summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* fix(archsetup): add firewall validation with critical warningCraig Jennings2026-01-212-1/+25
| | | | | | - Verify ufw is active after setup completes - Display critical security warning in outro if firewall not active - Include manual fix commands in warning message
* fix(archsetup): add locale configurationCraig Jennings2026-01-212-1/+14
| | | | | | Configure en_US.UTF-8 locale early in Environment Configuration section to prevent "cannot change locale" errors during package installs.
* chore: rename TODO.org to todo.orgCraig Jennings2026-01-211-14/+41
|
* fix(dotfiles): update for ratio desktopCraig Jennings2026-01-213-6/+4
| | | | | - Set Xresources DPI to 109 for ultrawide monitor - Remove deno environment setup (no longer using)
* fix(archsetup): replace ntp with chrony and add packagesCraig Jennings2026-01-211-6/+9
| | | | | | | | | - Replace deprecated ntp with chrony for time sync - Add opus codec (all music in opus format) - Add iperf3 and net-tools for network diagnostics - Add lexend-fonts-git font - Fix rmmod pcspkr error when module not loaded - Remove duplicate mediainfo entry (kept in Emacs section)
* fix(claude-code): use native installer instead of npm-globalCraig Jennings2026-01-211-3/+3
| | | | Native install to ~/.local/bin allows auto-updates without sudo.
* fix(archsetup): increase GRUB timeout and switch syncthing to user serviceCraig Jennings2026-01-215-5/+90
| | | | | | | - GRUB_TIMEOUT 0→2 seconds for menu access - Syncthing: system service → user service with lingering to prevent lock conflicts - Update airplanemodetoggle for user service - Update validation to check lingering instead of system service
* docs(TODO): add completed ZFS boot fixes and validation testsCraig Jennings2026-01-211-25/+34
| | | | | | | Document completed work from 2026-01-20/21 session: - Method 1: ZFS boot fixes (udev hook, nvme MODULES, random.trust_cpu) - Method 2: Boot configuration validation tests added to validation.sh - Reorganize URGENT section tasks into appropriate V2MOM methods
* fix(archsetup): prevent ZFS boot failures and add validation testsCraig Jennings2026-01-202-4/+95
| | | | | | | | | | | | | - Skip udev→systemd hook change on ZFS systems (ZFS hook is busybox-based) - Add nvme to MODULES for NVMe systems (ensures devices ready for ZFS import) - Add random.trust_cpu=off to suppress AMD RDSEED warnings - Add has_nvme_drives() detection function New validation tests: - validate_terminus_font: check package installed via pacman - validate_mkinitcpio_hooks: verify ZFS uses udev not systemd - validate_initramfs_consolefont: check font in initramfs - validate_nvme_module: check nvme in MODULES for NVMe systems
* feat(testing): add bare metal ZFS test script + fix scrub timer checkCraig Jennings2026-01-202-1/+324
| | | | | | | | | | | | Add run-test-baremetal.sh for testing on physical ZFS systems: - SSH to target host and run archsetup - Support for ZFS genesis snapshot rollback - Validate-only mode for existing installs - Same validation checks as VM tests Fix grep -c multi-line output issue in ZFS scrub timer check. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(testing): add emacs config permission checkCraig Jennings2026-01-201-0/+10
| | | | | | | Verify .emacs.d directory is readable by user cjennings, not just that it exists. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(testing): fix validation script bugs causing false failuresCraig Jennings2026-01-201-10/+24
| | | | | | | | | | - Add || true to arithmetic increments (set -e exits on ((0++))) - Fix grep -c multi-file output parsing with tr and defaults - Add fallback UFW check via systemctl when ufw status fails - Add dbus-broker timing error to benign patterns (geoclue) - Use grep -h | wc -l for error counting across multiple log files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(testing): add comprehensive validation library for archsetupCraig Jennings2026-01-202-53/+906
| | | | | | | | | | | | | | | | | | | | | Add validation.sh library with 25+ automated validation checks: - User creation, shell, and group membership (15 groups) - Dotfiles: symlink validity, target location, and readability - Package managers: yay and pacman functional tests - Suckless tools: dwm, st, dmenu, slock - Services: firewall, DNS-over-TLS, avahi (with mDNS ping test), fail2ban, NetworkManager - Developer tools: emacs, git, python, node, npm, go, rustc - Filesystem-specific: ZFS (sanoid, scrub) and btrfs (grub-btrfsd) - Archsetup-specific: log errors, state markers Also includes: - Pre/post install log capture and diff analysis - Error categorization (benign vs real) - Issue attribution (archsetup vs base install) - archzfs inbox integration for base install issues Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(archsetup): remove unnecessary firewall portsCraig Jennings2026-01-201-22/+11
| | | | | | | | | Remove ports for services not installed: - 80,443,8080/tcp (no web server) - 9040,9050,9051,9053,9119/tcp (Tor relay - only client installed) - 443/tcp limit (no HTTPS service) Add inline comments documenting each port's purpose.
* feat(archsetup): skip avahi if already runningCraig Jennings2026-01-191-3/+7
| | | | | Detect if avahi-daemon.service is active and skip install/config. Supports archzfs installs that pre-configure avahi for mDNS on first boot.
* fix(archsetup): remove root account lockingCraig Jennings2026-01-191-16/+2
| | | | | Locking root prevents console access after reboot, making recovery impossible without reinstalling.
* fix(archsetup): redirect git clone output to logfileCraig Jennings2026-01-191-2/+2
| | | | | Move redirect outside subshell so mkdir and git clone output goes to logfile instead of stdout.
* fix(archsetup): fix npm global install and add wireless-regdbCraig Jennings2026-01-191-3/+4
| | | | | - Run npm install -g as root (global install requires root perms) - Add wireless-regdb to prerequisites (prevents kernel regulatory warnings)
* fix(archsetup): start systemd-resolved before creating DNS symlinkCraig Jennings2026-01-191-0/+3
| | | | The stub-resolv.conf file only exists when systemd-resolved is running.
* feat(archsetup): configure Docker to use ZFS storage driver on ZFS systemsCraig Jennings2026-01-191-0/+9
| | | | | | | | Creates /etc/docker/daemon.json with storage-driver: zfs when running on a ZFS root filesystem. This provides better performance and enables Docker to leverage ZFS snapshots. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(archsetup): add claude-code AI coding assistantCraig Jennings2026-01-191-0/+5
| | | | | | Installs @anthropic-ai/claude-code via npm after npm is installed. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(archsetup): use official repo packages for tailscale and torbrowserCraig Jennings2026-01-191-2/+2
| | | | | | | | - tailscale-bin no longer exists in AUR; tailscale is now in official repos - torbrowser-launcher (official repo) is more reliable than tor-browser-bin (AUR) which has GPG key verification issues Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(archsetup): fix ZFS scrub timer and emacs cloneCraig Jennings2026-01-191-3/+11
| | | | | - ZFS scrub timer: use template unit with pool name (zfs-scrub-weekly@pool.timer) - Emacs config: handle existing .emacs.d dir with git pull instead of failing
* fix(archsetup): move STARTTIME outside intro() for resume supportCraig Jennings2026-01-191-1/+1
|
* feat(archsetup): add --no-root-lock flag for testingCraig Jennings2026-01-191-5/+16
|
* fix(archsetup): add harfbuzz dependency for st terminalCraig Jennings2026-01-191-1/+1
|
* fix(archsetup): fix DNS and git safe.directory for curl|bashCraig Jennings2026-01-191-2/+9
| | | | | - Bootstrap DNS symlink in create_user() before AUR/git operations - Add git safe.directory config before git restore (root on user repo)
* fix(archsetup): clone repo instead of copying for curl|bash supportCraig Jennings2026-01-191-6/+6
| | | | | When run via curl|bash, archsetup_dir resolves to /root with no files. Now clones from git.cjennings.net instead of copying local files.
* fix(archsetup): chown tmpfs mount point instead of parent dirCraig Jennings2026-01-193-295/+1
| | | | | - Fixed permission bug where source_dir tmpfs was owned by root - Remove zfssnapshot and zfsrollback (now in archzfs ISO)
* Update ZFS scripts for archzfs compatibilityCraig Jennings2026-01-182-7/+32
| | | | | | | | | | | | | | | zfssnapshot: - Change date format to YYYY-MM-DD_HH-MM-SS_description (matches pre-pacman snapshot format for consistent sorting) - Convert spaces to underscores instead of hyphens - Add GRUB menu regeneration after snapshot creation zfsrollback: - Add special warning for genesis rollback - Add GRUB menu regeneration after successful rollback (removes destroyed snapshots from boot menu) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(zfsrollback): sort snapshots with newest firstCraig Jennings2026-01-181-3/+4
|
* feat(dotfiles): add zfssnapshot and zfsrollback utilitiesCraig Jennings2026-01-182-0/+268
| | | | | | - zfssnapshot: create dated snapshots across all pools with description - zfsrollback: fzf-based snapshot selection with multi-dataset rollback - Both require root and validate input/show appropriate warnings
* feat(archsetup): add automatic console login for encrypted systemsCraig Jennings2026-01-181-8/+87
| | | | | | | - Add --autologin and --no-autologin CLI flags - Add is_encrypted_root() to detect LUKS and ZFS encryption - Prompt user on encrypted systems (default yes) - Configure getty@tty1 drop-in for passwordless login after decryption
* feat(archsetup): add wireguard-tools and tailscaleCraig Jennings2026-01-181-0/+7
| | | | | | - wireguard-tools from pacman (dotfiles have helper functions ready) - tailscale-bin from AUR (prebuilt, fast install) - Enable tailscaled service (run 'tailscale up' to authenticate)
* docs(archsetup): note potential Docker DNS issue with systemd-resolvedCraig Jennings2026-01-181-0/+3
|
* privacy(archsetup): add encrypted DNS (DNS over TLS)Craig Jennings2026-01-181-2/+28
| | | | | | | - Configure systemd-resolved with DoT using Cloudflare + Quad9 - Enable DNSSEC validation - Integrate with NetworkManager - Fix conflict: keep systemd-resolved for DNS, avahi for mDNS
* privacy(archsetup): add WiFi MAC address randomizationCraig Jennings2026-01-181-0/+14
|
* feat(archsetup): add lynis security auditing toolCraig Jennings2026-01-181-0/+1
|
* feat(archsetup): configure journald retention to 500MBCraig Jennings2026-01-171-0/+7
|
* security(archsetup): lock root account at end of scriptCraig Jennings2026-01-171-0/+4
| | | | | Root is locked last so it remains available for recovery if script fails earlier. Users must use sudo for privileged operations after successful install.
* feat(archsetup): enable weekly ZFS scrub timerCraig Jennings2026-01-171-0/+3
|
* feat(archsetup): add fail2ban for SSH brute force protectionCraig Jennings2026-01-172-0/+147
| | | | | | | - Install and configure fail2ban with ufw integration - SSH jail: 3 attempts, 1 hour ban - Default jail: 5 attempts, 10 minute ban - Also file security recommendations to assets/
* docs: add script URL to headerCraig Jennings2026-01-171-0/+1
|
* fix(archsetup): add cleanup trap to unmount tmpfs on exitCraig Jennings2026-01-171-0/+9
|
* feat(archsetup): add GPU driver detection and installationCraig Jennings2026-01-171-1/+55
| | | | | | | | | - Detect Intel, AMD, and NVIDIA GPUs via lspci - Install appropriate drivers and hardware video acceleration - Support multiple GPUs (e.g., hybrid Intel+NVIDIA laptops) - Add --no-gpu-drivers flag to skip (useful for VMs) - Use nvidia-dkms for better kernel compatibility - Add fallback to mesa+vesa for unknown hardware
* fix(archsetup): misc bug fixes and improvementsCraig Jennings2026-01-171-23/+22
| | | | | | | | | - Add missing error codes to error() calls - Remove useless mkdir pipe to tee - Remove duplicate 5353/udp firewall rule - Replace deprecated exfat-utils with exfatprogs - Quote all variable expansions for safety - Use pipx instead of pip for isolated environments
* feat(archsetup): add error summary at end of scriptCraig Jennings2026-01-171-2/+12
|
* feat(archsetup): ZFS/sanoid support, gvfs-smb, bug fixesCraig Jennings2026-01-173-70/+488
| | | | | | | | | | | | | | | | | | - Add ZFS detection with sanoid/syncoid for snapshot management - Add gvfs-smb for Thunar SMB network browsing - Fix shell quoting throughout script - Fix stale $action variables in error handlers - Fix display() return values (was returning 1) - Fix mkinitcpio.conf sed pattern to be flexible - Fix vconsole.conf duplicate entries on re-run - Fix systemd unit overrides using drop-in files - Fix ufw port typo (55353 -> 5353) - Fix GRUB_RECORDFAIL_TIMEOUT undefined variable - Enable NetworkManager service - Move thunar, libvips, isync to pacman (now in official repos) - Clean up reflector config with heredoc - Remove unnecessary sudo when already root - Convert shebang from sh to bash
* dotfiles: update hey alias, add phenom RAG functionCraig Jennings2026-01-171-2/+6
|
* dotfiles: ai-assistants prompt and formatting improvementsCraig Jennings2026-01-171-15/+15
|