diff options
| -rwxr-xr-x | archsetup | 6 | ||||
| -rw-r--r-- | configs/maintenance-thresholds.toml | 31 | ||||
| -rw-r--r-- | todo.org | 4 |
3 files changed, 39 insertions, 2 deletions
@@ -1672,6 +1672,7 @@ configure_package_cache() { display "subtitle" "Package Repository Cache Maintenance" pacman_install pacman-contrib + pacman_install arch-audit # CVE report from Arch Security Team data (maintenance console) run_task "enabling the package cache cleanup timer" systemctl enable --now paccache.timer action="configuring paccache to keep 3 versions" && display "task" "$action" @@ -1857,6 +1858,11 @@ configure_btrfs_snapshots() { run_task "enabling snapper timeline timer" systemctl enable snapper-timeline.timer systemctl enable snapper-cleanup.timer >> "$logfile" 2>&1 || error_warn "$action" "$?" + # Monthly data scrub — the maintenance console's scrub-age and + # expected-timers checks assume this runs (mirrors the ZFS branch's + # zfs-scrub-weekly@). The "-" instance is systemd escaping for "/". + run_task "enabling monthly btrfs scrub timer" systemctl enable btrfs-scrub@-.timer + run_task "enabling grub-btrfsd for boot menu snapshots" systemctl enable grub-btrfsd # Allow user to use snapper without root (required for snapper-gui) diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index f729a01..898f47a 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -43,12 +43,23 @@ zfs_space_warn_pct = 20 # snapshot space vs pool capacity [packages] cache_warn_gb = 10 # suggest paccache beyond the weekly keep-3 +keyring_warn_days = 60 # stale archlinux-keyring silently breaks updates + +[security] +cve_min_warn = "high" # arch-audit severity floor that warns (the + # constant Unknown/Low tail is background) [updates] pending_warn = 50 # "a lot" — reddens the strip border cache_stale_hours = 6 # network-tier cache older than this warns topgrade_warn_days = 14 # topgrade freshness +[systemd] +# The capability-derived expected set (paccache/reflector always; +# btrfs-scrub@ + snapper timers on btrfs; sanoid + zfs-scrub-weekly@ on ZFS) +# lives in code — this list adds host-agnostic extras on top. +expected_timers_extra = [] + [logs] app_log_warn_days = 7 # log-cleanup cron should hold ~7 days journal_digest_top = 10 # groups shown in the journal digest @@ -91,3 +102,23 @@ entries = ["winvm"] [curation.pacnew_safe_delete] # Regenerated files whose .pacnew is safe to drop (reflector-managed / local). entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"] + +[curation.kept_orphans] +# Packages pacman calls orphaned that are deliberate keeps (the rust lesson): +# listed in evidence but never counted or warned on. KEEP/UNMARK levers write +# the user layer; this shipped list stays empty. +entries = [] + +[curation.qkk_known] +# pacman -Qkk mismatches that are config knowledge, not integrity findings +# (fnmatch patterns). Unverifiable reads and mtime-only mismatches are +# already excluded in code; this covers managed symlinks, regenerated +# caches, and files archsetup itself edits. +entries = [ + "/etc/resolv.conf", # resolver-managed symlink + "/usr/lib/jvm/default", # archlinux-java symlinks + "/usr/lib/jvm/default-runtime", + "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg + "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache + "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS +] @@ -33,8 +33,8 @@ maint/ package + shim + tests/maint/ (48 tests, fake-tool harness); thresholds t *** 2026-07-07 Tue @ 20:49:05 -0500 Built Phase 2 — storage & snapshot collectors (dotfiles 94e8371) All Phase 2 collectors TDD'd against the fake-tool harness (argv-matched cases added): btrfs unallocated/scrub-age/device-errors (SMART cross-check), per-disk SMART health + last self-test, fstrim posture (discard mount option = continuous trim, ratio's real setup), disk top-consumers on a new slow-local cache (=maint scan --slow=, ~/.local/state/maint), snapper counts split timeline·single·pre-post (split keys on cleanup, not type), full ZFS family. =priv.py= pulled forward from Phase 6 (read-only verbs =smart_json= + =btrfs_scrub_status=, validated args, MAINT_SUDO) so probes stay elevation-free. maint suites 48→118; make test green (51). Live read-only verified on BOTH hosts: ratio worst=warn (10.75 GB cache; scrub 0d, SMART ok), velox over tailscale shows the ZFS family live (ONLINE/autotrim-on/scrub 1d/231 snaps) with a genuine fstrim warn (timer off — Phase 6 Confirm remedy). TOML gained storage keys (btrfs_unalloc_warn_gb, smart_*, fstrim_stale_days, hog_*); installed copies refreshed on ratio + velox. -*** TODO Phase 3 — collectors: packages, security, systemd :solo: -Cache size, orphans (name+size), pacnew classification, keyring freshness, reboot-required, -Qkk (slow-local, parses output not exit code); network-tier cache readers (checkupdates, arch-audit CVEs, AUR, fwupd, topgrade freshness) with age; is-system-running + cause, failed-unit roster, maintenance-timers meta-metric, taint decode. Prereq: add arch-audit to archsetup deps + install. Verify: unit green + live read-only on ratio. +*** 2026-07-07 Tue @ 21:30:59 -0500 Built Phase 3 — packages, security, systemd collectors (dotfiles 3eaab6e) +All Phase 3 collectors TDD'd: orphans name+size with [curation.kept_orphans], pacnew safe-delete vs needs-merge, keyring freshness, reboot-required (uname -r vs modules dir), -Qkk on =maint scan --slow= with a noise split (unverifiable-as-user reads, mtime-only, [curation.qkk_known] paths tallied but never counted — an unfiltered live run sat permanently red at 68 "altered" files; classified, ratio shows 10 real findings); =maint scan --net= writes checkupdates/yay/arch-audit/fwupd caches (yay rc-1-silent = AUR-clean zero; failures never clobber good cache; malformed payloads degrade to unprobed), readers grade with age + stale bump; is-system-running with state-aware cause, failed-unit roster since/exit/journalctl hint, maintenance-timers meta-metric (capability-derived expected set, @-prefix instance match), taint letters decoded. Prereq done: arch-audit added to archsetup deps + installed both hosts. Review subagent (live-verified) found 2 Important (yay AUR-clean rc quirk, cache-shape envelope kill) + 2 minor — all fixed red-first; archsetup now enables btrfs-scrub@-.timer on btrfs installs (was ratio-only out-of-band, the meta-metric expects it). maint suites 118→169; full make test green. Live on ratio: 23-metric envelope, worst=warn from real findings (10.75GB cache, 8 orphans, mirrorlist.pacnew, 713 repo updates, 32 CVEs, 1 firmware). *** TODO Phase 4 — collectors: logs, memory, power :solo: Journal digest (identifier groups, noise layers), coredumps by binary, kernel/hw events; memory + top-5, OOM, swap/zram, temps, throttle, EPP read, battery health + charge threshold read, unclean-shutdown rate. Verify: unit green + live read-only on ratio. |