bchanot/config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(memory): BDR-014 apt mirror choices, LRN-013 gitleaks version probe

Browse Source
This commit is contained in:
bastien
2026-09-28 21:57:03 +02:00
parent 3c5b1ece6e
commit ba1817a4e9
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/memory/decisions.md
+8
View File
@@ -108,3 +108,11 @@ never banned); 5/10m/1h from RECOVERY doc 01. (2) `20auto-upgrades` file instead
install continues. Declined by user: auditd rules, ufw whitelist (site-specific ports, lockout risk → would be an
offer, not systematic). Not included by design: PasswordAuthentication no / AllowUsers / X11Forwarding no
(lockout or workflow risk). Status: done in repo (feature/security-baseline), live apply = user.
## BDR-014 — install.sh mirrors machine apt set: GNOME + LAMP unconditional, NVIDIA via ubuntu-drivers
2026-09-28. Source: `apt-mark showmanual` + /var/log/apt/history.log diffed vs script. Added gitleaks, web stack
(mariadb-server imagemagick php-* unversioned → follows distro PHP), ubuntu-desktop-minimal before RDP setup
(gnome-remote-desktop needs GDM, bare server had none), `install_nvidia_driver()` = `lspci -d 10de:` gate +
`ubuntu-drivers install` (distro-recommended, 595-open today). Alternatives rejected: pin nvidia-driver-595-open
(ages, hardware-bound), LAMP behind confirm() offer (user: base list), GNOME left implicit (RDP fails silently).
Status: merged to develop. Live rerun of install.sh = user.