archsetup/configs, branch mainBuilds a full dev workstation from a bare Arch Linux install.
https://git.cjennings.net/archsetup/atom?h=main2026-07-14T05:23:16+00:00feat(maint): ship a tailscale health-noise ignore list2026-07-14T05:23:16+00:00Craig Jenningsc@cjennings.net2026-07-14T05:23:16+00:00urn:sha1:a20db511a2f03d9eb40b2faa606174c260f544d7
The maint probe now reads network.tailscale_health_ignore before grading the tailscale lamp. This ships the fleet default: tailscaled's permanent DNS-unreachable complaint under systemd-resolved, which kept the lamp amber while DNS worked.
fix(maint): uncurate /etc/ssl/private — it was a real misconfig2026-07-08T18:09:54+00:00Craig Jenningsc@cjennings.net2026-07-08T18:09:54+00:00urn:sha1:cf11bdb6adae3b860562affa9ce123f87cf7625a
pacman warned filesystem 755 vs package 700 on both hosts: a world-listable private-key directory, not runtime hardening as the previous commit claimed. pacman never resets existing directory permissions, so I chmod'd 700 on ratio and velox and removed the curation entry. Integrity reads an honest zero on both.
chore(maint): curate runtime perm drift out of the integrity count2026-07-08T18:06:38+00:00Craig Jenningsc@cjennings.net2026-07-08T18:06:38+00:00urn:sha1:422f34f82f7cb5bc67b84c2b2ed94123111427bd
Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them.
All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750).
chore(maint): retire cve_min_warn from the thresholds2026-07-08T16:47:08+00:00Craig Jenningsc@cjennings.net2026-07-08T16:47:08+00:00urn:sha1:2c17b9a912a6b53a2b2f4e311564305382d909fc
The maint probe now grades CVE advisories on actionability (a fixed release exists and isn't installed), not severity, so the severity floor is dead config. The section comment records the retirement. I installed it on both hosts.
docs(maint): reword coredump window comment for past-window grading2026-07-08T14:46:38+00:00Craig Jenningsc@cjennings.net2026-07-08T14:46:38+00:00urn:sha1:0c7c7c28f9f8fe5efcc6a9173b32b4e2bc7502f1fix(maint): add timeline_slack key to the snapshot thresholds2026-07-08T13:22:04+00:00Craig Jenningsc@cjennings.net2026-07-08T13:22:04+00:00urn:sha1:eaa22c4e62e96ae6ac792d3ef0074530214018b7
This pairs with the maint probe change: the snapper grade now warns at summed limits + snapshots.timeline_slack. Slack 2 absorbs the hourly create/:45-cleanup timer gap that kept the card amber most of every hour. I installed it on both hosts.
fix(maint): raise pacman cache warn threshold to 20GB2026-07-08T13:02:07+00:00Craig Jenningsc@cjennings.net2026-07-08T13:02:07+00:00urn:sha1:0f31715badfb26a07369888e9731c8c4940b7669
The 10GB threshold sat below the keep-3 steady state on both hosts (ratio 12.6GB, velox 10.8GB after pruning), so the warning persisted with nothing left to clean. paccache keeps three versions per package and never expires by age, which puts the honest ceiling near 17-19GB. At 20GB the metric stays quiet in steady state but still fires within about two months if the paccache timer dies.
I installed it on both hosts and the warning cleared on each.
feat: Phase 6 threshold keys (update guard, session-critical, quarterly)2026-07-08T04:15:41+00:00Craig Jenningsc@cjennings.net2026-07-08T04:15:41+00:00urn:sha1:ba6334af5b6b722eb223e0adb19c074c349782fb
[updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set.
feat: Phase 5 threshold keys (network, backups, services)2026-07-08T03:35:18+00:00Craig Jenningsc@cjennings.net2026-07-08T03:35:18+00:00urn:sha1:cfa815ac3a622a171cf5ce1be70c2cb49488c16cfeat: Phase 4 threshold keys (logs, memory, power)2026-07-08T03:00:49+00:00Craig Jenningsc@cjennings.net2026-07-08T03:00:49+00:00urn:sha1:892f746322c47ca6a1e28f2c975daba964af4a73