football

KNEL/football

Fork 0

Commit Graph

Author	SHA1	Message	Date
reachableceo	938182fc9f	fix: add GRUB timeout for auto-boot GRUB had no timeout set, causing it to wait indefinitely at the boot menu. Added 5-second timeout so the default entry (live system) boots automatically. Required for automated/serial console testing. 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>	2026-05-07 10:51:22 -05:00
reachableceo	9459c84fbc	fix: resolve all audit findings in hooks, config, and package list Security/Functional Fixes: - firewall-setup.sh: Added WireGuard allow, established/related, DHCP (was blocking ALL outbound including VPN - system was non-functional) - disable-package-management.sh: Preserve /var/lib/dpkg/ for queries (was destroying dpkg database with rm -rf) - encryption-validation.sh: Fixed inverted motd conditional (was creating file only if it already existed - backwards) - kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only) Changed user.max_user_namespaces from 0 to 100 - sudo-hardening.sh: Removed Defaults requiretty (was breaking GUI-launched sudo via pkexec) - encryption-setup.sh: Fixed conflicting stdin in luksAddKey - install-scripts.sh: Fixed embedded firewall (same WireGuard bug) Replaced gutted security-hardening stub with real status checker - GRUB config: Fixed serial_console → serial (invalid terminal name) - Package list: Removed audispd-plugins (deprecated in Debian 13), removed duplicate wireguard/wireguard-tools entries Reference: Full audit findings from Session 7 JOURNAL.md 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>	2026-05-07 08:41:52 -05:00
reachableceo	0fb9abe43e	feat: add dual-mode ISO builds (production vs demo) with serial console Two build modes: - `./run.sh iso` — production ISO (prompts for credentials, quiet boot) - `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial console output, verbose kernel) Changes: - run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker - run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0 - config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0 at 115200 baud alongside VGA gfxterm (dual output) - config/includes.installer/demo.preseed.cfg: Fully automated preseed with hardcoded test credentials (NOT for production use) - config/hooks/binary/0199-serial-console.hook: Ensures serial console on Debian installer entries too - .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/) Demo credentials (TESTING ONLY): - User: football / Kn3l-F00tball-D3m0! - Root: Kn3l-R00t-D3m0! - LUKS: Kn3l-D3m0-LUKS! 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>	2026-05-01 11:35:43 -05:00

Author

SHA1

Message

Date

reachableceo

938182fc9f

fix: add GRUB timeout for auto-boot

GRUB had no timeout set, causing it to wait indefinitely at the boot
menu. Added 5-second timeout so the default entry (live system) boots
automatically. Required for automated/serial console testing.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

2026-05-07 10:51:22 -05:00

reachableceo

9459c84fbc

fix: resolve all audit findings in hooks, config, and package list

Security/Functional Fixes:
- firewall-setup.sh: Added WireGuard allow, established/related, DHCP
  (was blocking ALL outbound including VPN - system was non-functional)
- disable-package-management.sh: Preserve /var/lib/dpkg/ for queries
  (was destroying dpkg database with rm -rf)
- encryption-validation.sh: Fixed inverted motd conditional
  (was creating file only if it already existed - backwards)
- kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only)
  Changed user.max_user_namespaces from 0 to 100
- sudo-hardening.sh: Removed Defaults requiretty
  (was breaking GUI-launched sudo via pkexec)
- encryption-setup.sh: Fixed conflicting stdin in luksAddKey
- install-scripts.sh: Fixed embedded firewall (same WireGuard bug)
  Replaced gutted security-hardening stub with real status checker
- GRUB config: Fixed serial_console → serial (invalid terminal name)
- Package list: Removed audispd-plugins (deprecated in Debian 13),
  removed duplicate wireguard/wireguard-tools entries

Reference: Full audit findings from Session 7 JOURNAL.md

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

2026-05-07 08:41:52 -05:00

reachableceo

0fb9abe43e

feat: add dual-mode ISO builds (production vs demo) with serial console

Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
  console output, verbose kernel)

Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
  at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
  with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
  on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)

Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

2026-05-01 11:35:43 -05:00

3 Commits