a27d3fb313
- docs/secureboot.md: MOK workflow (generate, build, enroll). - docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN. - docs/observability.md: vendor .debs are now the primary packaging path. - docs/editions.md: cloud ships a qcow2; qemu test command. - docs/architecture.md: full pipeline table incl. deploy/install; the four follow-up items are now implemented; new "on the horizon" list. - README: updated feature list, quickstart, and status.
49 lines
2.0 KiB
Markdown
49 lines
2.0 KiB
Markdown
# Editions
|
|
|
|
Three flavours, one hardened base. Each is defined entirely by its manifest
|
|
under `editions/<name>/`.
|
|
|
|
| Edition | Codename | Purpose | Kernel | Output |
|
|
|---------|----------|---------|--------|--------|
|
|
| `server` | bastion | production server | generic (`linux-image-amd64`) | ISO (and qcow2 for VM testing) |
|
|
| `workstation` | forge | hardened daily driver | generic | ISO |
|
|
| `cloud` | nimbus | cloud images | cloud (`linux-image-cloud-amd64`) | **qcow2/raw disk image** (`make image-cloud`)
|
|
|
|
## What an edition manifest contains
|
|
|
|
```
|
|
editions/<name>/
|
|
├── metadata.yaml # codename, summary, image type, services to enable/mask
|
|
├── packages.list # Debian packages (comments allowed)
|
|
├── kernel.cmdline # boot parameters for this edition
|
|
└── fstab # /etc/fstab template (btrfs subvolumes, UUID placeholder)
|
|
```
|
|
|
|
Edition-specific configs that land in the image live in `overlays/<name>/` and
|
|
are layered **after** `overlays/base/`, so they win conflicts.
|
|
|
|
## server — bastion
|
|
|
|
The flagship. Hardened base + Docker/Podman + Prometheus/Grafana/Loki
|
|
pre-configured (`overlays/server/etc/prometheus|grafana|loki|promtail`). Ships
|
|
the full Arcline toolchain. Serial console for headless boxes.
|
|
|
|
## workstation — forge
|
|
|
|
Same hardening baseline, relaxed only where a developer needs it (`perf`,
|
|
rootless containers). Curated KDE Plasma (not the full task meta-package),
|
|
dev toolchains (Go, Rust, Python, Node, clang/LLVM, CMake/Ninja), containers,
|
|
and privacy-oriented defaults.
|
|
|
|
## cloud — nimbus
|
|
|
|
Minimal footprint: cloud kernel, cloud-init (NoCloud/ConfigDrive/EC2/GCE/
|
|
Azure), guest agents (qemu/vmware), NVMe + iSCSI + multipath tooling.
|
|
`net.ifnames=0` for predictable, provider-friendly interface naming. Ships as
|
|
a bootable **qcow2** disk image (`make image-cloud`) — BIOS boot by default,
|
|
UEFI via `--boot efi`; upload to your provider or test with qemu:
|
|
|
|
```
|
|
qemu-system-x86_64 -m 2G -drive file=build/artifacts/arcline-cloud-0.1.0-amd64.qcow2,format=qcow2 -nographic
|
|
```
|