87fc370541
Document the design and how to operate it: architecture, building (including toolchain-free/minimal builds), hardening guide, editions, observability, and the toolchain. README ties it together.
1.8 KiB
Editions
Three flavours, one hardened base. Each is defined entirely by its manifest
under editions/<name>/.
| Edition | Codename | Purpose | Kernel | Notes |
|---|---|---|---|---|
server |
bastion | production server | generic (linux-image-amd64) |
full observability stack, containers |
workstation |
forge | hardened daily driver | generic | KDE Plasma, dev toolchains |
cloud |
nimbus | cloud images | cloud (linux-image-cloud-amd64) |
cloud-init, guest agents |
What an edition manifest contains
editions/<name>/
├── metadata.yaml # codename, summary, image type, services to enable/mask
├── packages.list # Debian packages (comments allowed)
├── kernel.cmdline # boot parameters for this edition
└── fstab # /etc/fstab template (btrfs subvolumes, UUID placeholder)
Edition-specific configs that land in the image live in overlays/<name>/ and
are layered after overlays/base/, so they win conflicts.
server — bastion
The flagship. Hardened base + Docker/Podman + Prometheus/Grafana/Loki
pre-configured (overlays/server/etc/prometheus|grafana|loki|promtail). Ships
the full Arcline toolchain. Serial console for headless boxes.
workstation — forge
Same hardening baseline, relaxed only where a developer needs it (perf,
rootless containers). Curated KDE Plasma (not the full task meta-package),
dev toolchains (Go, Rust, Python, Node, clang/LLVM, CMake/Ninja), containers,
and privacy-oriented defaults.
cloud — nimbus
Minimal footprint: cloud kernel, cloud-init (NoCloud/ConfigDrive/EC2/GCE/
Azure), guest agents (qemu/vmware), NVMe + iSCSI + multipath tooling.
net.ifnames=0 for predictable, provider-friendly interface naming. The
disk-image (qcow2) output path is the next milestone — the manifest is ready,
the ISO path is wired today.