Commit graph

8 commits

Author SHA1 Message Date
827465ca59
security: keep rootless podman storage on /mnt/data
Container images and build caches (anotherim-js's build images alone
are several GB each) had filled the root filesystem, and a NDK unzip
in an image build failed with the disk full. Point
rootless_storage_path at the data disk. Existing storage was moved
there with its libpod database paths rewritten.

Assisted-by: Claude:opus-5
2026-10-16 05:41:54 +04:00
1d1f5600eb
security: enable core dumps and on-demand debug symbols
gnome-shell keeps segfaulting in libmutter, and with the PAM core
limit at 0 systemd-coredump threw every dump away, so there was no
backtrace to work from. Raise the limit to unlimited; dumps land
root-owned in /var/lib/systemd/coredump, readable only by their
owner. Enable nixseparatedebuginfod2 so gdb/coredumpctl can fetch
symbols for store paths on demand.

The user manager inherits the limit at its first login, so it takes
a reboot (or a full logout) to apply.

Assisted-by: Claude:opus-5
2026-10-13 06:31:49 +04:00
5fbe4e306f
ThinkPad T14 G2 AMD -> P14s G6 AMD 2026-05-07 17:55:07 +03:00
8c5c54c797
turn off usbguard 2026-01-31 06:11:31 +02:00
306c51900e
podman and opensnitch 2026-01-31 06:11:31 +02:00
23ca86c7d5
docker -> podman 2026-01-13 10:38:35 +02:00
7f68764d33
hardened kernel + usbguard 2026-01-13 07:58:30 +02:00
5cbce68d88
hardening 2026-01-13 07:07:17 +02:00