🍙 dotfiles 🍙

I use arch, btw

> _"...we {do these} things not because they are easy, but because they are hard_,"

>   _"because that goal will serve to organize and measure the best of our energies and skills_,"

>     _"because that challenge is one that we are willing to accept, one we are unwilling to postpone_..."

👨‍💻 Software

🎥 Appearance

🛠️ Installation

This system is built specifically for the Framework Desktop (AMD Strix Halo, Ethernet only).

• Offline Arch ISO: installs the base system and dotfiles without a network.
• LUKS2 and YubiKey unlock: encrypts the disk; keeps passphrase and paper recovery options.
• btrfs with Snapper: keeps root snapshots for recovery and manual rollback.
• Limine and unified kernel images (UKIs): supports signed boot images and snapshot boot.
• Own-key Secure Boot and TPM-sealed TOTP: adds signatures and boot-state evidence.
• Two-phase setup: makes the desktop work before asking separately to lock it down.

_See the dctl guide for commands and recovery._

There is no model check, but this system is only tested on that machine. AMD packages, no Wi-Fi packages, NVMe selection, and firmware menus limit portability.

[!CAUTION]

> dctl iso usb erases the whole USB.

dctl install erases the whole target drive.

ISO ─▶ USB ─▶ firmware prep ─▶ install ─▶ reboot
  ┌─────────────────────────────────────────┘
  ▼
phase 1 ─▶ lock confirmation ─▶ luks ─▶ secureboot ─▶ reboot
  ┌─────────────────────────────────────────────────────┘
  ▼
totp ─▶ reboot and compare

1. Get the ISO

Download the ISO with its .sha256 and .sha256.sig files from Releases.

Or build a new one on an existing Arch machine:

dctl iso build
dctl iso test
dctl iso release # optional

• Build from a clean, committed master.
• USB writing needs signed checksums; release signs them before offering to publish.

_See ISO for requirements and test overrides._

2. Write the USB

Writing verifies the signed checksum and requires typed device-path consent. Add --iso /path/to/dotfiles-REV.iso for a downloaded ISO.

dctl iso usb /dev/sdX

3. Prepare the Framework

Prepare the firmware now to avoid another visit during security enrollment.

1. Back up any data on the internal disk.
2. Press F2 and choose Erase all Secure Boot Settings to enter Setup Mode.
3. Leave the TPM enabled and press F10 to save.

4. Install

The installer creates the encrypted system and desktop from bundled packages.

1. Press F12 and choose the USB in UEFI mode; the ISO starts the installer on tty1.
2. Enter the login password for cullyn, the timezone, and the disk passphrase.
3. Check the selected disk before confirming Erase and install?.
4. At the completed summary, remove the USB and reboot.

5. First login

Unlock with the passphrase, log in, connect Ethernet, and insert a YubiKey.

dctl setup

Phase 1, make it work, then runs:

1. Check system services and Ethernet/DNS (system, network).
2. Apply packages and home settings (packages, home).
3. Install extra applications in the background (extra).
4. Restore secrets, SSH access, and repositories (secrets, ssh, repos).
5. Set up Firefox and local certificates (firefox, certs).

_See Setup for stages and first-login details._

6. YubiKeys, Secure Boot, and boot TOTP

Phase 2, lock it down, secures the system after a separate confirmation. Run setup as the normal user; --yes never accepts the lock confirmation.

1. Enroll both YubiKeys for disk unlock and save the recovery key onto paper.
2. Enroll the Secure Boot keys, then reboot with a YubiKey inserted.
3. Once Secure Boot is enforced, run setup again to seal and verify the boot TOTP.
4. Reboot and compare the boot code with the authenticator before unlocking.

_See Secure Boot for the lock procedure._

_See hardware acceptance for real-machine checks._

Day-to-day use

dctl update --only {scope}

_See Update for upgrades and package reconciliation._