EL10 pam_u2f has no nullok — use nouserok, and make the control flag sufficient (required fails the whole stack without a token, hanging GDM/sudo).

Registration: pamu2fcfg already emits '<user>:<handle>,...' — the scripts were prepending the username again, producing a malformed authfile that silently matched nothing (this broke the first real deployment). Stop double-prefixing in setup_nitrokey.sh and nitrokey-register.sh; also stop touching/chmod'ing the authfile before the atomic install, drop the dead for-loop, and fix the wrong -i flag.

Patch PAM files in place instead of prepending the include, keep '-auth optional' lines (GNOME keyring), and verify the fragment got included — auto-revert when no auth line is found. leaf check-in: e7c348d5f9 user: andrew tags: master, trunk

patch_pam declared unused $2/$3 params while callers passed only one, awk -v referenced shell $name/$frag inconsistently, and the idempotency check grepped a dangling $marker. Verified with full sandboxed dry run: all three PAM files patched correctly, idempotent rerun, --remove restores .orig files. Real run enroll failed at patch_pam before this fix. check-in: 98a20bffeb user: andrew tags: master, trunk

Table definitions can't appear inside a chain block (where the include happens). Replaced with inline address sets that work directly in-chain. check-in: e53f7b9f25 user: sourcehut@lewman.us tags: master, trunk

Service .nft files used `add rule` (command syntax) but were included via `include` in a declarative config, which is invalid. Moved includes inside the chain in base.nft and converted service rules to bare declarative expressions. Also commented out all ssh.nft rules as a choose-one template and fixed install instructions in nft.local. check-in: 73ccad5bb1 user: sourcehut@lewman.us tags: master, trunk

ICMPv6 pass-in rule used "to $ext_if" but Router Advertisements are sent to multicast ff02::1, which doesn't match interface unicast addresses. This silently dropped unsolicited RAs after the initial state expired, preventing SLAAC address renewal. Also split the scrub rule to avoid applying random-id (IPv4-only) to IPv6 traffic. check-in: fc3738a23c user: sourcehut@lewman.us tags: master, trunk

The script uses fish syntax but had a .sh extension, causing bashls parse errors. Rename to .fish to reflect the actual interpreter.

Additional fixes: - Add OS guard at the top: exit early if not FreeBSD 15.0 or newer - Remove dead ARM64 code path (script is x86-only); hardcode bootx64.efi - Simplify minor version parsing (drop unnecessary capture group + pipe) - mkdir -p EFI destination dirs before copying loader.efi - Add error checks after both loader.efi cp commands check-in: ccba8f8022 user: sourcehut@lewman.us tags: master, trunk

Replace apt-get upgrade with full-upgrade to handle package removals. Install flatpak separately before other packages, add flathub remote, and install gnome-software-plugin-flatpak for GUI integration. check-in: da9e3fa006 user: sourcehut@lewman.us tags: master, trunk

Installs flatpak via apt alongside the rest of the standard tools so the system has a snap-free alternative package manager ready. check-in: f3381d6bf4 user: sourcehut@lewman.us tags: master, trunk

Change the awk filter from >= 3071 to > 3071 so only moduli strictly larger than 3071 (i.e. 3072 or higher) are kept. This aligns with the intended "3072-bit minimum" policy.

Affected: Arch, Fedora, and FreeBSD setup scripts. check-in: 86031511bf user: sourcehut@lewman.us tags: master, trunk

Creates ubuntu/setup_ubuntu.sh that: - Purges snap and blocks reinstall via apt pin - Installs standard tooling via apt (btop, fastfetch, fish, helix, etc.) - Regenerates SSH host keys (ed25519 + RSA-4096) - Applies the same hardening as Arch: nftables, journald limits, systemd-resolved DNS, kernel lockdown, and service disables check-in: 6d8c9073cd user: sourcehut@lewman.us tags: master, trunk

nftables requires semicolons after flush ruleset, include statements, and add rule commands when not inside a table block. Without them the parser fails with "unexpected include" and "unexpected end of file". check-in: d589d4f160 user: sourcehut@lewman.us tags: master, trunk

Add error suppression to systemctl disable/stop calls for avahi, cups, and resolved so the script succeeds on minimal installs where these units may not exist. check-in: bd2f09d22d user: sourcehut@lewman.us tags: master, trunk

- Generate the missing RSA-4096 SSH host key required by sshd_config and include 3071-bit moduli instead of filtering them out. - Correct nftables source paths and enable systemd-resolved so DNS works immediately after the script finishes. - Make config appends idempotent and use strict bash error handling to prevent partial system states on re-runs or pipeline failures. check-in: 05eef99a1f user: sourcehut@lewman.us tags: master, trunk

Replaces the minimal upgrade snippet with a full fish script that safely upgrades FreeBSD using the base system packages method.

- Requires a version argument (e.g. 15.1-RELEASE) - Creates a ZFS boot environment snapshot for rollback - Automatically computes ABI and OSVERSION from the version string - Detects UEFI vs BIOS and upgrades the boot loader appropriately - Prompts for confirmation before running destructive gpart commands - Checks for .pkgnew files that need manual merging check-in: b9f24f7ba4 user: sourcehut@lewman.us tags: master, trunk

Split monolithic nftables.conf into separate rule files under nft.d/, mirroring the pf/ organization. Added base, syncthing, ssh, http, and irc rule sets. Updated arch setup script to copy the new directory structure. check-in: 43d230dc69 user: sourcehut@lewman.us tags: master, trunk

All remaining alias statements have been turned into proper fish functions, removing any 'alias' keyword from the config file. This improves maintainability and follows fish best‑practice conventions. check-in: eafa7324a4 user: sourcehut@lewman.us tags: master, trunk

- Removed the now‑redundant alias from the Nerd‑Font block. - function remains, providing a reliable way to list only dotfiles regardless of Nerd‑Font presence. - No functional changes beyond the cleanup of the unused alias. check-in: 83351b5166 user: sourcehut@lewman.us tags: master, trunk

- Remove deprecated and options (UTF‑8 is always on in tmux ≥2.2). - Add comment explaining automatic UTF‑8 support. - Set to for proper 256‑color support. - Keep existing theme and status settings unchanged. check-in: 2a573e8f46 user: sourcehut@lewman.us tags: master, trunk

- Introduce __has_nerd_font function that checks for installed Nerd Fonts via fc-list. - Conditionally set ls‑style aliases (la, ll, lt, l.) only when a Nerd Font is present. - Prefer eza with icons if available; otherwise fall back to GNU ls with -F flag. - Improves visual directory listings while keeping compatibility on systems without Nerd Fonts. check-in: c8d87b7552 user: sourcehut@lewman.us tags: master, trunk