diff options
Diffstat (limited to 'configs/maintenance-thresholds.toml')
| -rw-r--r-- | configs/maintenance-thresholds.toml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index f729a01..898f47a 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -43,12 +43,23 @@ zfs_space_warn_pct = 20 # snapshot space vs pool capacity [packages] cache_warn_gb = 10 # suggest paccache beyond the weekly keep-3 +keyring_warn_days = 60 # stale archlinux-keyring silently breaks updates + +[security] +cve_min_warn = "high" # arch-audit severity floor that warns (the + # constant Unknown/Low tail is background) [updates] pending_warn = 50 # "a lot" — reddens the strip border cache_stale_hours = 6 # network-tier cache older than this warns topgrade_warn_days = 14 # topgrade freshness +[systemd] +# The capability-derived expected set (paccache/reflector always; +# btrfs-scrub@ + snapper timers on btrfs; sanoid + zfs-scrub-weekly@ on ZFS) +# lives in code — this list adds host-agnostic extras on top. +expected_timers_extra = [] + [logs] app_log_warn_days = 7 # log-cleanup cron should hold ~7 days journal_digest_top = 10 # groups shown in the journal digest @@ -91,3 +102,23 @@ entries = ["winvm"] [curation.pacnew_safe_delete] # Regenerated files whose .pacnew is safe to drop (reflector-managed / local). entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"] + +[curation.kept_orphans] +# Packages pacman calls orphaned that are deliberate keeps (the rust lesson): +# listed in evidence but never counted or warned on. KEEP/UNMARK levers write +# the user layer; this shipped list stays empty. +entries = [] + +[curation.qkk_known] +# pacman -Qkk mismatches that are config knowledge, not integrity findings +# (fnmatch patterns). Unverifiable reads and mtime-only mismatches are +# already excluded in code; this covers managed symlinks, regenerated +# caches, and files archsetup itself edits. +entries = [ + "/etc/resolv.conf", # resolver-managed symlink + "/usr/lib/jvm/default", # archlinux-java symlinks + "/usr/lib/jvm/default-runtime", + "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg + "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache + "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS +] |