init.env.example

# Private provisioning configuration for init.sh.
# Copy to init.env, replace placeholders, review every opt-in action, and set
# mode 0600. Disabled actions do not use their associated values. This file is
# trusted Bash syntax; never use a private copy received from an untrusted source.
# shellcheck disable=SC2034

# Identity creation is deliberately outside this provisioner. The account must
# already exist, be non-root and have been created by the OS installer.
CONFIG_USER="replace-with-existing-user"

# Package manager used for the mandatory phase-one system update.
# "auto" detects Arch/Pacman and Debian/APT systems. When Yay is already
# installed on a Pacman host, installed AUR packages are updated as CONFIG_USER.
CONFIG_PACKAGE_MANAGER="auto"

# Radio, journal and memory. RFKill targets are comma-separated radio types or
# numeric device IDs, not network interface names. Blocking the radio carrying
# an SSH session will disconnect that session. Debian requires package rfkill.
CONFIG_INIT_RFKILL=false
CONFIG_RFKILL_TARGETS="wlan"
# Persistent journal limits. These settings do not enable persistent storage
# and therefore do not affect hosts which keep their journal only under /run.
CONFIG_INIT_JOURNAL_LIMIT=false
CONFIG_JOURNAL_SYSTEM_MAX_USE="250M"
CONFIG_JOURNAL_SYSTEM_MAX_FILE_SIZE="50M"
# zram uses the native systemd generator and automatically installs its Arch or
# Debian package. Enabling it also disables zswap before zram setup and disables
# dphys-swapfile when that Raspberry Pi OS service exists. Use "ram / 2" for a
# primary compressed swap or "ram / 4" for a conservative safety margin. Leave
# the compression algorithm empty to use the kernel default.
CONFIG_INIT_MEMORY_CONFIGURE=false
CONFIG_MEMORY_SWAPPINESS="180"
CONFIG_MEMORY_PAGE_CLUSTER="0"
# Leave empty to retain the kernel default. Redis and Valkey commonly require
# mode 1 so background persistence is not rejected by strict commit accounting.
CONFIG_MEMORY_OVERCOMMIT_MEMORY=""
CONFIG_MEMORY_ZRAM_ENABLED=false
CONFIG_MEMORY_ZRAM_SIZE="ram / 2"
CONFIG_MEMORY_ZRAM_COMPRESSION_ALGORITHM=""

# Optional official-repository packages, separated by commas. Package names
# differ between distributions, so keep independent Pacman and APT lists.
CONFIG_PACMAN_PACKAGES=""
CONFIG_APT_PACKAGES=""

# Optional package maintenance and Pacman appearance. Cleanup automatically
# removes orphaned packages and empties downloaded APT, Pacman and Yay caches.
CONFIG_INIT_PACKAGE_CLEANUP=false
CONFIG_INIT_PACMAN_ENABLE_COLORS=false

# Raspberry Pi bootloader and boot firmware. "default" is the conservative
# EEPROM release; "latest" provides newer tested features. Available updates
# are staged without replacing the board's existing EEPROM configuration.
CONFIG_INIT_RPI_EEPROM_UPDATE=false
CONFIG_RPI_EEPROM_RELEASE="default"
# Boot settings are written to a managed fragment included by config.txt.
# Keep one firmware line per array element; model filters are supported. The
# provisioner supplies neutral [all] filters around this content.
#
# Example (replace the empty array below and review every setting):
# CONFIG_RPI_BOOT_SETTINGS=(
#     "[pi5]"
#     "dtoverlay=disable-wifi-pi5"
#     "arm_freq_min=600"
#     "usb_max_current_enable=1"
# )
CONFIG_INIT_RPI_BOOT_CONFIGURE=false
CONFIG_RPI_BOOT_SETTINGS=()

# User account and editor. Supplementary groups are additive and per-host;
# memberships not listed here are never removed. Examples:
# Arch Docker host: "wheel,docker"
# Arch Docker host with a serial adapter: "wheel,uucp,docker"
# Raspberry Pi OS: "adm,dialout,sudo,audio,video,plugdev,input,render,netdev,spi,i2c,gpio,docker"
CONFIG_INIT_USER_ADD_TO_GROUPS=false
CONFIG_USER_GROUPS_TO_ADD=""
# This grants unrestricted root access without authentication. When enabled,
# the provisioner installs and validates one mode-0440 sudoers drop-in.
CONFIG_INIT_USER_SUDO_WITHOUT_PWD=false
# Install a common Bash login chain, Readline preferences, color aliases,
# completion and fzf integration for CONFIG_USER and root. Existing .bashrc
# content is retained and loads one managed fragment.
CONFIG_INIT_SHELL_CONFIGURE=false
# Add the packaged Nano syntax definitions and line numbers to both the normal
# user's and root's .nanorc while preserving their other editor preferences.
CONFIG_INIT_NANO_CONFIGURE=false

# Network policy. The optional reserved-port list accepts comma-separated
# ports or ranges such as "40000,41000-41010". Leave it empty when no local
# service must be protected from automatic ephemeral-port allocation.
CONFIG_INIT_NETWORK_CONFIGURE=false
CONFIG_NETWORK_IPV4_FORWARDING=true
CONFIG_NETWORK_IPV6_FORWARDING=false
CONFIG_NETWORK_RESERVED_PORTS=""
CONFIG_NETWORK_CONGESTION_CONTROL="bbr"
CONFIG_NETWORK_DEFAULT_QDISC="fq"

# Storage. This enables the distribution-provided periodic fstrim timer.
# Only add a USB VID:PID after verifying that the bridge supports UNMAP but the
# kernel reports provisioning_mode=full. Example: ("1234:abcd"). An empty
# array never forces discard support.
CONFIG_INIT_FSTRIM_ENABLE=false
CONFIG_FSTRIM_USB_UNMAP_IDS=()

# Time synchronization. Choose "timesyncd" for a trusted local NTP server or
# "chrony" for direct NTS authentication. Fallback servers are used only by
# timesyncd. The public Chrony example requires at least three of six
# independent sources to agree and never serves time to other hosts.
CONFIG_INIT_NTP_CUSTOMIZATION=false
CONFIG_NTP_BACKEND="chrony"
CONFIG_NTP_SERVERS="time.cloudflare.com nts.netnod.se ptbtime4.ptb.de ntp3.fau.de ntppool1.time.nl ts11.univie.ac.at"
CONFIG_NTP_FALLBACK_SERVERS=""
CONFIG_NTP_CHRONY_NTS=true
CONFIG_NTP_CHRONY_MIN_SOURCES="3"
CONFIG_NTP_CHRONY_MAX_UPDATE_SKEW="100"
CONFIG_NTP_CHRONY_LOG_CHANGE="0.5"

# SSH. Public keys are intentionally empty; never store private keys here.
# The known-hosts source must contain verified public host keys and is installed
# as the system-wide /etc/ssh/ssh_known_hosts file.
CONFIG_INIT_SSH_KEYS_ADD=false
CONFIG_SSH_KEY_USER=""
CONFIG_SSH_KEY_ROOT=""
CONFIG_INIT_SSH_HOSTS_ADD=false
CONFIG_SSH_KNOWN_HOSTS_FILE=""
# Hardening follows secure OpenSSH defaults instead of freezing algorithm
# lists in the public repository. The first successful hardening run rotates
# the server identity and records a root-owned marker under /var/lib; later
# runs update and validate the policy without changing identity. Set the force
# flag only for an intentional emergency/manual rotation. RSA 4096 and
# Ed25519 keys are generated, MLDSA is added when supported, and obsolete
# default host keys are removed. Clients must then update known_hosts using the
# fingerprints printed by init.
# Leave port and address family empty to keep the existing host setting.
# Root remains key-only by default.
CONFIG_INIT_SSH_HARDENING=false
CONFIG_SSH_FORCE_HOST_KEY_ROTATION=false
CONFIG_SSH_PORT=""
CONFIG_SSH_ADDRESS_FAMILY=""
CONFIG_SSH_PERMIT_ROOT_LOGIN="prohibit-password"
# OpenSSH 10.0 or newer only. Example: "192.0.2.10/32". Leave empty on older
# releases and whenever no trusted source must bypass connection penalties.
CONFIG_SSH_PER_SOURCE_PENALTY_EXEMPT_LIST=""
# One global sshd_config directive per element. Keep host-specific algorithm
# policy and private network values only in the ignored init.env. Include and
# HostKey, Include and Match are rejected because the provisioner owns host-key
# selection and every additional directive must remain globally scoped.
CONFIG_SSH_EXTRA_DIRECTIVES=()

# Services. On Debian/Raspberry Pi OS, enabling Docker configures Docker's
# official APT repository and installs Engine, CLI, containerd, Buildx and the
# Compose plugin. Do not duplicate those packages in CONFIG_APT_PACKAGES.
CONFIG_INIT_SRV_BT_ENABLE=false
CONFIG_INIT_DOCKER_DAEMON_CONFIGURE=false
# The native nftables backend is still experimental in Docker Engine. Leave
# the backend empty to retain Docker's default. The local logging driver bounds
# container log growth without per-container settings. IPv6 and its optional
# allocation prefix are deliberately host-specific; never reuse an example
# subnet without planning the network.
CONFIG_DOCKER_EXPERIMENTAL=true
CONFIG_DOCKER_FIREWALL_BACKEND="nftables"
CONFIG_DOCKER_LOG_DRIVER="local"
CONFIG_DOCKER_IPV6=false
CONFIG_DOCKER_FIXED_CIDR_V6=""
CONFIG_INIT_SRV_DOCKER_ENABLE=false

# systemd-resolved global policy. Empty DNS assignments deliberately clear
# global and fallback servers so systemd-networkd can supply per-link DNS and
# routing domains. Set space-separated servers only when a host needs global
# resolver addresses. "uplink" exposes real upstream addresses in resolv.conf;
# "stub" uses 127.0.0.53 and requires an enabled stub listener.
CONFIG_INIT_SYSTEMD_RESOLVED_CONFIGURE=false
CONFIG_RESOLVED_DNS=""
CONFIG_RESOLVED_FALLBACK_DNS=""
CONFIG_RESOLVED_DNSSEC="no"
CONFIG_RESOLVED_DNS_OVER_TLS="no"
CONFIG_RESOLVED_LLMNR="no"
CONFIG_RESOLVED_MULTICAST_DNS="yes"
CONFIG_RESOLVED_STUB_LISTENER="no"
CONFIG_RESOLVED_RESOLV_CONF_MODE="uplink"

# Docker registry login. Empty registry selects Docker Hub. Otherwise use only
# hostname[:port], without a URL scheme or repository path. On headless hosts,
# an empty username uses Docker Hub's device code in any external browser; a
# username forces the hidden password/PAT prompt in the current SSH terminal.
# Passwords and tokens never belong in this file.
CONFIG_INIT_DOCKER_LOGIN=false
CONFIG_DOCKER_REGISTRY=""
CONFIG_DOCKER_USERNAME=""
CONFIG_INIT_DOCKER_NETWORK_ADD_CUSTOM_BRIDGE=false
CONFIG_DOCKER_NETWORK_CUSTOM_BRIDGE_NAME="custom_bridge"

# Restore only administrator-controlled TAR archives. Both paths are
# host-specific and must be absolute; "/" reproduces the legacy full-system
# restore, while another existing directory confines extraction there.
CONFIG_INIT_BACKUP_RESTORE=false
CONFIG_BACKUP_FILE_PATH=""
CONFIG_BACKUP_RESTORE_DESTINATION="/"
# The Compose file path is host-specific and must be absolute when enabled.
CONFIG_INIT_DOCKER_COMPOSE_START=false
CONFIG_DOCKER_COMPOSE_FILE_PATH=""