- Fix function name: configure_ssh → configure_ssh_client (matches src/)
- Add missing configure_fim call for AIDE File Integrity Monitoring
These functions exist in src/security-hardening.sh but the hook was
calling the wrong name or missing the FIM call entirely.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Improve code quality by addressing shellcheck warnings
across security-critical scripts.
src/security-hardening.sh:
- Add shellcheck directive for SC2120/SC2119
- Function configure_password_policy() accepts optional args
- Directive documents intentional usage pattern
src/firewall-setup.sh:
- Fix function argument passing in main()
- Properly pass arguments to configure_firewall()
config/hooks/installed/encryption-setup.sh:
- Consolidate echo commands to fix SC2129
- Use single redirect for multiple writes
Remaining warnings are non-critical:
- SC1091: Source files exist at runtime in Docker container
- SC2016: Intentional single quotes for sed pattern
No functional changes - purely code quality improvements.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
Validate LUKS2 encryption configuration, create user-facing reminder files, MOTD messages, and first-boot check script to ensure encryption requirements are met and users are informed.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Configure LUKS2 with AES-256-XTS encryption, cryptsetup-initramfs, initramfs modules, key management scripts, and encryption status systemd service for automated encryption setup during installation.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Update disable-package-management.sh with immutable permissions
- Update install-scripts.sh with proper path handling
- Add knel-football.list.chroot package list
- Add desktop shortcuts for VPN configuration
- Add USB automount support
💘 Generated with Crush
Assisted-by: GLM-4.6 via Crush <crush@charm.land>
- Update to ignore KNEL-Football specific build artifacts
- Remove blanket config/ directory ignore
- Add build directories and temporary files
- Add ISO artifacts and checksum patterns
- Add security exclusions for keys and secrets
💘 Generated with Crush
Assisted-by: GLM-4.6 via Crush <crush@charm.land>
- Add security-hardening.sh for system hardening
- Add firewall-setup.sh for nftables configuration
- Add qr-code-import.sh for WireGuard QR scanning
- Add disable-package-management.sh to secure package tools
- Add install-scripts.sh to install source utilities
These hooks implement core security and functionality requirements.
💘 Generated with Crush
Assisted-by: GLM-4.6 via Crush <crush@charm.land>
