From 9dacef38232d0e1e1d3b4e5635a3e12ccf049044 Mon Sep 17 00:00:00 2001
From: bastien <chanot.bastien@gmail.com>
Date: Tue, 22 Sep 2026 16:57:08 +0200
Subject: [PATCH 1/4] feat(cloudpex): track the on-demand SMB mount helper, add
 installer + README

cloudpex/cloudpex mounts //192.168.1.111/CloudPex on /mnt/cloudpex on demand
(password prompted, nothing stored, noexec/nosuid/nodev, dir_mode 0750).
cloudpex/install.sh reproduces the live deployment: /usr/local/bin/cloudpex
root:root 0755, /mnt/cloudpex, cifs-utils if mount.cifs is missing.
README (FR) explains why on-demand and not fstab (RECOVERY doc 04).
---
 cloudpex/README.md  | 63 ++++++++++++++++++++++++++++++++++++++++
 cloudpex/cloudpex   | 71 +++++++++++++++++++++++++++++++++++++++++++++
 cloudpex/install.sh | 26 +++++++++++++++++
 3 files changed, 160 insertions(+)
 create mode 100644 cloudpex/README.md
 create mode 100644 cloudpex/cloudpex
 create mode 100755 cloudpex/install.sh

diff --git a/cloudpex/README.md b/cloudpex/README.md
new file mode 100644
index 0000000..d0d9415
--- /dev/null
+++ b/cloudpex/README.md
@@ -0,0 +1,63 @@
+# cloudpex : montage à la demande du partage SMB CloudPex
+
+`cloudpex` monte et démonte le partage SMB `CloudPex` du NAS (`//192.168.1.111/CloudPex`)
+sur `/mnt/cloudpex`. Le mot de passe SMB est demandé à chaque montage. Rien n'est
+écrit sur disque, rien ne passe en argument (le mot de passe est transmis à
+`mount.cifs` par la variable d'environnement `PASSWD`, invisible dans `ps`).
+
+## Pourquoi à la demande, et pas dans fstab
+
+Sur l'ancien serveur le partage était monté en permanence, en écriture, avec
+`uid=1000` forcé. Tout processus de l'utilisateur pouvait donc tout effacer, agents
+Claude compris. C'est ce qui a rendu l'incident du 21/09 total (voir
+`RECOVERY/01-prochain-systeme/04-NAS-cloudpex-sauvegardes.md` sur le partage).
+
+Ce script applique la règle 2 de ce document :
+
+- montage à la demande, par un humain, jamais automatique au boot ;
+- aucun identifiant stocké (`/root/.smbcredentials` n'existe plus) ;
+- `noexec,nosuid,nodev` : rien ne s'exécute depuis le partage ;
+- `dir_mode=0750`, propriétaire = l'utilisateur qui a lancé `sudo` : les autres
+  comptes (dont les comptes agents) ne voient pas le contenu.
+
+Démonte quand tu as fini (`cloudpex -u`). Un partage monté reste effaçable par
+tes propres processus.
+
+## Usage
+
+```sh
+cloudpex        # monte (demande le mot de passe de bchanot_smb)
+cloudpex -s     # état
+cloudpex -u     # démonte (alias : -d, dc, disconnect, disable)
+cloudpex -h     # aide
+```
+
+Le script se relance lui-même via `sudo` : pas besoin de le préfixer.
+
+## Installation
+
+```sh
+./cloudpex/install.sh
+```
+
+Ce que ça fait, à l'identique de cette machine :
+
+| Cible | Détail |
+| --- | --- |
+| `/usr/local/bin/cloudpex` | copie du script, `root:root`, `0755` |
+| `/mnt/cloudpex` | point de montage, créé vide |
+| `cifs-utils` | installé via `apt-get` seulement si `mount.cifs` manque |
+
+Réexécutable. `../install.sh` l'appelle sur Linux, donc une installation complète
+du dépôt suffit. Rien n'est monté à l'installation.
+
+## Paramètres
+
+En tête de `cloudpex` : `SHARE`, `MNT`, `SMB_USER`, `SMB_VERS`. Pour changer de NAS
+ou de compte, édite ces valeurs puis relance `./cloudpex/install.sh`.
+
+## Dépannage
+
+- Échec du montage : `dmesg | tail` (mot de passe, réseau, ou version SMB
+  refusée par le NAS : essayer `SMB_VERS="3.1.1"`).
+- Démontage refusé (fichiers ouverts) : `lsof +D /mnt/cloudpex`, fermer, réessayer.
diff --git a/cloudpex/cloudpex b/cloudpex/cloudpex
new file mode 100644
index 0000000..7daaa0f
--- /dev/null
+++ b/cloudpex/cloudpex
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# cloudpex-mount — monte / démonte le partage SMB CloudPex du NAS
+# Usage : cloudpex-mount        -> monte (demande le mot de passe)
+#         cloudpex-mount -u     -> démonte
+#         cloudpex-mount -s     -> état
+# Aucun credential n'est écrit sur disque ni passé en argument (invisible dans ps).
+
+set -euo pipefail
+
+SHARE="//192.168.1.111/CloudPex"
+MNT="/mnt/cloudpex"
+SMB_USER="bchanot_smb"
+SMB_VERS="3.0"
+
+# Re-lance le script en root si nécessaire (avant toute saisie du mot de passe)
+if [[ $EUID -ne 0 ]]; then
+    exec sudo -- "$0" "$@"
+fi
+
+# Propriétaire des fichiers montés : l'utilisateur qui a lancé sudo, sinon 1000
+OWNER_UID="${SUDO_UID:-1000}"
+OWNER_GID="${SUDO_GID:-1000}"
+
+die() { echo "Erreur : $*" >&2; exit 1; }
+
+is_mounted() { mountpoint -q "$MNT"; }
+
+do_status() {
+    if is_mounted; then
+        echo "Monté : $SHARE -> $MNT"
+        df -h "$MNT" | tail -n 1
+    else
+        echo "Non monté."
+    fi
+}
+
+do_umount() {
+    is_mounted || { echo "Déjà démonté."; return 0; }
+    umount "$MNT" || die "démontage impossible (fichiers ouverts ? voir : lsof +D $MNT)"
+    echo "Démonté : $MNT"
+}
+
+do_mount() {
+    command -v mount.cifs >/dev/null || die "cifs-utils absent (sudo apt install cifs-utils)"
+    is_mounted && { echo "Déjà monté : $MNT"; return 0; }
+
+    mkdir -p "$MNT"
+
+    local pass
+    read -rsp "Mot de passe SMB pour ${SMB_USER}@${SHARE} : " pass
+    echo
+    [[ -n "$pass" ]] || die "mot de passe vide"
+
+    # mount.cifs lit PASSWD dans l'environnement : pas d'exposition dans ps ni sur disque
+    if PASSWD="$pass" mount -t cifs "$SHARE" "$MNT" \
+        -o "username=${SMB_USER},uid=${OWNER_UID},gid=${OWNER_GID},iocharset=utf8,vers=${SMB_VERS},file_mode=0640,dir_mode=0750,nosuid,nodev,noexec"; then
+        unset pass
+        echo "Monté : $SHARE -> $MNT"
+    else
+        unset pass
+        die "échec du montage (mot de passe, réseau ou version SMB ; voir : dmesg | tail)"
+    fi
+}
+
+case "${1:-}" in
+    "")        do_mount ;;
+    -u|-d|--umount|dc|disconnect|disable) do_umount ;;
+    -s|--status) do_status ;;
+    -h|--help) sed -n '2,6p' "$0" ;;
+    *)         die "option inconnue : $1 (voir -h)" ;;
+esac
diff --git a/cloudpex/install.sh b/cloudpex/install.sh
new file mode 100755
index 0000000..9e8f9f4
--- /dev/null
+++ b/cloudpex/install.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# cloudpex/install.sh — installe la commande `cloudpex` (montage à la demande du
+# partage SMB CloudPex du NAS, voir README.md) telle qu'elle est déployée ici :
+#   /usr/local/bin/cloudpex   root:root 0755
+#   /mnt/cloudpex             point de montage (vide tant que rien n'est monté)
+#   cifs-utils                installé si mount.cifs manque (apt-get)
+# Réexécutable : réinstalle en place. Ne monte rien, ne stocke aucun identifiant.
+# Usage : ./cloudpex/install.sh   (appelé aussi par ../install.sh sur Linux)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+TARGET=/usr/local/bin/cloudpex
+MNT=/mnt/cloudpex
+
+if ! command -v mount.cifs >/dev/null 2>&1; then
+	if command -v apt-get >/dev/null 2>&1; then
+		sudo apt-get install -y cifs-utils
+	else
+		echo "mount.cifs absent et apt-get introuvable : installe cifs-utils à la main" >&2
+		exit 1
+	fi
+fi
+
+sudo install -m 0755 -o root -g root "$SCRIPT_DIR/cloudpex" "$TARGET"
+sudo install -d -m 0755 "$MNT"
+echo "cloudpex installé : $TARGET (monter : cloudpex · état : cloudpex -s · démonter : cloudpex -u)"

From 872079bafbf1d922cc8a6f1f8ff4e4c6d1d27f89 Mon Sep 17 00:00:00 2001
From: bastien <chanot.bastien@gmail.com>
Date: Tue, 22 Sep 2026 16:57:08 +0200
Subject: [PATCH 2/4] feat(install): offer /tmp on disk + SSH memory guard,
 deploy cloudpex helper

/tmp is a RAM-backed tmpfs on Ubuntu (50% of RAM). Agent runs fill it: half
the RAM goes, then every temp-file creation fails with ENOSPC and shells
break. Swap does not lift the cap, so the fix is /tmp on disk.

End-of-install offers (Linux, [y/N], skipped without a terminal, idempotent):
- offer_tmp_on_disk: mask tmp.mount + etc/tmpfiles.d/tmp.conf (wipe at
  boot, 10-day purge, /var/tmp rule kept). Effective at next reboot.
- offer_ssh_memory_guard: the previous server's rules. ssh.service drop-in
  (OOMScoreAdjust=-1000, MemoryMin=256M) + earlyoom with --avoid sshd and
  --prefer node/java. MemoryMin covers sshd only; earlyoom is the real guard.

install_cloudpex deploys the NAS mount helper in the Linux block.
Docs: README steps 12-14 + table, CLAUDE.md layout + lint command.
---
 .claude/tasks/TODO.md                   | 16 +++++
 CLAUDE.md                               | 11 ++-
 README.md                               | 10 ++-
 etc/default/earlyoom                    |  8 +++
 etc/systemd/ssh.service.d/override.conf |  8 +++
 etc/tmpfiles.d/tmp.conf                 |  5 ++
 install.sh                              | 91 +++++++++++++++++++++++++
 7 files changed, 146 insertions(+), 3 deletions(-)
 create mode 100644 etc/default/earlyoom
 create mode 100644 etc/systemd/ssh.service.d/override.conf
 create mode 100644 etc/tmpfiles.d/tmp.conf

diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index 6eb8913..0425793 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -25,3 +25,19 @@
 - [ ] Runtime-test install.sh on a clean VM (all 4 targets) — not safe on dev machine
 - [ ] Consider an `uninstall.sh` (restore from ~/Oldconfig)
 - [x] LICENSE if repo ever goes public — done (GPL-3.0, BDR-008, 40c6524)
+
+## Feature — /tmp on disk + SSH OOM guard + cloudpex installer (2026-09-22)
+Branch: feature/tmp-disk-ssh-oom-cloudpex (off develop). Design approved in chat (bounded).
+Root cause: /tmp is tmpfs (50% RAM) → agents fill it → RAM halved + ENOSPC breaks shells. Swap rejected.
+- [x] etc/tmpfiles.d/tmp.conf (D /tmp 10d + q /var/tmp 30d — keep both upstream lines)
+- [x] etc/systemd/ssh.service.d/override.conf (MemoryMin=256M, OOMScoreAdjust=-1000 — old server)
+- [x] etc/default/earlyoom (old server args: -r 60 -m 10 -s 10 --avoid sshd… --prefer node…)
+- [x] install.sh: confirm() TTY-guarded prompt helper
+- [x] install.sh: offer_tmp_on_disk() — mask tmp.mount + tmpfiles rule, reboot notice, idempotent
+- [x] install.sh: offer_ssh_memory_guard() — drop-in + daemon-reload/restart ssh + earlyoom, idempotent
+- [x] install.sh: install_cloudpex() in Linux block; offers at end of script (Linux-gated)
+- [x] cloudpex/install.sh — /usr/local/bin/cloudpex root 0755, /mnt/cloudpex, cifs-utils if missing
+- [x] cloudpex/README.md (FR) — purpose, why on-demand not fstab, usage, install
+- [x] README.md steps 12-14 + table rows; CLAUDE.md layout
+- [x] shellcheck + bash -n (install.sh, cloudpex/install.sh); stub-sudo dry run of the offers
+- [x] commit on feature branch (no gitea-deploy/, no .githooks changes)
diff --git a/CLAUDE.md b/CLAUDE.md
index ed55dd8..2975c04 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,9 +23,16 @@ vim/colors/           molokai colorscheme (committed)
 bash/bashrc-{linux,osx}          OS-detected bashrc
 bin/{dt,dtach-router,claude-provider}   CLI scripts deployed to ~/.local/bin
 etc/profile.d/disk-usage-warning.sh     login-time low-disk warning → /etc/profile.d (Linux only)
+etc/tmpfiles.d/tmp.conf                 disk-backed /tmp cleanup rules (offer: /tmp on disk)
+etc/systemd/ssh.service.d/override.conf sshd OOM-exempt drop-in (offer: SSH memory guard)
+etc/default/earlyoom                    earlyoom args, spare sshd / kill node first (same offer)
+cloudpex/{cloudpex,install.sh,README.md} on-demand CloudPex SMB mount helper → /usr/local/bin (FR docs)
 .claude/{tasks,memory,audits}/   Claude working state
 ```
 
+`/tmp` is a RAM-backed tmpfs on Ubuntu (50% of RAM): agent runs fill it, which is why
+install.sh offers to mask `tmp.mount`. Swap is not the fix (the cap and ENOSPC stay).
+
 `pymupdf`/`markdown_py` are NOT tracked — they are pipx entry-point shims,
 recreated by `pipx install PyMuPDF Markdown` in install.sh.
 `claude-provider` reads `$OPENROUTER_API_KEY` from the env — never hardcode it (the
@@ -35,8 +42,8 @@ original had a live key; it was scrubbed — see decisions/blockers).
 
 | Task  | Command                                  |
 | ----- | ---------------------------------------- |
-| Lint  | `shellcheck *.sh bash/bashrc-*`          |
-| Syntax check | `bash -n install.sh remote-install.sh` |
+| Lint  | `shellcheck *.sh cloudpex/install.sh cloudpex/cloudpex bash/bashrc-*` |
+| Syntax check | `bash -n install.sh remote-install.sh cloudpex/install.sh` |
 | Install | `./install.sh` (OS auto-detected) |
 | Remote install | `curl -fsSL <raw>/remote-install.sh \| bash` |
 
diff --git a/README.md b/README.md
index e0a7882..08f2eee 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,11 @@ curl -fsSL https://git.bchanot.fr/bchanot/config/raw/branch/master/remote-instal
 
 | Path                 | Purpose                                                        |
 | -------------------- | -------------------------------------------------------------- |
-| `install.sh`         | Installs apt packages + Docker + code-server + RDP (gnome-remote-desktop), backs up old config, deploys vim + bashrc (OS-detected), installs CLI scripts, pipx tools, and a low-disk login warning. |
+| `install.sh`         | Installs apt packages + Docker + code-server + RDP (gnome-remote-desktop), backs up old config, deploys vim + bashrc (OS-detected), installs CLI scripts, pipx tools, a low-disk login warning and the `cloudpex` NAS mount helper; ends by offering two system changes (`/tmp` on disk, SSH memory guard). |
+| `cloudpex/`          | On-demand SMB mount of the CloudPex NAS share (`cloudpex` command + its installer). French README inside. |
+| `etc/tmpfiles.d/tmp.conf` | Cleanup rules for a disk-backed `/tmp` (wiped at boot, 10-day purge). Deployed by the `/tmp` on disk offer. |
+| `etc/systemd/ssh.service.d/override.conf` | `ssh.service` drop-in: sshd exempt from the OOM killer + memory reclaim protection. Deployed by the SSH memory guard offer. |
+| `etc/default/earlyoom` | earlyoom arguments: spare sshd/systemd, kill node/java first. Deployed by the SSH memory guard offer. |
 | `vim/vimrc`          | Vim config: pathogen, molokai, syntastic (C with `-Wall -Werror -Wextra`), NERDTree, 42-style canonical class generators (`:ClassH`, `:ClassC`). |
 | `vim/autoload/`      | `pathogen.vim` plugin loader (committed).                      |
 | `vim/colors/`        | `molokai.vim` colorscheme (committed).                         |
@@ -61,6 +65,9 @@ What it does:
 9. On Linux, installs `etc/profile.d/disk-usage-warning.sh` to `/etc/profile.d/` (needs `sudo`) so each login warns when `/` or `/home` cross 85% usage.
 10. On Linux, installs **code-server** (VS Code in the browser) via its vendor script — skipped if already present — and enables the `code-server@$USER` systemd service.
 11. On Linux, sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active.
+12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh` (nothing is mounted, no credential stored, see [`cloudpex/README.md`](cloudpex/README.md)).
+13. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
+14. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
 
 ### Packages installed (apt)
 
@@ -72,6 +79,7 @@ What it does:
 - **Docker**: `docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin` (via Docker's repo)
 - **Remote access**: `gnome-remote-desktop openssl` (apt) + `code-server` (via its vendor install script, not apt) — RDP remote login + browser VS Code
 - **pipx**: `PyMuPDF` (`pymupdf`), `Markdown` (`markdown_py`)
+- **Optional (end-of-install offer, Linux)**: `earlyoom`
 
 The script is re-runnable: each run re-backs up to `~/Oldconfig` (overwriting the previous backup), re-clones plugins, skips Docker if already installed, and re-deploys the `bin/` scripts.
 
diff --git a/etc/default/earlyoom b/etc/default/earlyoom
new file mode 100644
index 0000000..052dded
--- /dev/null
+++ b/etc/default/earlyoom
@@ -0,0 +1,8 @@
+# earlyoom settings, sourced by earlyoom.service (rules of the previous server).
+# -r 60     memory report in the journal every minute
+# -m 10     act when available RAM drops under 10% ...
+# -s 10     ... and free swap under 10% (both conditions)
+# --avoid   never kill sshd, systemd, logind, dbus, containerd
+# --prefer  kill the agent runtimes first: java, node, pnpm, esbuild
+# Quotes inside the value are honoured by systemd's $VAR word splitting.
+EARLYOOM_ARGS="-r 60 -m 10 -s 10 --avoid '^(sshd|systemd|systemd-logind|dbus-daemon|containerd)$' --prefer '^(java|node|pnpm|esbuild)$'"
diff --git a/etc/systemd/ssh.service.d/override.conf b/etc/systemd/ssh.service.d/override.conf
new file mode 100644
index 0000000..21f8c0d
--- /dev/null
+++ b/etc/systemd/ssh.service.d/override.conf
@@ -0,0 +1,8 @@
+# ssh.service drop-in: keep sshd alive when RAM runs out (rules of the previous server).
+# OOMScoreAdjust=-1000  the kernel OOM killer never selects sshd.
+# MemoryMin=256M        reclaim protection for the daemon's own cgroup. Login sessions
+#                       live in user.slice (logind), so this cannot reserve RAM for an
+#                       interactive shell — earlyoom is what frees memory in time.
+[Service]
+MemoryMin=256M
+OOMScoreAdjust=-1000
diff --git a/etc/tmpfiles.d/tmp.conf b/etc/tmpfiles.d/tmp.conf
new file mode 100644
index 0000000..59fa9f6
--- /dev/null
+++ b/etc/tmpfiles.d/tmp.conf
@@ -0,0 +1,5 @@
+# /tmp on disk (install.sh masks tmp.mount): keep the tmpfs semantics — wipe /tmp
+# at boot (D) and purge entries untouched for 10 days. Same file name as
+# /usr/lib/tmpfiles.d/tmp.conf, so this REPLACES it: the /var/tmp rule must stay.
+D /tmp 1777 root root 10d
+q /var/tmp 1777 root root 30d
diff --git a/install.sh b/install.sh
index d0ebe21..114047d 100755
--- a/install.sh
+++ b/install.sh
@@ -133,6 +133,87 @@ unwire_dtach_profile() {
 	' "$profile" > "$profile.tmp" && mv "$profile.tmp" "$profile"
 }
 
+# NAS helper: deploys the on-demand CloudPex SMB mount command to /usr/local/bin
+# (see cloudpex/README.md). Nothing is mounted and no credential is stored.
+# Linux-only (cifs-utils); the helper's own installer is idempotent.
+install_cloudpex() {
+	echo "Installing the cloudpex mount helper"
+	bash "$SCRIPT_DIR/cloudpex/install.sh"
+}
+
+# Yes/no prompt for the optional system changes offered at the end of the install.
+# Declines (returns 1) when no terminal is attached (curl | bash), so an offer is
+# skipped with a hint instead of blocking; re-run ./install.sh from a terminal to
+# get it offered again.
+confirm() {
+	local answer=""
+	if [ ! -t 0 ]; then
+		echo "Skipped (no terminal attached): $1" >&2
+		return 1
+	fi
+	read -rp "$1 [y/N] " answer || true
+	case "$answer" in
+		[yY]|[yY][eE][sS]) return 0 ;;
+		*) return 1 ;;
+	esac
+}
+
+# /tmp on disk instead of the tmpfs Ubuntu mounts by default (RAM-backed, capped at
+# 50% of RAM). Agent runs fill it: that eats half the RAM and, once the cap is hit,
+# every temp-file creation fails with ENOSPC — which is what breaks shells. Masking
+# tmp.mount leaves /tmp on the root filesystem; the tmpfiles rule keeps the tmpfs
+# semantics (wiped at boot, entries older than 10 days purged). Takes effect at the
+# next reboot: a busy /tmp is never unmounted live. Idempotent.
+offer_tmp_on_disk() {
+	if [ "$(systemctl is-enabled tmp.mount 2>/dev/null)" = "masked" ]; then
+		echo "/tmp already on disk (tmp.mount masked) — skipping"
+		return 0
+	fi
+	if [ "$(findmnt -n -o FSTYPE -T /tmp)" != "tmpfs" ]; then
+		echo "/tmp is not a tmpfs — nothing to do"
+		return 0
+	fi
+	confirm "Move /tmp from RAM (tmpfs) to disk? Agents fill it and break shells" || return 0
+	sudo systemctl mask tmp.mount
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/tmpfiles.d/tmp.conf" /etc/tmpfiles.d/tmp.conf
+	echo "/tmp moves to disk at the next reboot."
+}
+
+# Keep SSH reachable when RAM runs out — the two rules the previous server ran:
+#  - ssh.service drop-in: OOMScoreAdjust=-1000 (the kernel OOM killer never picks
+#    sshd) + MemoryMin=256M (reclaim protection for the daemon's cgroup);
+#  - earlyoom: kills the single largest process (node preferred, sshd/systemd spared)
+#    once free RAM and free swap both drop under 10%, before the box thrashes.
+# MemoryMin covers sshd only: logind puts login sessions in user.slice, so nothing can
+# reserve RAM for a future shell — earlyoom acting in time is the real protection.
+# Idempotent: each piece is skipped when already in place. Restarting ssh keeps the
+# current sessions alive (KillMode=process).
+offer_ssh_memory_guard() {
+	local dropin="/etc/systemd/system/ssh.service.d/override.conf"
+	local ssh_done=0 oom_done=0
+	cmp -s "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin" && ssh_done=1
+	if cmp -s "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom \
+		&& [ "$(systemctl is-enabled earlyoom 2>/dev/null)" = "enabled" ]; then
+		oom_done=1
+	fi
+	if [ "$ssh_done" = 1 ] && [ "$oom_done" = 1 ]; then
+		echo "SSH memory guard already in place — skipping"
+		return 0
+	fi
+	confirm "Protect SSH under memory pressure (sshd OOM-exempt + earlyoom)?" || return 0
+	if [ "$ssh_done" = 0 ]; then
+		sudo install -D -m 0644 "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin"
+		sudo systemctl daemon-reload
+		sudo systemctl restart ssh
+	fi
+	if [ "$oom_done" = 0 ]; then
+		sudo apt-get install -y earlyoom
+		sudo install -m 0644 "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom
+		sudo systemctl enable earlyoom
+		sudo systemctl restart earlyoom
+	fi
+}
+
 # System packages: Debian/Ubuntu only. Skipped where apt-get is absent (e.g. macOS).
 if command -v apt-get >/dev/null 2>&1; then
 	sudo apt-get update
@@ -161,6 +242,9 @@ if command -v apt-get >/dev/null 2>&1; then
 
 	# Low-disk login warning (system-wide profile.d snippet).
 	install_disk_warning
+
+	# On-demand NAS mount helper (cloudpex/).
+	install_cloudpex
 else
 	echo "apt-get not found — skipping system packages (install vim/git manually)."
 fi
@@ -219,6 +303,13 @@ chmod +x "$HOME"/.local/bin/dt "$HOME"/.local/bin/dtach-router "$HOME"/.local/bi
 # Remove any stale dtach wiring from ~/.profile (the menu now ships in ~/.bashrc; see above).
 unwire_dtach_profile
 
+# Optional system changes, offered last so the base install is complete even when
+# declined. Linux/systemd only. Each prompts [y/N] on a terminal, is skipped otherwise.
+if command -v apt-get >/dev/null 2>&1; then
+	offer_tmp_on_disk
+	offer_ssh_memory_guard
+fi
+
 echo "Done. Restart your shell or run: source ~/.bashrc"
 echo "If you use zsh, switch to bash to enjoy these settings =)"
 echo "Note: the deployed bashrc puts ~/.local/bin on PATH — re-login or run: source ~/.bashrc"

From 4f8bb61458793099e2909ca7671525a7ff27cc22 Mon Sep 17 00:00:00 2001
From: bastien <chanot.bastien@gmail.com>
Date: Tue, 22 Sep 2026 17:34:18 +0200
Subject: [PATCH 3/4] feat(cloudpex): site values out of the script, prompted
 at install into /etc/cloudpex.conf

cloudpex/cloudpex no longer carries the NAS host, share name, SMB user,
mount point or SMB version. It reads /etc/cloudpex.conf (root:root 0600,
KEY=value) line by line, never sources it, and dies with a hint when the
file is missing, incomplete or has a relative mount point.

cloudpex/install.sh prompts for the five values (regex-validated, re-asked
on bad input so the main installer never aborts), shows and keeps an
existing config unless answered n, and skips the config when no terminal
is attached. README (FR) + root README + CLAUDE.md updated.
---
 .claude/tasks/TODO.md |  9 +++++
 CLAUDE.md             |  3 +-
 README.md             |  4 +-
 cloudpex/README.md    | 49 +++++++++++++++++-------
 cloudpex/cloudpex     | 32 +++++++++++-----
 cloudpex/install.sh   | 86 ++++++++++++++++++++++++++++++++++++-------
 6 files changed, 144 insertions(+), 39 deletions(-)

diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index 0425793..efadf73 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -41,3 +41,12 @@ Root cause: /tmp is tmpfs (50% RAM) → agents fill it → RAM halved + ENOSPC b
 - [x] README.md steps 12-14 + table rows; CLAUDE.md layout
 - [x] shellcheck + bash -n (install.sh, cloudpex/install.sh); stub-sudo dry run of the offers
 - [x] commit on feature branch (no gitea-deploy/, no .githooks changes)
+
+## Round 2 — cloudpex config out of script, reconcile main/develop, capitalize, merge (2026-09-22)
+- [x] cloudpex/cloudpex: constants → /etc/cloudpex.conf parsed line by line (never sourced), die if missing
+- [x] cloudpex/install.sh: prompt host/share/user/mnt/vers (regex-validated), keep-existing [Y/n], no-TTY skip
+- [x] cloudpex/README.md + README.md + CLAUDE.md: no site values, describe prompts + conf file
+- [x] registries: BDR-010/011/012, LRN-009/010/011, BLK-005/006, EVAL-002, journal
+- [ ] reconcile: merge main (a210d01 dtach) into develop via lib helper
+- [ ] gitflow finish feature → develop (explicit user signal: "puis merge")
+- [ ] runbook for live apply on this machine
diff --git a/CLAUDE.md b/CLAUDE.md
index 2975c04..c2ec799 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,7 +26,8 @@ etc/profile.d/disk-usage-warning.sh     login-time low-disk warning → /etc/pro
 etc/tmpfiles.d/tmp.conf                 disk-backed /tmp cleanup rules (offer: /tmp on disk)
 etc/systemd/ssh.service.d/override.conf sshd OOM-exempt drop-in (offer: SSH memory guard)
 etc/default/earlyoom                    earlyoom args, spare sshd / kill node first (same offer)
-cloudpex/{cloudpex,install.sh,README.md} on-demand CloudPex SMB mount helper → /usr/local/bin (FR docs)
+cloudpex/{cloudpex,install.sh,README.md} on-demand SMB mount helper → /usr/local/bin; site values
+                                         prompted at install → /etc/cloudpex.conf, never in the script (FR docs)
 .claude/{tasks,memory,audits}/   Claude working state
 ```
 
diff --git a/README.md b/README.md
index 08f2eee..48ad7bf 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ curl -fsSL https://git.bchanot.fr/bchanot/config/raw/branch/master/remote-instal
 | Path                 | Purpose                                                        |
 | -------------------- | -------------------------------------------------------------- |
 | `install.sh`         | Installs apt packages + Docker + code-server + RDP (gnome-remote-desktop), backs up old config, deploys vim + bashrc (OS-detected), installs CLI scripts, pipx tools, a low-disk login warning and the `cloudpex` NAS mount helper; ends by offering two system changes (`/tmp` on disk, SSH memory guard). |
-| `cloudpex/`          | On-demand SMB mount of the CloudPex NAS share (`cloudpex` command + its installer). French README inside. |
+| `cloudpex/`          | On-demand SMB mount of a NAS share (`cloudpex` command + its installer). Site values (host, share, SMB user, mount point, SMB version) are prompted at install and stored in `/etc/cloudpex.conf`, never in the script. French README inside. |
 | `etc/tmpfiles.d/tmp.conf` | Cleanup rules for a disk-backed `/tmp` (wiped at boot, 10-day purge). Deployed by the `/tmp` on disk offer. |
 | `etc/systemd/ssh.service.d/override.conf` | `ssh.service` drop-in: sshd exempt from the OOM killer + memory reclaim protection. Deployed by the SSH memory guard offer. |
 | `etc/default/earlyoom` | earlyoom arguments: spare sshd/systemd, kill node/java first. Deployed by the SSH memory guard offer. |
@@ -65,7 +65,7 @@ What it does:
 9. On Linux, installs `etc/profile.d/disk-usage-warning.sh` to `/etc/profile.d/` (needs `sudo`) so each login warns when `/` or `/home` cross 85% usage.
 10. On Linux, installs **code-server** (VS Code in the browser) via its vendor script — skipped if already present — and enables the `code-server@$USER` systemd service.
 11. On Linux, sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active.
-12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh` (nothing is mounted, no credential stored, see [`cloudpex/README.md`](cloudpex/README.md)).
+12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh`, which prompts for the NAS host, share name, SMB user, mount point and SMB version and writes them to `/etc/cloudpex.conf` (root, `0600`; an existing config is shown and kept unless you say `n`; skipped when no terminal is attached). Nothing is mounted, no password stored, see [`cloudpex/README.md`](cloudpex/README.md).
 13. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
 14. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
 
diff --git a/cloudpex/README.md b/cloudpex/README.md
index d0d9415..de9e7fd 100644
--- a/cloudpex/README.md
+++ b/cloudpex/README.md
@@ -1,9 +1,13 @@
-# cloudpex : montage à la demande du partage SMB CloudPex
+# cloudpex : montage à la demande d'un partage SMB (NAS)
 
-`cloudpex` monte et démonte le partage SMB `CloudPex` du NAS (`//192.168.1.111/CloudPex`)
-sur `/mnt/cloudpex`. Le mot de passe SMB est demandé à chaque montage. Rien n'est
-écrit sur disque, rien ne passe en argument (le mot de passe est transmis à
-`mount.cifs` par la variable d'environnement `PASSWD`, invisible dans `ps`).
+`cloudpex` monte et démonte un partage SMB du NAS sur un point de montage local.
+Le mot de passe SMB est demandé à chaque montage. Rien n'est écrit sur disque,
+rien ne passe en argument (le mot de passe est transmis à `mount.cifs` par la
+variable d'environnement `PASSWD`, invisible dans `ps`).
+
+Les valeurs propres au site (hôte du NAS, nom du partage, utilisateur SMB, point
+de montage, version SMB) ne sont pas dans le script. Elles sont demandées à
+l'installation et écrites dans `/etc/cloudpex.conf`, lisible par root seulement.
 
 ## Pourquoi à la demande, et pas dans fstab
 
@@ -26,7 +30,7 @@ tes propres processus.
 ## Usage
 
 ```sh
-cloudpex        # monte (demande le mot de passe de bchanot_smb)
+cloudpex        # monte (demande le mot de passe SMB)
 cloudpex -s     # état
 cloudpex -u     # démonte (alias : -d, dc, disconnect, disable)
 cloudpex -h     # aide
@@ -45,19 +49,36 @@ Ce que ça fait, à l'identique de cette machine :
 | Cible | Détail |
 | --- | --- |
 | `/usr/local/bin/cloudpex` | copie du script, `root:root`, `0755` |
-| `/mnt/cloudpex` | point de montage, créé vide |
+| `/etc/cloudpex.conf` | les cinq valeurs du site, demandées au clavier, `root:root`, `0600` |
+| point de montage | créé vide (`/mnt/cloudpex` par défaut) |
 | `cifs-utils` | installé via `apt-get` seulement si `mount.cifs` manque |
 
-Réexécutable. `../install.sh` l'appelle sur Linux, donc une installation complète
-du dépôt suffit. Rien n'est monté à l'installation.
+Questions posées (défaut entre crochets) :
 
-## Paramètres
+```
+Hôte du NAS (IP ou nom) :
+Nom du partage SMB :
+Utilisateur SMB :
+Point de montage [/mnt/cloudpex] :
+Version SMB [3.0] :
+```
 
-En tête de `cloudpex` : `SHARE`, `MNT`, `SMB_USER`, `SMB_VERS`. Pour changer de NAS
-ou de compte, édite ces valeurs puis relance `./cloudpex/install.sh`.
+Réexécutable : si `/etc/cloudpex.conf` existe, il est affiché et gardé sauf
+réponse `n`. Sans terminal (`curl | bash`), le script est réinstallé mais la
+config n'est ni créée ni modifiée. `../install.sh` appelle cet installeur sur
+Linux. Rien n'est monté à l'installation.
+
+## Changer de NAS, de partage ou de compte
+
+Relance `./cloudpex/install.sh` et réponds `n` à « La garder ? », ou édite
+`/etc/cloudpex.conf` en root (format `CLÉ=valeur`, une par ligne : `HOST`,
+`SHARE`, `SMB_USER`, `MNT`, `SMB_VERS`). Le script lit ce fichier ligne à ligne,
+il ne l'exécute jamais.
 
 ## Dépannage
 
+- `config absente` : lance `./cloudpex/install.sh` depuis un terminal.
 - Échec du montage : `dmesg | tail` (mot de passe, réseau, ou version SMB
-  refusée par le NAS : essayer `SMB_VERS="3.1.1"`).
-- Démontage refusé (fichiers ouverts) : `lsof +D /mnt/cloudpex`, fermer, réessayer.
+  refusée par le NAS : essayer `SMB_VERS=3.1.1` dans la config).
+- Démontage refusé (fichiers ouverts) : `lsof +D <point de montage>`, fermer,
+  réessayer.
diff --git a/cloudpex/cloudpex b/cloudpex/cloudpex
index 7daaa0f..26ddb6f 100644
--- a/cloudpex/cloudpex
+++ b/cloudpex/cloudpex
@@ -1,18 +1,16 @@
 #!/usr/bin/env bash
-# cloudpex-mount — monte / démonte le partage SMB CloudPex du NAS
-# Usage : cloudpex-mount        -> monte (demande le mot de passe)
-#         cloudpex-mount -u     -> démonte
-#         cloudpex-mount -s     -> état
+# cloudpex — monte / démonte le partage SMB du NAS déclaré dans /etc/cloudpex.conf
+# Usage : cloudpex        -> monte (demande le mot de passe)
+#         cloudpex -u     -> démonte
+#         cloudpex -s     -> état
 # Aucun credential n'est écrit sur disque ni passé en argument (invisible dans ps).
 
 set -euo pipefail
 
-SHARE="//192.168.1.111/CloudPex"
-MNT="/mnt/cloudpex"
-SMB_USER="bchanot_smb"
-SMB_VERS="3.0"
+CONF="/etc/cloudpex.conf"
 
-# Re-lance le script en root si nécessaire (avant toute saisie du mot de passe)
+# Re-lance le script en root si nécessaire (avant toute saisie du mot de passe,
+# et avant de lire la config, lisible par root seulement)
 if [[ $EUID -ne 0 ]]; then
     exec sudo -- "$0" "$@"
 fi
@@ -23,6 +21,22 @@ OWNER_GID="${SUDO_GID:-1000}"
 
 die() { echo "Erreur : $*" >&2; exit 1; }
 
+# Valeurs propres au site (hôte, partage, utilisateur, point de montage, version),
+# écrites par cloudpex/install.sh au format CLÉ=valeur. Lues ligne à ligne,
+# jamais sourcées : le fichier de config n'exécute rien.
+conf_get() { sed -n "s/^$1=//p" "$CONF" | head -n 1; }
+
+[[ -r $CONF ]] || die "config absente : $CONF (lance cloudpex/install.sh)"
+HOST="$(conf_get HOST)"
+SHARE_NAME="$(conf_get SHARE)"
+SMB_USER="$(conf_get SMB_USER)"
+MNT="$(conf_get MNT)"
+SMB_VERS="$(conf_get SMB_VERS)"
+[[ -n $HOST && -n $SHARE_NAME && -n $SMB_USER && -n $MNT && -n $SMB_VERS ]] \
+    || die "config incomplète : $CONF (relance cloudpex/install.sh)"
+[[ $MNT == /* ]] || die "MNT doit être un chemin absolu ($CONF)"
+SHARE="//${HOST}/${SHARE_NAME}"
+
 is_mounted() { mountpoint -q "$MNT"; }
 
 do_status() {
diff --git a/cloudpex/install.sh b/cloudpex/install.sh
index 9e8f9f4..e668d27 100755
--- a/cloudpex/install.sh
+++ b/cloudpex/install.sh
@@ -1,26 +1,86 @@
 #!/usr/bin/env bash
-# cloudpex/install.sh — installe la commande `cloudpex` (montage à la demande du
-# partage SMB CloudPex du NAS, voir README.md) telle qu'elle est déployée ici :
-#   /usr/local/bin/cloudpex   root:root 0755
-#   /mnt/cloudpex             point de montage (vide tant que rien n'est monté)
+# cloudpex/install.sh — installe la commande `cloudpex` (montage à la demande d'un
+# partage SMB, voir README.md) telle qu'elle est déployée ici :
+#   /usr/local/bin/cloudpex   le script, root:root 0755
+#   /etc/cloudpex.conf        hôte, partage, utilisateur SMB, point de montage,
+#                             version SMB : demandés ici, root:root 0600
 #   cifs-utils                installé si mount.cifs manque (apt-get)
-# Réexécutable : réinstalle en place. Ne monte rien, ne stocke aucun identifiant.
+# Réexécutable : réinstalle le script en place et propose de garder la config
+# existante. Sans terminal (curl | bash), la config n'est ni créée ni modifiée.
+# Ne monte rien, ne stocke aucun mot de passe.
 # Usage : ./cloudpex/install.sh   (appelé aussi par ../install.sh sur Linux)
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 TARGET=/usr/local/bin/cloudpex
-MNT=/mnt/cloudpex
+CONF=/etc/cloudpex.conf
+
+die() { echo "Erreur : $*" >&2; exit 1; }
+
+# Saisie validée : ask VAR "libellé" "défaut" "regex autorisée". Redemande tant
+# que la valeur ne correspond pas ; la valeur vide prend le défaut.
+ask() {
+	local value
+	while :; do
+		read -rp "$2${3:+ [$3]} : " value || die "saisie interrompue"
+		value="${value:-$3}"
+		[[ $value =~ ^$4$ ]] && break
+		echo "  valeur invalide, format attendu : $4" >&2
+	done
+	printf -v "$1" '%s' "$value"
+}
+
+# Demande les cinq valeurs propres au site et les écrit dans $CONF (root, 0600).
+# Les formats refusent ce qui casserait la ligne d'options de mount.cifs
+# (virgule, espace, guillemet) ; seul le nom de partage admet des espaces.
+write_conf() {
+	local host share user mnt vers tmp
+	ask host  "Hôte du NAS (IP ou nom)" ""              '[A-Za-z0-9.-]+'
+	ask share "Nom du partage SMB"      ""              '[A-Za-z0-9._ -]+'
+	ask user  "Utilisateur SMB"         ""              '[A-Za-z0-9._-]+'
+	ask mnt   "Point de montage"        "/mnt/cloudpex" '/[A-Za-z0-9._/-]+'
+	ask vers  "Version SMB"             "3.0"           '[0-9]+(\.[0-9]+)*'
+	tmp="$(mktemp)"
+	printf 'HOST=%s\nSHARE=%s\nSMB_USER=%s\nMNT=%s\nSMB_VERS=%s\n' \
+		"$host" "$share" "$user" "$mnt" "$vers" > "$tmp"
+	sudo install -m 0600 -o root -g root "$tmp" "$CONF"
+	rm -f "$tmp"
+}
+
+# Config : créée au clavier, ou gardée si elle existe déjà (répondre n pour la
+# refaire). Sans terminal, rien n'est demandé.
+configure() {
+	local keep=""
+	if [ ! -t 0 ]; then
+		[ -f "$CONF" ] || echo "Pas de terminal : $CONF non créé, relance ./cloudpex/install.sh depuis un terminal" >&2
+		return 0
+	fi
+	if [ -f "$CONF" ]; then
+		echo "Configuration existante ($CONF) :"
+		sudo sed 's/^/  /' "$CONF"
+		read -rp "La garder ? [Y/n] " keep || true
+		case "$keep" in
+			[nN]*) write_conf ;;
+		esac
+	else
+		write_conf
+	fi
+}
+
+# Le point de montage déclaré dans la config, créé vide s'il manque.
+ensure_mountpoint() {
+	local mnt
+	[ -f "$CONF" ] || return 0
+	mnt="$(sudo sed -n 's/^MNT=//p' "$CONF" | head -n 1)"
+	[ -n "$mnt" ] && sudo install -d -m 0755 "$mnt"
+}
 
 if ! command -v mount.cifs >/dev/null 2>&1; then
-	if command -v apt-get >/dev/null 2>&1; then
-		sudo apt-get install -y cifs-utils
-	else
-		echo "mount.cifs absent et apt-get introuvable : installe cifs-utils à la main" >&2
-		exit 1
-	fi
+	command -v apt-get >/dev/null 2>&1 || die "mount.cifs absent et apt-get introuvable : installe cifs-utils à la main"
+	sudo apt-get install -y cifs-utils
 fi
 
 sudo install -m 0755 -o root -g root "$SCRIPT_DIR/cloudpex" "$TARGET"
-sudo install -d -m 0755 "$MNT"
+configure
+ensure_mountpoint
 echo "cloudpex installé : $TARGET (monter : cloudpex · état : cloudpex -s · démonter : cloudpex -u)"

From a9f7b6437f9ba93d07b44b26026d0cbeb6782bcc Mon Sep 17 00:00:00 2001
From: bastien <chanot.bastien@gmail.com>
Date: Tue, 22 Sep 2026 17:34:18 +0200
Subject: [PATCH 4/4] chore(memory): capitalize /tmp on disk, SSH guard,
 cloudpex conf (BDR-010..012, LRN-009..011, BLK-005/006, EVAL-002)

---
 .claude/memory/blockers.md  | 12 ++++++++++++
 .claude/memory/decisions.md | 25 +++++++++++++++++++++++++
 .claude/memory/evals.md     |  7 +++++++
 .claude/memory/learnings.md | 18 ++++++++++++++++++
 4 files changed, 62 insertions(+)

diff --git a/.claude/memory/blockers.md b/.claude/memory/blockers.md
index 8a83f98..66c6d8f 100644
--- a/.claude/memory/blockers.md
+++ b/.claude/memory/blockers.md
@@ -31,3 +31,15 @@ despite: daemon LISTEN *:3389, ufw inactive, TLS cert readable, service active.
 PAM login at GDM. Empty gate creds → RDP nego refused before GDM → 0x904. Fix: set-credentials,
 connect (gate creds → GDM `bchanot`). Connection CONFIRMED live. Automated in install.sh via
 ensure_rdp_credentials (prompt, TTY-guarded, idempotent). Supersedes BLK-003 (xrdp). Status: resolved.
+
+## BLK-005 — secrets still on NAS share: /mnt/cloudpex/transfert/root/ — OPEN (user action)
+2026-09-22. RECOVERY checklist 06 + doc 04: delete `CloudPex/transfert/root/` (root ssh keys, .smbcredentials,
+.acme.sh copied 21/09 01:41) then regenerate. Still present 2026-09-22. Claude never deletes on the NAS
+(destructive-tools rule). User: delete on NAS, rotate root/bchanot SSH keys, SMB password, acme account.
+
+## BLK-006 — permission layer denies read-only diagnostics (`systemctl cat/is-enabled`, `sudo -n`, /tmp globs) — OPEN
+2026-09-22. Compound Bash calls holding `systemctl cat tmp.mount`, `systemctl is-enabled`, `sudo -n du`,
+`du /tmp/*`, `find -exec` were denied ("Permission to use Bash ... denied"), even read-only. Cause not
+identified (guard-bash hook vs auto-mode classifier). Workaround: read unit files under /usr/lib/systemd +
+/etc/systemd directly, `ls`/`du` on literal paths, no `find -exec`, no `sudo`. Cost ≈ 5 retries. Candidate fix:
+allowlist `systemctl {cat,show,is-enabled,is-active,status}` wherever the denial comes from.
diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index f4fac5b..e1665c8 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -73,3 +73,28 @@ the exact noise BDR-007 avoided, now tolerated for VS Code reliability. Alts rej
 sentinel keyed to `SSH_CONNECTION`/`VSCODE_IPC_HOOK_CLI` in `$XDG_RUNTIME_DIR` — more code, user declined;
 (b) VS Code `terminal.integrated` `args:["-l"]` — not carried by dotfiles, same per-tab firing. Supersedes
 BDR-007. Status: done in repo; live needs `./install.sh` re-run.
+
+## BDR-010 — /tmp on disk (mask tmp.mount), swap rejected
+2026-09-22. Ubuntu 26.04 mounts /tmp tmpfs size=50% RAM (7.4G of 14G here). Agents fill it → RAM halved +
+ENOSPC → shells break. Chose `systemctl mask tmp.mount` + `/etc/tmpfiles.d/tmp.conf` (`D /tmp 10d`, `/var/tmp`
+line kept). Offered [y/N] end of install.sh (`offer_tmp_on_disk`), TTY-guarded, idempotent, effective next
+reboot (never umount live). Alts rejected: (a) add/grow swap — cap + ENOSPC stay, thrash instead of OOM;
+(b) bigger tmpfs `size=` — still RAM; (c) `TMPDIR=/var/tmp` in bashrc — leaky (services, IDE spawns, cron).
+Status: done in repo, live apply = user (EVAL-002).
+
+## BDR-011 — SSH memory guard = old-server rules (ssh drop-in + earlyoom), systemd-oomd untouched
+2026-09-22. Restored from NAS `RECOVERY/40-systeme/etc`: `ssh.service.d/override.conf` (MemoryMin=256M,
+OOMScoreAdjust=-1000) + earlyoom `-r 60 -m 10 -s 10 --avoid '^(sshd|systemd|systemd-logind|dbus-daemon|containerd)$'
+--prefer '^(java|node|pnpm|esbuild)$'`. MemoryMin covers sshd cgroup only (logind puts sessions in user.slice)
+→ real guard = OOMScoreAdjust + earlyoom (kills ONE largest proc, shell survives). systemd-oomd (Ubuntu default
+`ManagedOOMMemoryPressure=kill` 50% on user@.service, kills WHOLE session cgroup) left as-is: zero kills in
+journal (fresh install), unproven as shell-killer. `offer_ssh_memory_guard`, [y/N], idempotent, ssh restart keeps
+sessions (KillMode=process). Alt rejected: drop-in only — kernel/oomd may still kill whole session. Status: done
+in repo, live apply = user.
+
+## BDR-012 — cloudpex site values in /etc/cloudpex.conf, prompted by installer
+2026-09-22. User: no IP/user in script. Chose key=value `/etc/cloudpex.conf` root:root 0600 written by
+`cloudpex/install.sh` prompts (HOST, SHARE, SMB_USER, MNT, SMB_VERS; regex-validated, re-ask on bad input so
+main install.sh never aborts; keep-existing [Y/n]; skipped without TTY). Script parses lines
+(`sed -n s/^KEY=//p`), never sources → no code exec as root from config. Alt rejected: sed placeholders into
+deployed script — config + code mixed, every re-run overwrites values. Status: done in repo.
diff --git a/.claude/memory/evals.md b/.claude/memory/evals.md
index 51b12d1..67dd849 100644
--- a/.claude/memory/evals.md
+++ b/.claude/memory/evals.md
@@ -7,3 +7,10 @@ Quality check of Claude output. Caveman + English.
 Not runtime-tested (would mutate ~/.vim, ~/.bashrc on this machine). Logic traced by hand:
 SCRIPT_DIR resolution, idempotent clones, target case map all correct. Anomaly: none.
 Action: safe to commit. Full runtime test deferred to next clean VM.
+
+## EVAL-002 — install.sh offers (tmp on disk, ssh guard) — stub-verified, live pending
+2026-09-22. Method: shellcheck + bash -n CLEAN (install.sh, cloudpex/install.sh); stub harness (LRN-011) ran both
+offers through 9 scenarios, emitted sudo calls match design; `systemd-tmpfiles --dry-run` accepts tmp.conf;
+`sh -n` on earlyoom env file. NOT run live (sudo). Anomaly: none. Action: user applies runbook, then checks
+`findmnt -T /tmp` (no tmpfs), `systemctl status earlyoom`, `systemctl show ssh -p OOMScoreAdjust -p MemoryMin`,
+`cloudpex -s` → close this EVAL.
diff --git a/.claude/memory/learnings.md b/.claude/memory/learnings.md
index ad4b0a1..e7e483b 100644
--- a/.claude/memory/learnings.md
+++ b/.claude/memory/learnings.md
@@ -67,3 +67,21 @@ via `~/.profile` AND directly by non-login interactive shells), NOT `~/.profile`
 (its `~/.profile` fix is valid only for real login shells, not IDE remotes). Deductive tell that pinned it:
 wiring proven correct + target resource (session) proven present, yet menu never fires at startup → the startup
 file is not being sourced → non-login shell. See BDR-009.
+
+## LRN-009 — tmpfs /tmp + agents: two symptoms, one cause; swap is not the fix
+2026-09-22. "RAM overloaded" + "No space left on device" in shells = same root: /tmp tmpfs (RAM). Diagnose
+`findmnt -T /tmp` (FSTYPE tmpfs, SIZE=50% RAM). Swap only pages tmpfs out, cap unchanged. Fix = /tmp on disk
+(mask tmp.mount; it is wanted from `/usr/lib/systemd/system/local-fs.target.wants/`). Gotcha:
+`/etc/tmpfiles.d/X.conf` REPLACES `/usr/lib/tmpfiles.d/X.conf` wholesale → copy the other lines
+(`q /var/tmp 30d`) or they vanish. Validate: `systemd-tmpfiles --dry-run --create <file>`.
+
+## LRN-010 — systemd `$VAR` in ExecStart honours quotes inside EnvironmentFile values
+2026-09-22. `EARLYOOM_ARGS="-m 10 --avoid '^(a|b)$'"` + `ExecStart=… $EARLYOOM_ARGS`: bare `$VAR` = split on
+whitespace, quotes respected then stripped → regex arrives as ONE arg. `${VAR}` = whole value as one arg (wrong
+here). Old-server earlyoom file valid as-is. Env-file syntax check: `sh -n`.
+
+## LRN-011 — verify sudo-bound installer functions with a stub harness
+2026-09-22. Can't run sudo/systemctl here (security rule; permission layer even denied `systemctl is-enabled`).
+Extract functions (`sed -n '/^fn()/,/^}/p'`) into scratch, define `sudo(){ echo "SUDO: $*"; }` + `systemctl`
++ `findmnt` stubs, override `confirm` per scenario, `</dev/null` for no-TTY. Covers every branch, prints exact
+sudo calls, `set -e` behaviour included. Gotcha: `unset -f` on an overridden fn removes it entirely.