infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity
62 Commits 1 Branch 0 Tags
3c7bf3bd73b32b1fc78dbcc8a12e7899fb6f0dc4
Commit Graph
62 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ja 3c7bf3bd73 Add SUPER+Enter as alternative terminal shortcut 2026-05-28 08:54:33 +02:00
ja 5173fdd5e0 Enable NumLock on boot via tuigreet and Hyprland 
- Install numlockx
- Add --numlock flag to tuigreet greeter
- Add exec-once = numlockx on to Hyprland config
 2026-05-28 08:32:40 +02:00
ja dbf366f8a5 Update Hyprland keybindings and monitor refresh rates 
- SUPER+Q: killactive (was kitty)
- SUPER+T: exec kitty (new terminal binding)
- SUPER+C: removed (was killactive)
- All monitors set to 60Hz (DP-1 and HDMI-A-1 down from 144Hz)
 2026-05-28 08:25:57 +02:00
ja 6f455ab0f2 chore: remove alesi-routine-morning systemd timer 
- Deleted alesi-routine-morning.service and .timer from ~/.config/systemd/user/
- Timer failed daily at 07:45 (exit 128, git outside repo)
- daily-routine.sh script retained for manual use
- Updated CHANGELOG.md and workstation-health.md
 2026-05-26 08:59:00 +02:00
ja b0af3dcf12 Workstation optimization: Chrome cleanup, package purge, PCIe audit, service tuning 
- Chrome/Chromium cleanup (ADR 0006): removed 10GB chromium profile, broken PWA
  shortcuts, dead BROWSER_CDP_URL from .bashrc, restored Wayland chrome-flags.conf
- Package cleanup (ADR 0007): Tier 1-4 executed, 40 packages removed (KDE Plasma,
  ruby, love, xorg-server, kscreen/kscreenlocker), 45 cascade orphans purged
- Waybar USB module: auto-mount via udisks2, yazi integration, hover details
- Service tuning: disabled bluetooth.service, NetworkManager-wait-online.service
- hypridle fix: upgraded sdbus-cpp 2.3.0->2.3.1-1 (SEGV crash loop resolved)
- PCIe audit: GPU in wrong slot (PCIEX4 vs PCIEX16), 8x bandwidth loss documented
- D-Bus cleanup: removed stale org.kde.kwalletd6.service stub
- Ansible: all changes reflected in vars/main.yml and task files
 2026-05-22 16:24:18 +02:00
ja 2487aa5749 feat(chrome): NVIDIA Wayland GPU acceleration for Chrome 148 
Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API
hardware decode config for Chrome 148 on Wayland/Hyprland.

- Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error
- Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland)
- Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts
- Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux*
- Add gnome-libsecret password store for gnome-keyring integration
- Install libva-utils and libva-nvidia-driver packages
- Update driver version to 580.159.03 in hardware inventory

WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified
working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.
 2026-05-21 16:02:11 +02:00
ja 7d8760592e chore: align IaC with today's package installs + PDF comparison docs 
DevOps sync (2026-05-21):
- Remove onlyoffice-desktopeditors from absent list (actively used)
- Add gnome-keyring, rbw to common role (secrets migration)
- Add perl-image-exiftool, icoutils, innoextract-git to dev-tools
  (Windows installer inspection)
- Create fonts role: Inter, Cascadia Code, Fira, Source Sans, TeX Gyre
- Create pdf role: zathura, zathura-pdf-mupdf, python-weasyprint
- Register new roles in workstation.yml

PDF comparison:
- Add pdf-comparison docs with Quarto/Typst/Pandoc outputs
- Add batch-pdf.sh script
- Update yazi-cheatsheet.md
- Ignore .quarto/ cache
 2026-05-21 13:38:50 +02:00
ja d746d76530 migrate secrets management from KWallet to gnome-keyring + Bitwarden 
Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring
(local cache via org.freedesktop.secrets D-Bus). All apps (himalaya,
git, ssh-agent, JetBrains IDEs, browsers) now read secrets via
libsecret/secret-tool through gnome-keyring.

Changes:
- Install gnome-keyring + rbw, enable as systemd user service
- Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com)
- Migrate 45 meaningful entries from KWallet → BW + GK
- Switch git credential.helper from store to libsecret
- Document: one-pager, ADR, migration checklist, NEXT_STEPS update
- Skill: devops/secrets-migration for reuse

Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in
KWallet) and GitHub CLI token re-auth.

See docs/product/passwords.md for the full guide.
 2026-05-21 12:58:38 +02:00
ja a9bc934543 chore: add LibreOffice lock files to .gitignore 2026-05-21 11:16:29 +02:00
ja ee592cc21b feat: add start-hyprland watchdog override for uwsm session 
Hyprland 0.53+ requires launching via start-hyprland (watchdog) for
proper crash diagnostics and signal handling. Without it a warning
banner appears on login.

Override package-managed hyprland.desktop with local copy pointing to
start-hyprland. XDG_DATA_DIRS priority ensures the override wins
without modifying system files.

- ansible/roles/hyprland/tasks/main.yml: manage override in ~/.local/share/wayland-sessions/
- docs/adr/0004-start-hyprland-override.md: full decision record
- docs/hyprland-uwsm.md: document override behavior
 2026-05-21 11:15:14 +02:00
ja f81c789683 feat(docs): add Hyprland keybindings and screenshot cheatsheet 2026-05-21 09:25:30 +02:00
ja 2bf5f5c005 ansible: sync templates with live system state 
- hyprland: add pulseaudio + custom/gpu modules to waybar
- hyprland: template hyprlauncher.conf
- hyprland: add keybinding updates (yazi, chrome, screenshots, reload)
- hyprland: add uwsm package, replace wofi with hyprlauncher
- hyprland: add waybar GPU monitoring script
- greetd: update tuigreet command to uwsm start
- vars: add uwsm, hyprlauncher; remove wofi; add screenshot tools
 2026-05-21 09:10:24 +02:00
ja 1fcb467c04 feat: uwsm integration and hyprland worktime saver keybinds 
- Replace SDDM with greetd+tuigreet (VT1) using uwsm-managed Hyprland
- Remove legacy exec-once from hyprland.conf
- Create 6 systemd user services: hyprpaper, waybar, dunst, hypridle,
  hyprlauncher, cliphist (all WantedBy=graphical-session.target)
- Add worktime saver keybinds: fullscreen, float, cycle windows,
  scratchpad, reload config, browser, keybind menu
- Home row navigation: HJKL for focus, move, resize (SUPER+ALT)
- Replace wofi with hyprlauncher (first-party, uwsm app prefix)
- Add hyprlauncher config with finders: desktop, math, unicode, font
- New ansible role templates: systemd/user services
- Documentation: hyprland-uwsm.md, cheatsheet.txt

KDE Wallet -> Bitwarden migration deferred (extract script prepared)
 2026-05-20 16:02:53 +02:00
ja 9d06a71f71 feat: migrate from SDDM to greetd+tuigreet 
- Add greetd role with tuigreet greeter (3 packages, 4.9MB)
- Replace SDDM as display-manager.service with greetd
- Add ADR 0003 documenting migration rationale
- Rename hyprland task: "register session in SDDM" -> "register
  Wayland session desktop entry"
- Add display_manager variables to vars/main.yml
- Add greetd role to workstation.yml
- Update setup.md timestamp
 2026-05-20 12:51:25 +02:00
ja 1274b3e2cb feat: add hyprpaper wallpaper management with Next manga wallpaper 2026-05-20 12:31:21 +02:00
ja 89acae9751 feat(ansible/hyprland): enable left-handed mouse (pixart-usb-optical-mouse) 2026-05-20 12:09:02 +02:00
ja 7a95ef0019 fix(ansible/hyprland): standardize keybindings (Super+Q open, Super+C close) 
Change default Hyprland keybindings to match convention:
- Super+Q now opens kitty (was Return)
- Super+C now kills active window (was Q)
 2026-05-20 12:02:34 +02:00
ja a67c629356 fix(ansible/hyprland): update template for Hyprland 0.55+ syntax 
- Remove pseudotile (removed in 0.55)
- Change togglesplit to layoutmsg, togglesplit
 2026-05-20 11:34:53 +02:00
jaandJunie cdb0730280 docs: update hardware/setup docs and add install script 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie bab92f0292 feat: add hyprland environment templates 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie 54d8729e63 feat: implement hyprland role and package configuration 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie e6f3506ef1 feat: add system-upgrade role for kernel/nvidia migration 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie 724ccebdb0 docs: add ADR 0002 for kernel and nvidia strategy 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie 45ad579120 feat: configure systemd power management and fix kitty TERM 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-05-20 10:49:07 +02:00
jaandJunie 6ff790fd4b fix(ansible): optimize root trim policy 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-04-02 16:15:32 +02:00
ja bbdcd43e01 docs(tech): add post-firmware benchmark and complete GXA7801Q update docs 
- Post-update fio benchmark: random read +12.4%, write +15.9% IOPS
- Latency reduced 10-14% for random workloads
- SMART health unchanged: 0 media errors, 0 error log entries
- Firmware research status updated to complete
- Pre-benchmark checklist marked done
 2026-04-02 15:10:54 +02:00
ja 8fec0802ad chore(eod): pre-reboot cleanup and documentation update 
- Add scripts/update-cli-suite.sh for Manjaro/Arch CLI tool maintenance
- Update .gitignore: add logs/ and docs/tech/capabilities/ exclusions
- Update CHANGELOG.md with 2026-04-02 NVMe benchmark + firmware work
- Update NEXT_STEPS.md: post-reboot verification tasks for GXA7801Q
 2026-04-02 14:34:00 +02:00
ja 5d770d2def docs(tech): correct firmware target GXA7801Q (non-SED) and update status 
- Key discovery: GXA7802Q is SED-only (00B07), our drive needs GXA7801Q (00B00)
- Updated all references from GXA7802Q to GXA7801Q
- Added firmware naming convention table (1Q=non-SED, 2Q=SED)
- Updated procedure with correct GitHub source and slot-based update
- Marked firmware update as applied (reboot pending)
- Added SHA256 checksum for GXA7801Q.bin
 2026-04-02 10:57:12 +02:00
ja 1a57375fff docs(tech): pre-firmware benchmark + GXA7801Q update applied 
- Comprehensive NVMe benchmark before firmware update (GXA7401Q)
- SMART health: 19% used, 0 media errors, 100% spare
- Sequential read: 1,554 MiB/s, write: 1,305 MiB/s
- Random read: 361k IOPS, write: 291k IOPS
- Key discovery: GXA7802Q is SED-only, GXA7801Q is non-SED (our drive)
- Firmware update applied: fw-download + fw-commit + fw-activate (slot 2)
- Reboot required to activate GXA7801Q firmware
 2026-04-02 10:53:54 +02:00
ja 66408ff68f docs(tech): add pre-firmware-update NVMe benchmark (GXA7401Q) 
Comprehensive benchmark of Samsung PM9A1 NVMe SSD before firmware
update from GXA7401Q to GXA7802Q. Includes SMART health, hdparm,
and fio results (seq/rand read/write, 4K blocks, iodepth=32).
 2026-04-02 10:40:10 +02:00
ja 7a672833aa docs(tech): add PM9A1 firmware changelog GXA7401Q to GXA7802Q 
- Document full firmware progression: GXA7401Q → GXA7602Q → GXA7702Q → GXA7802Q
- GXA7802Q fixes unmap/TRIM handling regressions from GXA7702Q
- Add sources: Samsung PDF, Win-Raid, GitHub samsung-nvme-firmware
 2026-04-02 10:15:50 +02:00
ja b80dad6a75 feat(tech): add fwupd setup and firmware update research 
- Install fwupd 2.1.1, refresh LVFS metadata
- Detect 7 devices: NVMe, SATA SSD, CPU, AMD TPM 2.0, 3 displays
- LVFS: no updates published for Samsung SSDs
- New discovery: AMD fTPM 2.0 (v3.8.0.3) not in original inventory
- NVMe firmware GXA7802Q available via nvme-cli (not LVFS)
- Action plan: 1 medium-risk update (NVMe), rest up-to-date or EOL
 2026-04-02 10:02:15 +02:00
ja 9494d1693b docs(tech): add firmware/BIOS update research for all workstation components 
- Researched 7 component categories for available firmware updates
- NVMe SSD (PM9A1): update available GXA7401Q -> GXA7802Q
- Motherboard BIOS F53 is current (no update needed)
- SATA SSD 840 EVO, GPU GTX 1050 Ti: EOL, no updates
- NIC/CPU microcode: managed via kernel/firmware packages
- USB peripherals: no LVFS/fwupd support
- Recommend installing fwupd for future firmware management
 2026-04-02 09:49:00 +02:00
ja 5a1ae7b0e2 docs(tech): add hardware inventory and document LLM model migration 
- Created docs/tech/hardware-inventory.md with full system specs
- Documented LLM model move to /home/mw/models in manual-overrides.md
 2026-04-02 09:38:02 +02:00
ja 6980d7369a docs(tech): add hardware inventory, fix DDR5->DDR4 error in health doc 
- New docs/tech/hardware-inventory.md with full hardware specs:
  CPU (Ryzen 7 2700X), RAM (64GiB DDR4-2666, 4x16GiB), storage
  (512G NVMe PM9A1 + 500G SATA 840 EVO), GPU (GTX 1050 Ti),
  networking (Realtek 1Gbps + Tailscale), USB peripherals, chipset
- Fix workstation-health.md: DDR5-3200 was incorrect, actual DDR4-2666
- Note: primary disk at 93% usage (34G free)
 2026-04-02 09:18:06 +02:00
ja 1ae898a9af feat(dev-tools): expand Ansible role with complete CLI tool inventory 
Add all tools from infra.standards.md §4 and global Skills requirements:
- CLI utilities: zoxide, fzf, gum, dust, bottom, scrot, shellcheck, shfmt
- Git CLIs: github-cli, tea, glab
- Python: ruff, uv
- DevOps: terraform, docker suite, podman, cmake
- Security: cosign, syft, trivy, certbot, dive
- Docs: typst, pandoc, wp-cli
- CalDAV: khal, vdirsyncer
- 3D/CAD: openscad, freecad, f3d
- Node.js global: @marp-team/marp-cli
- Python pipx: semgrep, huggingface_hub[cli]
 2026-03-31 13:00:47 +02:00
jaandJunie ccdaf95f15 docs(security): add AppArmor, systemd sandboxing, Falco, YARA, cosign, OIDC, Ansible integration 
Complete hardening workflow now covers all key technical concepts:
- AppArmor/SELinux status, systemd sandboxing audit
- Semgrep SAST, YARA malware patterns, Nuclei network scan
- Cosign artifact verification, SHA256 package verification
- Falco/eBPF runtime monitoring, Volatility 3 memory forensics
- OIDC/GAT token best practices
- Ansible integration per .clinerules/workstation.md

Co-authored-by: Junie <junie@jetbrains.com>
 2026-03-24 04:35:50 +01:00
jaandJunie e0c2997ee4 docs(security): add workstation hardening workflow for Arch Linux 
Daily/weekly/monthly security checks covering systemd health,
network C2 detection, package audit, SBOM scanning, Unicode IOC
sweep, kernel hardening, and firewall status. References
supply-chain-security-2026-03.md for detailed threat context.

Co-authored-by: Junie <junie@jetbrains.com>
 2026-03-24 04:34:31 +01:00
jaandJunie 8670ecd787 docs(security): expand supply chain defense guide with deep research findings 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-03-23 23:16:34 +01:00
ja 519142f0d7 docs: update workstation health with crashlog analysis 2026-03-17 23:27:53 +01:00
ja 9a5d81124c docs: update workstation health documentation with system check results 2026-03-17 23:25:22 +01:00
ja 54ab23dce9 docs(system): analysis reports and EOD workflows 
- Created crash analysis for 2026-03-17 OOM event.
- Documented stability test results and memory tuning effects.
- Added PARA-structured workflows for EOD protocol.
- Updated workstation health report for current 16GB swap status.
 2026-03-17 19:02:06 +01:00
ja 40d073f0dc feat(scripts): implement eod argument in daily-routine.sh 
- Integrated maintenance.sh into the end-of-day protocol.
- Added hygiene and documentation checklists to EOD workflow.
- Updated daily-routine.sh with morning and evening phases.
 2026-03-17 19:02:03 +01:00
ja 72274e0d39 feat(ansible): increase swap to 16GB and apply memory optimizations 
- Resized swap file from 4GB to 16GB.
- Configured zswap pool (30%) and THP (madvise) via GRUB.
- Tuned kernel parameters for proactive reclaim and NVMe write-back.
- Integrated systemd-oomd for user slice monitoring.
- Updated documentation and changelog.
 2026-03-17 19:02:01 +01:00
jaandJunie d2067dfb91 feat: implement 7-phase morning start protocol and enhanced health checks 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-03-17 16:50:55 +01:00
jaandJunie 4c489ded5c chore: ignore .junie memory directory 
Co-authored-by: Junie <junie@jetbrains.com>
 2026-03-17 16:46:55 +01:00
ja cd7d9a6746 fix(scripts): suppress checkupdates pipefail error in daily-routine.sh 2026-03-16 11:36:13 +01:00
ja 67d299d8ad feat(scripts): add morning health check and daily routine scripts 2026-03-16 10:54:30 +01:00
ja 69d6757d51 feat(scripts): add morning health check and daily routine scripts 2026-03-16 10:53:10 +01:00
ja 2bce647b31 docs: sync system health and cleanup deprecated software (2026-03-13) 2026-03-13 14:24:14 +01:00