# Arcline Server — package set
# Debian trixie packages. Lines beginning with # are notes/optional.
# The configure hook installs the Arcline toolchain and observability
# components that are not in Debian main (grafana, loki).

# ── base system ─────────────────────────────────────────────────────────────
systemd
systemd-sysv
dbus
libpam-systemd
ca-certificates
locales
tzdata

# ── boot ────────────────────────────────────────────────────────────────────
# The bootloader is chosen by the BOOT build variable and injected by
# build-rootfs.sh: bios → grub-pc, efi → grub-efi-amd64 + shim-signed.
# (Installing grub-pc and grub-efi-amd64 together makes apt fail with a
# "held broken packages" conflict — exactly one is ever installed.)
os-prober

# ── kernel / firmware ───────────────────────────────────────────────────────
linux-image-amd64
firmware-linux-free

# ── filesystem ──────────────────────────────────────────────────────────────
btrfs-progs
snapper
zstd
xz-utils

# ── security / hardening ────────────────────────────────────────────────────
openssh-server
nftables
apparmor
apparmor-utils
fail2ban
unattended-upgrades
libpam-pwquality

# ── containers ──────────────────────────────────────────────────────────────
docker.io
podman
runc
containernetworking-plugins
fuse-overlayfs
slirp4netns

# ── observability (Debian-main components) ─────────────────────────────────
prometheus
prometheus-node-exporter
prometheus-alertmanager
# grafana + loki are fetched from upstream repos by configure-system.sh

# ── admin tooling ───────────────────────────────────────────────────────────
curl
wget
jq
git
make
rsync
htop
tmux
vim-tiny
unzip
file
ethtool
sysstat
chrony
needrestart

# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
# arcline-uptime arcline-check arcline-audit arcline-dns
# arcline-vault arcline-email arcline-migrate arcline-billing
# arcline-portal arcline-website arcline-status