# Arcline Server — kernel command line
# Hardening flags + console config. Kept explicit and auditable.
#
# Security notes:
#   init_on_alloc / init_on_free  — zero freshly allocated/freed memory
#   slab_nomerge                  — disable merging of similar slab objects
#   page_poison=1                 — fill freed pages to catch use-after-free
#   pti=on                        — kernel page-table isolation
#   spectre_v2=on spec_store_bypass=on — mitigations on (no auto-off)
#   tsx=off                       — disable TSX (TAA mitigations)
#   lockdown=integrity            — block unsigned kernel modifications
#   oops=panic panic=-1           — panic (and stay down) on oops
#   quiet loglevel=3              — quiet serial console boot

console=tty0
console=ttyS0,115200n8
quiet
loglevel=3
systemd.show_status=auto

# hardening
init_on_alloc=1
init_on_free=1
slab_nomerge
page_poison=1
pti=on
spectre_v2=on
spec_store_bypass=on
tsx=off
lockdown=integrity
oops=panic
panic=-1

# btrfs / storage
rootflags=subvol=@