0361c12c07
The edition package lists installed BOTH grub-pc and grub-efi-amd64 (+ shim-signed). Those provide the same bootloader role and conflict in apt, so every rootfs build failed with "unable to correct problems, you have held broken packages". A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable (mirroring the existing --boot bios|efi deploy option): - versions.mk / common.sh: BOOT := bios (bios -> grub-pc, efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the Makefile. - build-rootfs.sh validates BOOT early and injects the matching boot packages into the apt install; the static package lists no longer contain any grub package. - deploy-disk.sh / build-image.sh / install.sh default --boot from the same BOOT variable, so a rootfs and the artifact deployed from it can never disagree (BOOT=efi make image-cloud produces a UEFI image). - mokutil is now installed explicitly in the efi flavour (it was not pulled in because we install with --no-install-recommends). - docs updated (building.md knob + rationale, secureboot.md note).
76 lines
2.9 KiB
Plaintext
76 lines
2.9 KiB
Plaintext
# Arcline Server — package set
|
|
# Debian trixie packages. Lines beginning with # are notes/optional.
|
|
# The configure hook installs the Arcline toolchain and observability
|
|
# components that are not in Debian main (grafana, loki).
|
|
|
|
# ── base system ─────────────────────────────────────────────────────────────
|
|
systemd
|
|
systemd-sysv
|
|
dbus
|
|
libpam-systemd
|
|
ca-certificates
|
|
locales
|
|
tzdata
|
|
|
|
# ── boot ────────────────────────────────────────────────────────────────────
|
|
# The bootloader is chosen by the BOOT build variable and injected by
|
|
# build-rootfs.sh: bios → grub-pc, efi → grub-efi-amd64 + shim-signed.
|
|
# (Installing grub-pc and grub-efi-amd64 together makes apt fail with a
|
|
# "held broken packages" conflict — exactly one is ever installed.)
|
|
os-prober
|
|
|
|
# ── kernel / firmware ───────────────────────────────────────────────────────
|
|
linux-image-amd64
|
|
firmware-linux-free
|
|
|
|
# ── filesystem ──────────────────────────────────────────────────────────────
|
|
btrfs-progs
|
|
snapper
|
|
zstd
|
|
xz-utils
|
|
|
|
# ── security / hardening ────────────────────────────────────────────────────
|
|
openssh-server
|
|
nftables
|
|
apparmor
|
|
apparmor-utils
|
|
fail2ban
|
|
unattended-upgrades
|
|
libpam-pwquality
|
|
|
|
# ── containers ──────────────────────────────────────────────────────────────
|
|
docker.io
|
|
podman
|
|
runc
|
|
containernetworking-plugins
|
|
fuse-overlayfs
|
|
slirp4netns
|
|
|
|
# ── observability (Debian-main components) ─────────────────────────────────
|
|
prometheus
|
|
prometheus-node-exporter
|
|
prometheus-alertmanager
|
|
# grafana + loki are fetched from upstream repos by configure-system.sh
|
|
|
|
# ── admin tooling ───────────────────────────────────────────────────────────
|
|
curl
|
|
wget
|
|
jq
|
|
git
|
|
make
|
|
rsync
|
|
htop
|
|
tmux
|
|
vim-tiny
|
|
unzip
|
|
file
|
|
ethtool
|
|
sysstat
|
|
chrony
|
|
needrestart
|
|
|
|
# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
|
|
# arcline-uptime arcline-check arcline-audit arcline-dns
|
|
# arcline-vault arcline-email arcline-migrate arcline-billing
|
|
# arcline-portal arcline-website arcline-status
|