87fc370541
Document the design and how to operate it: architecture, building (including toolchain-free/minimal builds), hardening guide, editions, observability, and the toolchain. README ties it together.
45 lines
1.8 KiB
Markdown
45 lines
1.8 KiB
Markdown
# Editions
|
|
|
|
Three flavours, one hardened base. Each is defined entirely by its manifest
|
|
under `editions/<name>/`.
|
|
|
|
| Edition | Codename | Purpose | Kernel | Notes |
|
|
|---------|----------|---------|--------|-------|
|
|
| `server` | bastion | production server | generic (`linux-image-amd64`) | full observability stack, containers |
|
|
| `workstation` | forge | hardened daily driver | generic | KDE Plasma, dev toolchains |
|
|
| `cloud` | nimbus | cloud images | cloud (`linux-image-cloud-amd64`) | cloud-init, guest agents |
|
|
|
|
## What an edition manifest contains
|
|
|
|
```
|
|
editions/<name>/
|
|
├── metadata.yaml # codename, summary, image type, services to enable/mask
|
|
├── packages.list # Debian packages (comments allowed)
|
|
├── kernel.cmdline # boot parameters for this edition
|
|
└── fstab # /etc/fstab template (btrfs subvolumes, UUID placeholder)
|
|
```
|
|
|
|
Edition-specific configs that land in the image live in `overlays/<name>/` and
|
|
are layered **after** `overlays/base/`, so they win conflicts.
|
|
|
|
## server — bastion
|
|
|
|
The flagship. Hardened base + Docker/Podman + Prometheus/Grafana/Loki
|
|
pre-configured (`overlays/server/etc/prometheus|grafana|loki|promtail`). Ships
|
|
the full Arcline toolchain. Serial console for headless boxes.
|
|
|
|
## workstation — forge
|
|
|
|
Same hardening baseline, relaxed only where a developer needs it (`perf`,
|
|
rootless containers). Curated KDE Plasma (not the full task meta-package),
|
|
dev toolchains (Go, Rust, Python, Node, clang/LLVM, CMake/Ninja), containers,
|
|
and privacy-oriented defaults.
|
|
|
|
## cloud — nimbus
|
|
|
|
Minimal footprint: cloud kernel, cloud-init (NoCloud/ConfigDrive/EC2/GCE/
|
|
Azure), guest agents (qemu/vmware), NVMe + iSCSI + multipath tooling.
|
|
`net.ifnames=0` for predictable, provider-friendly interface naming. The
|
|
disk-image (qcow2) output path is the next milestone — the manifest is ready,
|
|
the ISO path is wired today.
|