diff options
Diffstat (limited to 'configs')
| -rw-r--r-- | configs/maintenance-thresholds.toml | 190 |
1 files changed, 190 insertions, 0 deletions
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml new file mode 100644 index 0000000..c14eaec --- /dev/null +++ b/configs/maintenance-thresholds.toml @@ -0,0 +1,190 @@ +# maintenance-thresholds.toml — every severity value the maintenance console +# and the system-health-check workflow grade against, plus the shipped +# curation defaults. Owned and installed by archsetup (canonical: +# configs/maintenance-thresholds.toml in the archsetup repo; installed to +# ~/.config/archsetup/maintenance-thresholds.toml). Both consumers read the +# installed path, so severity rules can never drift between them. +# +# User curation and overrides live in ~/.config/maint/curation.toml and merge +# over this file (scalars: user wins; [curation.*]: entries − disable + add). +# Never record user marks here — an archsetup update replaces this file. +# +# Seed values migrated 2026-07-07 from the system-health-check workflow's +# hard-won prose rules (the 2026-05-26 /home snapshot lesson, the 10 GB cache +# trigger, the 35/60-day scrub bands) and the maintenance-console design doc. + +[storage] +df_warn_pct = 80 +df_crit_pct = 90 +btrfs_scrub_warn_days = 35 +btrfs_scrub_crit_days = 60 +btrfs_unalloc_warn_gb = 10 # chunk headroom floor before ENOSPC weirdness +zfs_scrub_warn_days = 35 +zfs_scrub_crit_days = 60 +zfs_capacity_warn_pct = 80 # ZFS performance degrades past 80 +zfs_capacity_crit_pct = 90 +zfs_frag_info_pct = 50 +smart_wear_warn_pct = 80 # NVMe percentage_used (100 = rated life) +smart_temp_warn_c = 70 +fstrim_stale_days = 10 # weekly timer + slack (continuous discard exempts) +hog_roots = ["/home/cjennings", "/var"] # disk top-consumers scan roots (slow-local); depth-1 of /home is just the user dir, so scan inside it +hog_top = 8 # digest rows kept + +[snapshots] +# Sane snapper TIMELINE limits — the 2026-05-26 /home pile-up fix. +timeline_hourly = 6 +timeline_daily = 7 +timeline_weekly = 2 +timeline_monthly = 2 +timeline_quarterly = 0 +timeline_yearly = 0 +timeline_slack = 2 # grade at summed limits + slack: absorbs the + # hourly create/:45-cleanup gap; a dead cleanup + # timer still clears it within a few hours +single_keep = 2 # DELETE STALE keeps the newest N singles +zfs_count_warn = 1000 # runaway retention +zfs_space_warn_pct = 20 # snapshot space vs pool capacity + +[packages] +cache_warn_gb = 20 # above keep-3 saturation (~17-19GB on ratio); + # fires within ~2 months if the paccache timer dies +keyring_warn_days = 60 # stale archlinux-keyring silently breaks updates + +# [security] cve_min_warn retired 2026-07-08: the cve grade now keys on +# actionability (a fixed release exists and isn't installed), not severity. +# Unfixable advisories are informational and never warn. + +[updates] +pending_warn = 50 # "a lot" — reddens the strip border +cache_stale_hours = 6 # network-tier cache older than this warns +topgrade_warn_days = 14 # topgrade freshness +# The live-update guard (never -Syu the graphics/wayland runtime under a +# live session — the 2026-06-07 mesa+hyprland crash). fnmatch patterns +# against pending package names; a hit arms UPDATE/TOPGRADE instead of +# running ("press again to run anyway — or apply from a TTY"). +guard_patterns = [ + "mesa", "mesa-*", "lib32-mesa*", + "hyprland", "hyprland-*", "aquamarine", "hyprutils", "hyprlang", + "hyprcursor", "hyprgraphics", + "*wayland*", "wlroots*", + "vulkan-radeon", "lib32-vulkan-radeon", # ratio's GPU driver + "vulkan-intel", "lib32-vulkan-intel", # velox's GPU driver +] + +[systemd] +# The capability-derived expected set (paccache/reflector always; +# btrfs-scrub@ + snapper timers on btrfs; sanoid + zfs-scrub-weekly@ on ZFS) +# lives in code — this list adds host-agnostic extras on top. +expected_timers_extra = [] + +[logs] +app_log_warn_days = 7 # log-cleanup cron should hold ~7 days +journal_digest_top = 10 # groups shown in the journal digest +journal_disk_warn_gb = 2 # journald footprint before vacuum suggested +coredump_window_days = 14 # forensic window (matches systemd's 2w + # tmpfiles aging): the value/grade counts + # corefiles PAST it — CLEAR's reclaim set; + # recent crashes are digest-visible only + +[memory] +used_warn_pct = 90 # 1 - available/total (reclaimable-aware) +used_crit_pct = 97 +oom_window_days = 7 # kernel-journal OOM lookback + +[power] +battery_low_pct = 15 # feeds the diagnostic state (glyph red) +charge_limit_pct = 80 # the SET 80% longevity cap on velox +cpu_temp_warn_c = 90 # k10temp Tctl / coretemp package +gpu_temp_warn_c = 95 # amdgpu edge +battery_health_warn_pct = 80 # charge_full vs design floor +unclean_warn_pct = 25 # unclean-shutdown rate over recent boots +unclean_boot_sample = 10 # boots assessed for the rate + +[network] +ntp_offset_warn_ms = 100 # chrony last-offset bound (typical is sub-ms) + +[backups] +rsyncshot_daily_crit_hours = 48 # daily backup older than this is a fire +rsyncshot_hourly_warn_hours = 3 # graded only on hosts whose log shows hourly runs + +[services] +docker_reclaim_warn_gb = 5 +docker_reclaim_warn_pct = 50 +# Expected crontab entries (substring match, comment lines ignored). Root +# expectations apply only on backup sources (hosts with a rsyncshot log). +cron_expected_root = ["rsyncshot"] +cron_expected_user = ["log-cleanup"] + +[refresh] +# Cadence knobs (seconds unless named otherwise) — spec Decision 8. +live_secs = 3 +fast_secs = 30 +glyph_scan_mins = 30 +net_scan_mins = 60 + +# --- shipped curation defaults (user layer adds/disables, never edits) ------ + +[curation.known_noise] +# Journal-noise patterns bind to identifier + message snippet, never a whole +# unit — a muted service's new errors still surface. +entries = [ + { identifier = "bluetoothd", pattern = "HFP" }, + { identifier = "pixman", pattern = "Invalid glyph" }, + { identifier = "xkbcomp", pattern = "Could not resolve keysym" }, +] + +[curation.expected_listeners] +entries = ["sshd", "mpd", "tailscaled"] + +[curation.session_critical] +# Process names KILL must never fire on (the lever renders disabled) — +# systemd, the compositor and its plumbing, the audio stack, the panel +# itself, and sshd (a remote session's lifeline). fnmatch patterns. +entries = [ + "systemd*", "Hyprland", "Xwayland", "waybar", + "dbus-broker*", "dbus-daemon", + "pipewire*", "wireplumber", + "maint*", "sshd", +] + +[curation.expected_containers] +entries = ["winvm"] + +[curation.pacnew_safe_delete] +# Regenerated files whose .pacnew is safe to drop (reflector-managed / local). +entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"] + +[curation.kept_orphans] +# Packages pacman calls orphaned that are deliberate keeps (the rust lesson): +# listed in evidence but never counted or warned on. KEEP/UNMARK levers write +# the user layer; this shipped list stays empty. +entries = [] + +[curation.qkk_known] +# pacman -Qkk mismatches that are config knowledge, not integrity findings +# (fnmatch patterns). Unverifiable reads and mtime-only mismatches are +# already excluded in code; this covers managed symlinks, regenerated +# caches, and files archsetup itself edits. +entries = [ + "/etc/resolv.conf", # resolver-managed symlink + "/usr/lib/jvm/default", # archlinux-java symlinks + "/usr/lib/jvm/default-runtime", + "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg + "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache + "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS + # Runtime perm/owner drift the system re-applies within seconds of a + # reinstall (verified on ratio 2026-07-08: reinstall reset these, the + # daemons re-drifted them before the next -Qkk): + "/etc/cups/classes.conf", # cupsd rewrites mode 600 + "/etc/cups/printers.conf", # (may carry device creds) + "/etc/cups/subscriptions.conf", + "/var/lib/passim*", # StateDirectory re-chowns + "/var/log/journal", # tmpfiles re-groups + # /etc/ssl/private deliberately NOT here: both hosts had it world-listable + # (755 vs packaged 700) — a real misconfig the metric caught. pacman warns + # but never resets existing dir perms; fixed by chmod 2026-07-08. + "/usr/lib/utempter/utempter", # setgid-helper ownership; + # NOTE: also silences a + # content change on this + # one binary (accepted) +] |