments allowed)
├── kernel.cmdline   # boot parameters for this edition
└── fstab            # /etc/fstab template (btrfs subvolumes, UUID placeholder)
```

Edition-specific configs that land in the image live in `overlays/<name>/` and
are layered **after** `overlays/base/`, so they win conflicts.

## server — bastion

The flagship. Hardened base + Docker/Podman + Prometheus/Grafana/Loki
pre-configured (`overlays/server/etc/prometheus|grafana|loki|promtail`). Ships
the full Arcline toolchain. Serial console for headless boxes.

## workstation — forge

Same hardening baseline, relaxed only where a developer needs it (`perf`,
rootless containers). Curated KDE Plasma (not the full task meta-package),
dev toolchains (Go, Rust, Python, Node, clang/LLVM, CMake/Ninja), containers,
and privacy-oriented defaults.

## cloud — nimbus

Minimal footprint: cloud kernel, cloud-init (NoCloud/ConfigDrive/EC2/GCE/
Azure), guest agents (qemu/vmware), NVMe + iSCSI + multipath tooling.
`net.ifnames=0` for predictable, provider-friendly interface naming. The
disk-image (qcow2) output path is the next milestone — the manifest is ready,
the ISO path is wired today.