Merge feature/apt-packages into develop

chore(memory): BDR-014 apt mirror choices, LRN-013 gitleaks version probe
chore(memory): journal — apt packages feature, gitleaks hook fix
2026-09-28 21:57:04 +02:00 · 2026-09-28 21:57:03 +02:00 · 2026-09-28 21:41:27 +02:00 · 2026-09-28 21:41:06 +02:00 · 2026-09-28 21:41:05 +02:00 · 2026-09-22 18:03:46 +02:00
26 changed files with 1659 additions and 29 deletions
@@ -21,7 +21,7 @@ resource-DB tool, no such systemd service). Returns non-zero → under `set -euo
 whole installer. Also `apt-get install xrdp` missing `-y` → hangs non-interactive run. Root cause:
 one-letter typo `xrdp`→`xrdb` + missing -y. Fix: idempotent `install_xrdp()` (apt -y, adduser xrdp
 ssl-cert, polkit .rules, conditional ufw 3389, enable+restart). shellcheck + bash -n CLEAN.
-Status: resolved in repo. Not run live / RDP connection not tested.
+Status: SUPERSEDED by BLK-004 (xrdp dropped for gnome-remote-desktop) — was resolved in repo, never run live.

 ## BLK-004 — RDP Win→Linux 0x904/0x7: empty gate creds on g-r-d --system — RESOLVED
 2026-06-23. After xrdp dropped for gnome-remote-desktop (Wayland), mstsc fails `0x904 / 0x7`
@@ -31,3 +31,15 @@ despite: daemon LISTEN *:3389, ufw inactive, TLS cert readable, service active.
 PAM login at GDM. Empty gate creds → RDP nego refused before GDM → 0x904. Fix: set-credentials,
 connect (gate creds → GDM `bchanot`). Connection CONFIRMED live. Automated in install.sh via
 ensure_rdp_credentials (prompt, TTY-guarded, idempotent). Supersedes BLK-003 (xrdp). Status: resolved.
+
+## BLK-005 — secrets still on NAS share: /mnt/cloudpex/transfert/root/ — OPEN (user action)
+2026-09-22. RECOVERY checklist 06 + doc 04: delete `CloudPex/transfert/root/` (root ssh keys, .smbcredentials,
+.acme.sh copied 21/09 01:41) then regenerate. Still present 2026-09-22. Claude never deletes on the NAS
+(destructive-tools rule). User: delete on NAS, rotate root/bchanot SSH keys, SMB password, acme account.
+
+## BLK-006 — permission layer denies read-only diagnostics (`systemctl cat/is-enabled`, `sudo -n`, /tmp globs) — OPEN
+2026-09-22. Compound Bash calls holding `systemctl cat tmp.mount`, `systemctl is-enabled`, `sudo -n du`,
+`du /tmp/*`, `find -exec` were denied ("Permission to use Bash ... denied"), even read-only. Cause not
+identified (guard-bash hook vs auto-mode classifier). Workaround: read unit files under /usr/lib/systemd +
+/etc/systemd directly, `ls`/`du` on literal paths, no `find -exec`, no `sudo`. Cost ≈ 5 retries. Candidate fix:
+allowlist `systemctl {cat,show,is-enabled,is-active,status}` wherever the denial comes from.
@@ -23,3 +23,96 @@ REPO_URL/CLONE_DIR/BRANCH), pulls if exists, ensures git first, then `bash insta
 Alt rejected: temp-dir + tarball download (no git dep) — kept git path, simpler + repo
 needs git anyway. Risk noted: curl|bash runs unreviewed remote code (archetype pain point);
 mitigated by HTTPS + pinned branch + manual fallback in README, not eliminated. Status: done.
+
+## BDR-005 — Remote desktop via gnome-remote-desktop --system, not xrdp
+2026-06-23. Target machine = Wayland-only GNOME (Shell asserts XDG_SESSION_TYPE=wayland). xrdp's
+Xorg backend can't satisfy it → session dies instantly on login. Chose gnome-remote-desktop system
+"Remote Login" (GNOME-native, Wayland, RDP 3389, TLS, fresh GDM session). Auth 2-layer: shared gate
+creds (`set-credentials`) → per-user GDM PAM; gate creds required else mstsc 0x904 (BLK-004).
+Implemented install.sh `setup_remote_desktop` + `ensure_rdp_credentials`. Connection confirmed live.
+Alts rejected: (a) force Xorg GDM + xrdp — sacrifices Wayland desktop, fragile; (b) VNC (wayvnc) —
+RDP preferred (mstsc native on Win client, TLS); (c) g-r-d user "Desktop Sharing" mode — shares
+existing local session, wanted independent headless login. See LRN-004, BLK-004. Status: done.
+
+## BDR-006 — Disk-usage login warning deployed system-wide to /etc/profile.d
+2026-06-24. New `etc/profile.d/disk-usage-warning.sh` (POSIX sh, bold-red warn when / or /home ≥85%)
+deployed via `sudo install -D -m 0644` to `/etc/profile.d/` from `install_disk_warning()`, gated in
+the apt-get Linux block (see LRN-005). Alt rejected: per-user append to `~/.bashrc` — wanted the warn
+for EVERY login account on the box, not just the installing user, so system-wide profile.d won. Known
+limit: login-shell scope only (non-login terminals miss it). Status: done.
+
+## BDR-007 — dtach resume menu wired login-scope via guarded SOURCE in ~/.profile
+2026-06-24. Wired dtach session-resume into `~/.profile` (login scope = once per SSH) as a guarded SOURCE
+`case $- in *i*) [ -x ~/.local/bin/dtach-router ] && . … ;;`, NOT `~/.bashrc` (every interactive shell →
+menu pops on each tab/subshell). Matches "à la connexion SSH" intent. install.sh `wire_dtach_profile()`
+idempotent: awk strips prior block (marker-delimited managed block `# >>> claude-dtach >>>` + legacy
+`DT=$(dt ls)…fi` execute block) then re-appends marker block. cc/d aliases live in bashrc-linux (sourced by
+.profile BEFORE the router runs → available). Alts rejected: (a) source from `.bashrc` (router's own header
+suggests it) — fires too often for login-only intent; (b) keep execute + string-parse — broke the return-based
+guard (LRN-006) + fragile parse. Supersedes the old execute+string-parse block. Status: SUPERSEDED by BDR-009 — done in repo; live
+~/.profile re-migrated this session.
+
+## BDR-008 — config repo licensed GPL-3.0-or-later (copyleft)
+2026-06-25. Added LICENSE (verbatim GPLv3 copied from `/usr/share/common-licenses/GPL-3`) + README
+`## License` (`GPL-3.0-or-later — see LICENSE`, © 2026 Bastien Chanot). User said "full opensource" → read
+as strong COPYLEFT (code + all derivatives stay open), not permissive. SPDX: GPL-3.0-or-later; "or-later"
+grant asserted in README per FSF convention, LICENSE holds plain GPLv3 text. Alts rejected: MIT / Apache-2.0
+(permissive — allow CLOSED derivatives, weaker open guarantee); Unlicense (public domain, no copyleft).
+Repo private (CLAUDE.md Public=no) so license optional, but user wanted one set. Reversible: swap LICENSE +
+README line if "full opensource" meant permissive. Status: done in repo (committed: LICENSE 40c6524, README License 00d88f7).
+
+## BDR-009 — dtach resume menu moved ~/.profile → ~/.bashrc (every interactive shell)
+2026-06-25. Reversed BDR-007. Root cause: user works in VS Code Remote-SSH; its Linux integrated terminals are
+NON-login interactive shells → read `~/.bashrc`, never `~/.profile` → login-scoped wiring (BDR-007) silently
+never fired (LRN-008). Now source dtach-router from `bashrc-linux` via `case $- in *i*) … . dtach-router`;
+fires in EVERY interactive shell (covers VS Code, plain SSH via `~/.profile`→`~/.bashrc`, tmux, new tabs).
+install.sh `wire_dtach_profile()` → `unwire_dtach_profile()`: strips any stale `~/.profile` block (marker +
+legacy) so plain SSH login (sources `~/.bashrc` via `~/.profile`) doesn't prompt twice. Trade-off ACCEPTED
+(user chose "simplest"): menu shows in each new terminal tab when sessions exist, not once-per-connection —
+the exact noise BDR-007 avoided, now tolerated for VS Code reliability. Alts rejected: (a) once-per-connection
+sentinel keyed to `SSH_CONNECTION`/`VSCODE_IPC_HOOK_CLI` in `$XDG_RUNTIME_DIR` — more code, user declined;
+(b) VS Code `terminal.integrated` `args:["-l"]` — not carried by dotfiles, same per-tab firing. Supersedes
+BDR-007. Status: done in repo; live needs `./install.sh` re-run.
+
+## BDR-010 — /tmp on disk (mask tmp.mount), swap rejected
+2026-09-22. Ubuntu 26.04 mounts /tmp tmpfs size=50% RAM (7.4G of 14G here). Agents fill it → RAM halved +
+ENOSPC → shells break. Chose `systemctl mask tmp.mount` + `/etc/tmpfiles.d/tmp.conf` (`D /tmp 10d`, `/var/tmp`
+line kept). Offered [y/N] end of install.sh (`offer_tmp_on_disk`), TTY-guarded, idempotent, effective next
+reboot (never umount live). Alts rejected: (a) add/grow swap — cap + ENOSPC stay, thrash instead of OOM;
+(b) bigger tmpfs `size=` — still RAM; (c) `TMPDIR=/var/tmp` in bashrc — leaky (services, IDE spawns, cron).
+Status: done in repo, live apply = user (EVAL-002).
+
+## BDR-011 — SSH memory guard = old-server rules (ssh drop-in + earlyoom), systemd-oomd untouched
+2026-09-22. Restored from NAS `RECOVERY/40-systeme/etc`: `ssh.service.d/override.conf` (MemoryMin=256M,
+OOMScoreAdjust=-1000) + earlyoom `-r 60 -m 10 -s 10 --avoid '^(sshd|systemd|systemd-logind|dbus-daemon|containerd)$'
+--prefer '^(java|node|pnpm|esbuild)$'`. MemoryMin covers sshd cgroup only (logind puts sessions in user.slice)
+→ real guard = OOMScoreAdjust + earlyoom (kills ONE largest proc, shell survives). systemd-oomd (Ubuntu default
+`ManagedOOMMemoryPressure=kill` 50% on user@.service, kills WHOLE session cgroup) left as-is: zero kills in
+journal (fresh install), unproven as shell-killer. `offer_ssh_memory_guard`, [y/N], idempotent, ssh restart keeps
+sessions (KillMode=process). Alt rejected: drop-in only — kernel/oomd may still kill whole session. Status: done
+in repo, live apply = user.
+
+## BDR-012 — cloudpex site values in /etc/cloudpex.conf, prompted by installer
+2026-09-22. User: no IP/user in script. Chose key=value `/etc/cloudpex.conf` root:root 0600 written by
+`cloudpex/install.sh` prompts (HOST, SHARE, SMB_USER, MNT, SMB_VERS; regex-validated, re-ask on bad input so
+main install.sh never aborts; keep-existing [Y/n]; skipped without TTY). Script parses lines
+(`sed -n s/^KEY=//p`), never sources → no code exec as root from config. Alt rejected: sed placeholders into
+deployed script — config + code mixed, every re-run overwrites values. Status: done in repo.
+
+## BDR-013 — security baseline always-on in install.sh: fail2ban (all-ports), unattended-upgrades, sshd limits
+2026-09-22. User: "fail2ban and the like, systematically". Chose no-prompt Linux-block steps: (1) fail2ban sshd
+jail `backend = systemd` + `banaction = %(banaction_allports)s` → SSH port irrelevant (old server banned 22 while
+sshd on 337, LRN-012); `ignoreip` = loopback + RFC1918 static (no LAN detection; trade-off: compromised LAN host
+never banned); 5/10m/1h from RECOVERY doc 01. (2) `20auto-upgrades` file instead of interactive dpkg-reconfigure.
+(3) sshd drop-in limited to PermitRootLogin/MaxAuthTries/LoginGraceTime, `sshd -t` gated, rejected file removed +
+install continues. Declined by user: auditd rules, ufw whitelist (site-specific ports, lockout risk → would be an
+offer, not systematic). Not included by design: PasswordAuthentication no / AllowUsers / X11Forwarding no
+(lockout or workflow risk). Status: done in repo (feature/security-baseline), live apply = user.
+
+## BDR-014 — install.sh mirrors machine apt set: GNOME + LAMP unconditional, NVIDIA via ubuntu-drivers
+2026-09-28. Source: `apt-mark showmanual` + /var/log/apt/history.log diffed vs script. Added gitleaks, web stack
+(mariadb-server imagemagick php-* unversioned → follows distro PHP), ubuntu-desktop-minimal before RDP setup
+(gnome-remote-desktop needs GDM, bare server had none), `install_nvidia_driver()` = `lspci -d 10de:` gate +
+`ubuntu-drivers install` (distro-recommended, 595-open today). Alternatives rejected: pin nvidia-driver-595-open
+(ages, hardware-bound), LAMP behind confirm() offer (user: base list), GNOME left implicit (RDP fails silently).
+Status: merged to develop. Live rerun of install.sh = user.
@@ -7,3 +7,10 @@ Quality check of Claude output. Caveman + English.
 Not runtime-tested (would mutate ~/.vim, ~/.bashrc on this machine). Logic traced by hand:
 SCRIPT_DIR resolution, idempotent clones, target case map all correct. Anomaly: none.
 Action: safe to commit. Full runtime test deferred to next clean VM.
+
+## EVAL-002 — install.sh offers (tmp on disk, ssh guard) — stub-verified, live pending
+2026-09-22. Method: shellcheck + bash -n CLEAN (install.sh, cloudpex/install.sh); stub harness (LRN-011) ran both
+offers through 9 scenarios, emitted sudo calls match design; `systemd-tmpfiles --dry-run` accepts tmp.conf;
+`sh -n` on earlyoom env file. NOT run live (sudo). Anomaly: none. Action: user applies runbook, then checks
+`findmnt -T /tmp` (no tmpfs), `systemctl status earlyoom`, `systemctl show ssh -p OOMScoreAdjust -p MemoryMin`,
+`cloudpex -s` → close this EVAL.
@@ -26,3 +26,55 @@ xrdp abandoned (Wayland-only GNOME kills Xorg session). Replaced install_xrdp
 empty (BLK-004); 2-layer auth gate→GDM PAM (LRN-004). Added ensure_rdp_credentials (prompt, TTY-guard,
 idempotent). Connection CONFIRMED live. install.sh committed 0bd936b (bash -n + shellcheck CLEAN);
 push blocked here (HTTPS remote, no creds in env) → user pushes. TPM GKeyFile-fallback warn harmless.
+
+## 2026-06-24 — disk-usage login warning
+Added etc/profile.d/disk-usage-warning.sh (POSIX sh, warns bold red when / or /home ≥85%).
+install_disk_warning() in install.sh: sudo install -D -m 0644 → /etc/profile.d, gated in apt block
+(Linux-only: df --output=pcent GNU-only + /etc/profile.d Debian convention). shellcheck + sh -n CLEAN,
+both code paths runtime-verified. README + CLAUDE.md synced. Not committed (master, user to confirm).
+
+## 2026-06-24 — dtach login wiring fix (source not execute) + cc/d aliases
+Old ~/.profile block EXECUTED dtach-router + parsed "Aucune session dtach." → broken: executing breaks
+the script's return-based interactive guard → falls through → fzf/`dt at >/dev/tty` errors `/dev/tty: No
+such device` in every non-interactive login shell (repro'd live on each Bash init). Replaced with guarded
+SOURCE `case $- in *i*) ... . dtach-router` via idempotent wire_dtach_profile() (awk strips legacy +
+marker block, re-appends marker block). Added cc (create) / d (re-summon) aliases to bashrc-linux.
+shellcheck + bash -n CLEAN; migration simulated on real .profile copy. LRN-006 + BDR-007. README synced.
+Not committed; live ~/.profile not yet re-migrated.
+
+## 2026-06-25 — dtach menu: ~/.profile → ~/.bashrc (VS Code non-login fix)
+User: dtach resume menu never fires at session start, even post-install. Root cause: user runs VS Code
+Remote-SSH → its Linux terminals are NON-login → skip ~/.profile (where BDR-007 wired it). Proven by process
+tree (VSCODE_IPC_HOOK_CLI, no sshd/login-bash) + provably-correct ~/.profile wiring + existing session yet zero
+menu. Fix: source dtach-router from bashrc-linux (every interactive shell); install.sh wire_dtach_profile() →
+unwire_dtach_profile() strips stale ~/.profile block (avoids double-prompt on plain SSH). User chose simplest
+(per-tab) over once-per-connection sentinel. shellcheck install.sh CLEAN, bash -n OK, strip proven idempotent
+on .profile copy. BDR-009 (supersedes BDR-007) + LRN-008. Live needs ./install.sh re-run.
+
+## 2026-09-22 — /tmp on disk + SSH OOM guard + cloudpex conf
+User: swap for /tmp? keep RAM for ssh, old-server rules, cloudpex README+installer. Found /tmp = tmpfs 50% RAM
+→ swap rejected, mask tmp.mount offer (BDR-010). Old rules in NAS RECOVERY/40-systeme: ssh drop-in + earlyoom →
+end-of-install offers (BDR-011). cloudpex tracked; site values → /etc/cloudpex.conf prompted by installer
+(BDR-012). shellcheck/bash -n CLEAN, stub harnesses (LRN-011; EVAL-002 open until live apply). Reconciled
+main→develop (a210d01 dtach was main-only), feature finished via lib → develop 836bb67. Not applied live.
+Flagged: secrets in NAS transfert/root (BLK-005), remote-install.sh BRANCH=master stale vs main, gitea-deploy/
+untracked, remote feature branch left on origin (lib deletes local only).
+Later same day: security baseline always-on in install.sh (fail2ban all-ports + RFC1918 ignore, unattended-
+upgrades file, sshd limits drop-in sshd -t gated) on feature/security-baseline (BDR-013, LRN-012: old jail
+banned 22 not 337). auditd + ufw declined. shellcheck/bash -n CLEAN, stub harness incl. sshd -t reject path,
+configparser + apt-config checks. Branch pushed, NOT finished (no merge signal). Live apply = user runbook.
+Update: user said merge → feature/security-baseline finished via lib, develop a6c416e pushed.
+Cleanup: user asked all-in-develop + delete branches. Hooks refresh committed (a42e8f6). All 3 remote feature
+branches verified merged; `git push --delete` DENIED by permission layer → user runs it. gitea-deploy/ (untracked
+Gitea server deploy project, 31 files, no secrets) moved to ~/Documents/gitea-deploy, own repo via gitflow init,
+pushed main+develop to git.bchanot.fr (push-to-create worked). deploy.conf gitignored.
+
+## 2026-09-28
+- feature/apt-packages (0bc9e3f, unmerged): install.sh mirrors machine apt set. Diff `apt-mark showmanual` +
+apt history vs script → added gitleaks, web stack (mariadb-server imagemagick php-* unversioned),
+ubuntu-desktop-minimal before RDP, install_nvidia_driver() (lspci 10de gate, `ubuntu-drivers install`, no pin).
+User approved 3 choices (GNOME in, ubuntu-drivers, LAMP unconditional). shellcheck + bash -n + stub run OK.
+- Blocked mid-commit: lib pre-commit ran `gitleaks git --staged`, Ubuntu apt gitleaks = 8.16 (no `git` subcmd,
+exit 1 read as leak). Fixed in claude-config bugfix/gitleaks-protect-fallback (347073a, unmerged): probe
+`gitleaks git --help`, fallback `protect --staged`; T16c symlink-farm PATH. make test 0. Hooks refreshed here (9e49b9d).
+- Note: `gh` in install.sh list but not installed on this box (script not rerun since added).
@@ -18,7 +18,7 @@ files already cover before adding external fetch.
 (else recurring "Authentication required to create a color managed device" popups). Polkit format
 version-gated: v>=0.106 → `/etc/polkit-1/rules.d/*.rules` (JS); older → `.pkla`. Verified live polkit
 127 → `.rules` only (`.pkla` backend dropped). Open RDP 3389 only if firewall active. Restart xrdp
-after group add so daemon reloads ssl-cert membership.
+after group add so daemon reloads ssl-cert membership. SUPERSEDED by LRN-004 for Wayland-only GNOME (xrdp recipe N/A there).

 ## LRN-004 — gnome-remote-desktop --system: remote desktop on Wayland-only GNOME
 2026-06-23. xrdp does NOT work on Wayland-only GNOME (Shell asserts XDG_SESSION_TYPE=wayland, Xorg
@@ -29,3 +29,75 @@ enable+start `gnome-remote-desktop.service`. Auth = 2 layers: shared gate creds
 Listening socket + TLS + enable NOT enough alone. TPM warn `Init TPM credentials failed ... using
 GKeyFile as fallback` = harmless on TPM-less host (creds → keyfile). Connect: client → ip:3389,
 accept self-signed cert, gate creds, then GDM user. Supersedes LRN-003 for Wayland GNOME.
+
+## LRN-005 — df --output=pcent is GNU-only → keep /etc/profile.d disk scripts Linux-gated
+2026-06-24. `df --output=pcent` (and `/etc/profile.d` itself) are GNU coreutils / Debian conventions,
+absent on macOS BSD df. Any install step deploying such a snippet system-wide must sit inside the
+`command -v apt-get` (Linux) block, never the OS-agnostic path. Deploy idempotently with
+`sudo install -D -m 0644 src /etc/profile.d/x.sh` (-D makes the dir, overwrite = re-runnable). Caveat:
+`/etc/profile.d/*.sh` runs for LOGIN shells only — non-login terminals need `/etc/bash.bashrc` instead.
+
+## LRN-006 — Login-resume scripts must be SOURCED, not executed
+2026-06-24. `dtach-router` (any login script that hands control back via `return` + attaches to host TTY)
+must be SOURCED, never run as a command. Executed: its guard `case $- in *i*) ;; *) return 0 2>/dev/null ;;`
+can't `return` from a non-sourced script → error swallowed by `2>/dev/null` → falls THROUGH the guard →
+runs fzf + `dt at … >/dev/tty` → `/dev/tty: No such device or address` in EVERY non-interactive login shell
+(`bash -lc`, cron, scp, tool sandbox). Repro'd live (fired on each Bash init). Fix in `~/.profile`:
+`case $- in *i*) [ -x router ] && . router ;; esac`. Also: don't re-guard by parsing decorative output
+(`[ "$(dt ls)" != "Aucune session dtach." ]`) — fragile (couples to exact string) AND redundant
+(`dtach-router` already returns on empty `dt --raw`). Let the script self-guard. Bonus gotcha: `~/.profile`
+is NOT read by bash if `~/.bash_profile` or `~/.bash_login` exists.
+
+## LRN-007 — Doc-drift by file mtime misses partial doc updates
+2026-06-25. `git log -1 --format=%aI -- README.md` reports "fresh" → false negative for staleness.
+README touched in 46512ee (`docs(readme): fix wkhtmltopdf→weasyprint`, PACKAGE LIST ONLY) AFTER feature
+commit 0bd936b (`gnome-remote-desktop + code-server`), so the mtime-based "commits since doc edit" scan
+returned EMPTY while code-server + RDP stayed undocumented. A partial doc commit resets the clock and
+hides earlier feature drift. Fix: drift-detect against FEATURE commits (scan `git log` for feat/* touching
+source since the doc's last SUBSTANTIVE edit, OR cross-ref each entry-point / install-step in code vs doc
+text) — never trust doc timestamp alone. Surfaced by /doc clean this session.
+
+## LRN-008 — VS Code Remote-SSH terminals are non-login → skip ~/.profile
+2026-06-25. VS Code Remote-SSH (Linux) integrated terminals = NON-login interactive bash → source `~/.bashrc`,
+NEVER `~/.profile`. Any login-scoped startup wiring (`~/.profile`, `~/.bash_profile`) silently never runs there.
+Diagnose via process tree: `VSCODE_IPC_HOOK_CLI` env + `.vscode-server/.../remote-cli` in PATH, no `sshd` /
+no `bash -l` ancestry (the launching shell reparents to systemd); confirm with `shopt -q login_shell`. For
+"run once at session start" that must work under VS Code, hook `~/.bashrc` (universal: sourced by login shells
+via `~/.profile` AND directly by non-login interactive shells), NOT `~/.profile`. Extends/corrects LRN-006
+(its `~/.profile` fix is valid only for real login shells, not IDE remotes). Deductive tell that pinned it:
+wiring proven correct + target resource (session) proven present, yet menu never fires at startup → the startup
+file is not being sourced → non-login shell. See BDR-009.
+
+## LRN-009 — tmpfs /tmp + agents: two symptoms, one cause; swap is not the fix
+2026-09-22. "RAM overloaded" + "No space left on device" in shells = same root: /tmp tmpfs (RAM). Diagnose
+`findmnt -T /tmp` (FSTYPE tmpfs, SIZE=50% RAM). Swap only pages tmpfs out, cap unchanged. Fix = /tmp on disk
+(mask tmp.mount; it is wanted from `/usr/lib/systemd/system/local-fs.target.wants/`). Gotcha:
+`/etc/tmpfiles.d/X.conf` REPLACES `/usr/lib/tmpfiles.d/X.conf` wholesale → copy the other lines
+(`q /var/tmp 30d`) or they vanish. Validate: `systemd-tmpfiles --dry-run --create <file>`.
+
+## LRN-010 — systemd `$VAR` in ExecStart honours quotes inside EnvironmentFile values
+2026-09-22. `EARLYOOM_ARGS="-m 10 --avoid '^(a|b)$'"` + `ExecStart=… $EARLYOOM_ARGS`: bare `$VAR` = split on
+whitespace, quotes respected then stripped → regex arrives as ONE arg. `${VAR}` = whole value as one arg (wrong
+here). Old-server earlyoom file valid as-is. Env-file syntax check: `sh -n`.
+
+## LRN-011 — verify sudo-bound installer functions with a stub harness
+2026-09-22. Can't run sudo/systemctl here (security rule; permission layer even denied `systemctl is-enabled`).
+Extract functions (`sed -n '/^fn()/,/^}/p'`) into scratch, define `sudo(){ echo "SUDO: $*"; }` + `systemctl`
+ `findmnt` stubs, override `confirm` per scenario, `</dev/null` for no-TTY. Covers every branch, prints exact
+sudo calls, `set -e` behaviour included. Gotcha: `unset -f` on an overridden fn removes it entirely.
+
+## LRN-012 — fail2ban jail must match the real sshd port, or ban all ports
+2026-09-22. Old server: sshd `Port 337`, fail2ban sshd jail with default `port = ssh` (=22) → bans hit port 22
+only, SSH on 337 stayed open to the banned IP. Silent, no error. Fix options: `port = 337` (needs detection /
+templating, drifts if port changes) or `banaction = %(banaction_allports)s` (offender blocked everywhere, port
+irrelevant) — chose allports. Offline checks without fail2ban installed: python `configparser` with
+BasicInterpolation resolves `%(x)s` refs and proves the file parses; apt.conf → `apt-config
+--config-file=<f> dump APT::Periodic`. sshd drop-ins can't be `sshd -t`-tested without root (host keys).
+
+## LRN-013 — distro package lags upstream: probe subcommand before calling it
+2026-09-28. Ubuntu apt gitleaks = 8.16; lib pre-commit hook written for >= 8.19 (`gitleaks git --staged`).
+"unknown command" exit 1 read as a leak → every commit blocked, silently (stderr swallowed). Script calling a
+subcommand born in version N must probe `tool sub --help` and fall back (`protect --staged`). Test faking
+"binary absent" via shorter PATH (`/usr/bin:/bin`) breaks once the binary lives in /usr/bin: symlink farm of
+/usr/bin minus the binary instead. Apply: any tool install.sh pulls from apt while ~/.claude scripts assume
+the upstream release. Fix: claude-config bugfix/gitleaks-protect-fallback.
@@ -13,15 +13,59 @@

 ## P2 — Moyenne
 - [ ] [P2] [/hotfix] — vim/vimrc GenerateClassC: bare `name` → `a:name` (fixes :ClassC E121)
-      Files: vim/vimrc (~line 75-95)
+      Files: vim/vimrc (GenerateClassC, ~line 80-104)
      Source: .claude/memory/blockers.md BLK-001

 ## P3 — Basse
 - [ ] [P3] [/code-clean] — bashrc-* legacy backticks → $(...) (SC2006), arithmetic SC2004
-      Files: bash/bashrc-linux, bash/bashrc-server, bash/bashrc-osx
+      Files: bash/bashrc-linux, bash/bashrc-osx
      Note: cosmetic only, no behavior change

 ## Post-MVP (optional, backlog)
 - [ ] Runtime-test install.sh on a clean VM (all 4 targets) — not safe on dev machine
 - [ ] Consider an `uninstall.sh` (restore from ~/Oldconfig)
- [ ] LICENSE if repo ever goes public
+- [x] LICENSE if repo ever goes public — done (GPL-3.0, BDR-008, 40c6524)
+
+## Feature — /tmp on disk + SSH OOM guard + cloudpex installer (2026-09-22)
+Branch: feature/tmp-disk-ssh-oom-cloudpex (off develop). Design approved in chat (bounded).
+Root cause: /tmp is tmpfs (50% RAM) → agents fill it → RAM halved + ENOSPC breaks shells. Swap rejected.
+- [x] etc/tmpfiles.d/tmp.conf (D /tmp 10d + q /var/tmp 30d — keep both upstream lines)
+- [x] etc/systemd/ssh.service.d/override.conf (MemoryMin=256M, OOMScoreAdjust=-1000 — old server)
+- [x] etc/default/earlyoom (old server args: -r 60 -m 10 -s 10 --avoid sshd… --prefer node…)
+- [x] install.sh: confirm() TTY-guarded prompt helper
+- [x] install.sh: offer_tmp_on_disk() — mask tmp.mount + tmpfiles rule, reboot notice, idempotent
+- [x] install.sh: offer_ssh_memory_guard() — drop-in + daemon-reload/restart ssh + earlyoom, idempotent
+- [x] install.sh: install_cloudpex() in Linux block; offers at end of script (Linux-gated)
+- [x] cloudpex/install.sh — /usr/local/bin/cloudpex root 0755, /mnt/cloudpex, cifs-utils if missing
+- [x] cloudpex/README.md (FR) — purpose, why on-demand not fstab, usage, install
+- [x] README.md steps 12-14 + table rows; CLAUDE.md layout
+- [x] shellcheck + bash -n (install.sh, cloudpex/install.sh); stub-sudo dry run of the offers
+- [x] commit on feature branch (no gitea-deploy/, no .githooks changes)
+
+## Round 2 — cloudpex config out of script, reconcile main/develop, capitalize, merge (2026-09-22)
+- [x] cloudpex/cloudpex: constants → /etc/cloudpex.conf parsed line by line (never sourced), die if missing
+- [x] cloudpex/install.sh: prompt host/share/user/mnt/vers (regex-validated), keep-existing [Y/n], no-TTY skip
+- [x] cloudpex/README.md + README.md + CLAUDE.md: no site values, describe prompts + conf file
+- [x] registries: BDR-010/011/012, LRN-009/010/011, BLK-005/006, EVAL-002, journal
+- [x] reconcile: merge main (a210d01 dtach) into develop via lib helper
+- [x] gitflow finish feature → develop (explicit user signal: "puis merge")
+- [x] runbook for live apply on this machine
+
+## Feature — security baseline in install.sh (2026-09-22)
+Branch: feature/security-baseline (off develop). Scope approved: fail2ban, unattended-upgrades, sshd hardening. auditd + ufw declined.
+- [x] etc/fail2ban/jail.d/local.conf — sshd jail, backend systemd, allports ban, RFC1918 ignoreip
+- [x] etc/apt/apt.conf.d/20auto-upgrades — Periodic Update-Package-Lists + Unattended-Upgrade = 1
+- [x] etc/ssh/sshd_config.d/20-hardening.conf — PermitRootLogin no, MaxAuthTries 3, LoginGraceTime 20
+- [x] install.sh: install_fail2ban / install_unattended_upgrades / harden_sshd (sshd -t gated), called in Linux block
+- [x] README.md (table, step 13, packages) + CLAUDE.md layout
+- [x] shellcheck + bash -n; stub harness harden_sshd (accept / reject paths); configparser check of jail file
+- [x] commit; registries (BDR-013, LRN-012); runbook. No finish without explicit signal.
+
+## Feature — install.sh mirrors this machine's apt packages (2026-09-28)
+Branch: feature/apt-packages (off develop). Source: apt-mark showmanual + /var/log/apt/history.log diffed against install.sh.
+- [x] gitleaks in the base list (backs the pre-commit hook)
+- [x] web stack group: mariadb-server imagemagick + unversioned php-* modules (approved: base list, not an offer)
+- [x] ubuntu-desktop-minimal before setup_remote_desktop (approved)
+- [x] install_nvidia_driver(): lspci vendor 10de gate + ubuntu-drivers install (approved: no version pin)
+- [x] README steps 11 + packages; shellcheck + bash -n; stub run of the NVIDIA helper
+- [x] commit on the feature branch. No finish without explicit signal.
@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow post-commit — generated by gitflow_init. Do not hand-edit.
+# Pushes every commit as it lands (BDR-095): a remote only backs up what it
+# holds. Never fails the commit: no origin / offline / refused → warning only.
+# Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
+[ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
+# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
+[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+git remote get-url origin >/dev/null 2>&1 || exit 0
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
+if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi
+if $t git push -q -u --follow-tags origin "$br" >/dev/null 2>&1; then exit 0; fi
+echo "gitflow post-commit: push of '$br' FAILED — this commit exists only on this disk." >&2
+echo "  Push by hand: git push -u origin $br   (rejected as non-fast-forward? never force-push; ask first)" >&2
+exit 0
@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow post-merge — generated by gitflow_init. Do not hand-edit.
+# Pushes every commit as it lands (BDR-095): a remote only backs up what it
+# holds. Never fails the commit: no origin / offline / refused → warning only.
+# Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
+[ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
+# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
+[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+git remote get-url origin >/dev/null 2>&1 || exit 0
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
+if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi
+if $t git push -q -u --follow-tags origin "$br" >/dev/null 2>&1; then exit 0; fi
+echo "gitflow post-commit: push of '$br' FAILED — this commit exists only on this disk." >&2
+echo "  Push by hand: git push -u origin $br   (rejected as non-fast-forward? never force-push; ask first)" >&2
+exit 0
@@ -0,0 +1,46 @@
+#!/bin/sh
+# gitflow pre-commit — generated by gitflow_init. Do not hand-edit.
+# Mirrors gitflow_protected_base (lib/gitflow.sh). Drift caught by T10.
+gd=$(git rev-parse --git-dir)
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null)
+
+git rev-parse --verify -q HEAD >/dev/null 2>&1 || exit 0   # root commit — allow
+[ -f "$gd/MERGE_HEAD" ] && exit 0                          # merge in progress — allow
+
+# Secret backstop (job7) — any branch, not just protected ones. Non-blocking
+# if gitleaks isn't installed; auto-discovers ./.gitleaks.toml (repo root).
+# gitleaks >= 8.19 scans the index with `git --staged`; older builds (Ubuntu's
+# 8.16 package) only know `protect --staged`, and `git` exits 1 there as an
+# unknown command — which would block every commit. Probe the subcommand first.
+if command -v gitleaks >/dev/null 2>&1; then
+  gl_sub=git
+  gitleaks git --help >/dev/null 2>&1 || gl_sub=protect
+  if ! gitleaks "$gl_sub" --staged --no-banner >/dev/null 2>&1; then
+    echo "gitflow pre-commit: BLOCKED — gitleaks found a secret in staged changes." >&2
+    echo "  Details: gitleaks $gl_sub --staged --no-banner" >&2
+    echo "  Genuine false-positive? add an allowlist rule to .gitleaks.toml — never bypass with --no-verify." >&2
+    exit 1
+  fi
+else
+  echo "gitflow pre-commit: gitleaks not installed — secret scan skipped (https://github.com/gitleaks/gitleaks)." >&2
+fi
+
+# Per-repo opt-out of the branch model (a clone of a foreign project):
+#   git config gitflow.protect false
+[ "$(git config --bool --default true gitflow.protect)" = false ] && exit 0
+
+case "$br" in
+  main|develop) ;;                        # protected — keep checking
+  *) exit 0 ;;                                              # working branch — allow
+esac
+
+# whitelist: all-staged-under-.claude/ (memory/doc/deploy helpers) or
+# .githooks/ (the hooks themselves, refreshed by the lib) — allow
+if [ -z "$(git diff --cached --name-only | grep -vE '^\.(claude|githooks)/' | head -1)" ]; then
+  exit 0
+fi
+
+echo "gitflow pre-commit: BLOCKED — direct commit on '$br'." >&2
+echo "  Branch from the right base (feature/bugfix->develop, hotfix->main), or merge." >&2
+echo "  (.claude/** and .githooks/** commits are exempt; foreign clone? git config gitflow.protect false)" >&2
+exit 1
@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow reference-transaction — generated by gitflow_init. Do not hand-edit.
+# Refuses deleting (or renaming) main / develop, whatever the
+# command. Mirrors gitflow_protected_base (lib/gitflow.sh).
+[ "$1" = prepared ] || exit 0
+while read -r _old new ref; do
+  case "$ref" in refs/heads/main|refs/heads/develop) ;; *) continue ;; esac
+  case "$new" in *[!0]*) continue ;; esac     # new value not all-zeros → an update, not a deletion
+  # Per-repo opt-out (a foreign clone): git config gitflow.protect false
+  [ "$(git config --bool --default true gitflow.protect)" = false ] && exit 0
+  echo "gitflow reference-transaction: BLOCKED — deleting '$ref', a protected base." >&2
+  echo "  main and develop are never deleted or renamed. A merged working branch: gitflow.sh delete <branch>" >&2
+  exit 1
+done
+exit 0
@@ -15,3 +15,21 @@ Oldconfig/

 # Claude local settings (machine-specific)
 .claude/settings.local.json
+
+# ── gitflow standard socle (added by gitflow_init; additive, safe to edit) ──
+.env
+.env.*
+!.env.example
+.vscode/
+.idea/
+*.log
+.claude/*
+!.claude/memory/
+!.claude/tasks/
+!.claude/audits/
+!.claude/settings.json
+!.claude/deploy/
+.claude/agent-memory/
+.claude/gstack/
+.claude/deploy/PENDING.json
+.claude/deploy/NEXT.sh
@@ -10,7 +10,7 @@ Produces vim + bash configuration deployed by `install.sh`. Private/personal aud
 - Public: no
 - Database: none
 - Stack: POSIX/bash shell scripts + vimscript
- Distribution: `git clone` + `./install.sh <target>`
+- Distribution: `git clone` + `./install.sh` (OS auto-detected)

 ## Layout

@@ -22,9 +22,21 @@ vim/autoload/         pathogen loader (committed)
 vim/colors/           molokai colorscheme (committed)
 bash/bashrc-{linux,osx}          OS-detected bashrc
 bin/{dt,dtach-router,claude-provider}   CLI scripts deployed to ~/.local/bin
+etc/profile.d/disk-usage-warning.sh     login-time low-disk warning → /etc/profile.d (Linux only)
+etc/tmpfiles.d/tmp.conf                 disk-backed /tmp cleanup rules (offer: /tmp on disk)
+etc/systemd/ssh.service.d/override.conf sshd OOM-exempt drop-in (offer: SSH memory guard)
+etc/default/earlyoom                    earlyoom args, spare sshd / kill node first (same offer)
+etc/fail2ban/jail.d/local.conf          sshd jail: journal backend, all-ports ban, LAN ignored (always)
+etc/apt/apt.conf.d/20auto-upgrades      unattended security upgrades on (always)
+etc/ssh/sshd_config.d/20-hardening.conf sshd limits that cannot lock out, sshd -t gated (always)
+cloudpex/{cloudpex,install.sh,README.md} on-demand SMB mount helper → /usr/local/bin; site values
+                                         prompted at install → /etc/cloudpex.conf, never in the script (FR docs)
 .claude/{tasks,memory,audits}/   Claude working state
 ```

+`/tmp` is a RAM-backed tmpfs on Ubuntu (50% of RAM): agent runs fill it, which is why
+install.sh offers to mask `tmp.mount`. Swap is not the fix (the cap and ENOSPC stay).
+
 `pymupdf`/`markdown_py` are NOT tracked — they are pipx entry-point shims,
 recreated by `pipx install PyMuPDF Markdown` in install.sh.
 `claude-provider` reads `$OPENROUTER_API_KEY` from the env — never hardcode it (the
@@ -34,8 +46,8 @@ original had a live key; it was scrubbed — see decisions/blockers).

 | Task  | Command                                  |
 | ----- | ---------------------------------------- |
-| Lint  | `shellcheck *.sh bash/bashrc-*`          |
-| Syntax check | `bash -n install.sh remote-install.sh` |
+| Lint  | `shellcheck *.sh cloudpex/install.sh cloudpex/cloudpex bash/bashrc-*` |
+| Syntax check | `bash -n install.sh remote-install.sh cloudpex/install.sh` |
 | Install | `./install.sh` (OS auto-detected) |
 | Remote install | `curl -fsSL <raw>/remote-install.sh \| bash` |

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
@@ -16,15 +16,23 @@ curl -fsSL https://git.bchanot.fr/bchanot/config/raw/branch/master/remote-instal

 | Path                 | Purpose                                                        |
 | -------------------- | -------------------------------------------------------------- |
-| `install.sh`         | Installs apt packages + Docker, backs up old config, deploys vim + bashrc (OS-detected), installs CLI scripts. |
+| `install.sh`         | Installs apt packages + Docker + code-server + RDP (gnome-remote-desktop), backs up old config, deploys vim + bashrc (OS-detected), installs CLI scripts, pipx tools, a low-disk login warning and the `cloudpex` NAS mount helper; ends by offering two system changes (`/tmp` on disk, SSH memory guard). |
+| `cloudpex/`          | On-demand SMB mount of a NAS share (`cloudpex` command + its installer). Site values (host, share, SMB user, mount point, SMB version) are prompted at install and stored in `/etc/cloudpex.conf`, never in the script. French README inside. |
+| `etc/tmpfiles.d/tmp.conf` | Cleanup rules for a disk-backed `/tmp` (wiped at boot, 10-day purge). Deployed by the `/tmp` on disk offer. |
+| `etc/systemd/ssh.service.d/override.conf` | `ssh.service` drop-in: sshd exempt from the OOM killer + memory reclaim protection. Deployed by the SSH memory guard offer. |
+| `etc/default/earlyoom` | earlyoom arguments: spare sshd/systemd, kill node/java first. Deployed by the SSH memory guard offer. |
+| `etc/fail2ban/jail.d/local.conf` | fail2ban sshd jail: journal backend, all-ports ban, 5 tries / 10 min / 1 h, private LAN never banned. Deployed on every Linux install. |
+| `etc/apt/apt.conf.d/20auto-upgrades` | Enables unattended security upgrades (what `dpkg-reconfigure` writes). Deployed on every Linux install. |
+| `etc/ssh/sshd_config.d/20-hardening.conf` | sshd limits that cannot lock you out: `PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`. Deployed on every Linux install after `sshd -t`. |
 | `vim/vimrc`          | Vim config: pathogen, molokai, syntastic (C with `-Wall -Werror -Wextra`), NERDTree, 42-style canonical class generators (`:ClassH`, `:ClassC`). |
 | `vim/autoload/`      | `pathogen.vim` plugin loader (committed).                      |
 | `vim/colors/`        | `molokai.vim` colorscheme (committed).                         |
 | `bash/bashrc-linux`  | bashrc for desktop Linux (git-aware prompt + command timer).   |
 | `bash/bashrc-osx`    | bashrc for macOS.                                              |
 | `bin/dt`             | dtach session manager for claude-in-dtach sessions.            |
-| `bin/dtach-router`   | SSH-login dashboard to resume dtach sessions (sourced from bashrc). |
+| `bin/dtach-router`   | Dashboard to resume dtach sessions, shown at the start of every interactive shell (wired into `~/.bashrc` by the installer). |
 | `bin/claude-provider`| Switch Claude Code between Anthropic and OpenRouter.           |
+| `etc/profile.d/disk-usage-warning.sh` | Login-time warning (bold red) when `/` or `/home` cross 85% usage. Deployed to `/etc/profile.d/` on Linux. |

 ## Install

@@ -56,17 +64,29 @@ What it does:
 5. Copies the tracked vim files into `~/.vim` and symlinks `~/.vimrc`.
 6. Picks the bashrc by OS: macOS → `bashrc-osx` (falls back to `bashrc-linux` if missing), everything else → `bashrc-linux`. Copies it to `~/.bashrc`.
 7. Installs Python CLIs via `pipx` (`PyMuPDF` → `pymupdf`, `Markdown` → `markdown_py`) — skipped if `pipx` is absent.
-8. Copies the `bin/` scripts (`dt`, `dtach-router`, `claude-provider`) into `~/.local/bin`.
+8. Copies the `bin/` scripts (`dt`, `dtach-router`, `claude-provider`) into `~/.local/bin`. The dtach session-resume menu ships in the deployed `bashrc-linux`, so every interactive shell offers it — including VS Code Remote-SSH terminals, which are non-login and never read `~/.profile`. The installer also strips any older dtach block left in `~/.profile` so a plain SSH login doesn't prompt twice.
+9. On Linux, installs `etc/profile.d/disk-usage-warning.sh` to `/etc/profile.d/` (needs `sudo`) so each login warns when `/` or `/home` cross 85% usage.
+10. On Linux, installs **code-server** (VS Code in the browser) via its vendor script — skipped if already present — and enables the `code-server@$USER` systemd service.
+11. On Linux, installs **`ubuntu-desktop-minimal`** (GDM + GNOME Shell, ~1.5 GB): the RDP remote login below hands out a GNOME session, which a bare server install does not have. Then sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active. Finally, when `lspci` sees an NVIDIA GPU, runs `ubuntu-drivers install` to put on the driver the distro recommends for the card (no version pinned; loads at the next reboot). Skipped on machines without an NVIDIA GPU.
+12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh`, which prompts for the NAS host, share name, SMB user, mount point and SMB version and writes them to `/etc/cloudpex.conf` (root, `0600`; an existing config is shown and kept unless you say `n`; skipped when no terminal is attached). Nothing is mounted, no password stored, see [`cloudpex/README.md`](cloudpex/README.md).
+13. On Linux, installs the **security baseline**, always, no prompt: **fail2ban** (+ `nftables`) with `etc/fail2ban/jail.d/local.conf` (sshd jail reading the journal, bans the offending IP on every port so the SSH port does not matter, 5 failures in 10 min → 1 h ban, loopback and private LAN ranges never banned); **unattended-upgrades** enabled through `etc/apt/apt.conf.d/20auto-upgrades`; and the **sshd drop-in** `etc/ssh/sshd_config.d/20-hardening.conf` (`PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`), checked with `sshd -t` and removed again if sshd rejects it, then `reload ssh`. Authentication methods, port and user lists are left as they are.
+14. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
+15. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.

 ### Packages installed (apt)

- **Build / VCS / C dev**: `vim git git-lfs git-filter-repo gcc make pkg-config dkms valgrind shellcheck`
+- **Build / VCS / C dev**: `vim git git-lfs git-filter-repo gitleaks gcc make pkg-config dkms valgrind shellcheck gh`
 - **Net / security / transport**: `curl gnupg ca-certificates apt-transport-https net-tools openssh-server cifs-utils lftp ftp`
 - **Shell tooling**: `unzip tree tmux fzf dtach`
 - **Runtimes**: `nodejs python3-pip pipx php-cli`
- **Media / doc CLI**: `ffmpeg wkhtmltopdf poppler-utils qpdf webp libavif-bin`
+- **Web stack (local WordPress/LAMP)**: `mariadb-server imagemagick php-mysql php-gd php-imagick php-mbstring php-xml php-intl php-curl` (unversioned `php-*` metapackages, so they follow the distro's PHP)
+- **Media / doc CLI**: `ffmpeg weasyprint poppler-utils qpdf webp libavif-bin`
 - **Docker**: `docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin` (via Docker's repo)
+- **Desktop / GPU**: `ubuntu-desktop-minimal` (always, Linux) + the distro-recommended NVIDIA driver via `ubuntu-drivers install` (only when an NVIDIA GPU is detected)
+- **Remote access**: `gnome-remote-desktop openssl` (apt) + `code-server` (via its vendor install script, not apt) — RDP remote login + browser VS Code
 - **pipx**: `PyMuPDF` (`pymupdf`), `Markdown` (`markdown_py`)
+- **Security baseline (Linux, always)**: `fail2ban nftables unattended-upgrades`
+- **Optional (end-of-install offer, Linux)**: `earlyoom`

 The script is re-runnable: each run re-backs up to `~/Oldconfig` (overwriting the previous backup), re-clones plugins, skips Docker if already installed, and re-deploys the `bin/` scripts.

@@ -77,7 +97,7 @@ The script is re-runnable: each run re-backs up to `~/Oldconfig` (overwriting th
 Deployed to `~/.local/bin` (the deployed bashrc adds this dir to `PATH`):

 - **`dt`** — manage claude-in-dtach sessions (`dt ls|at|kill`). Needs `dtach` + `fzf`.
- **`dtach-router`** — source from `~/.bashrc` to get a session dashboard on SSH login. Needs `dt`, `dtach`, `fzf`.
+- **`dtach-router`** — session dashboard shown at shell startup. It ships in the deployed bashrc and is **sourced** (not executed) in every interactive shell, so it also fires in VS Code Remote-SSH terminals (non-login shells that skip `~/.profile`). Silent no-op when no session exists. Create a session with `cc [name]`, re-open the menu anytime with `d` (both aliases from the bashrc). Needs `dt`, `dtach`, `fzf`.
 - **`claude-provider`** — switch Claude Code between Anthropic and OpenRouter.
  OpenRouter mode reads the key from **`$OPENROUTER_API_KEY`** (never hardcoded). Export it from a private, untracked file, e.g. `~/.bashrc.local`:
  ```sh
@@ -90,8 +110,8 @@ Deployed to `~/.local/bin` (the deployed bashrc adds this dir to `PATH`):
 - Debian/Ubuntu `apt-get` for the package step (optional elsewhere)
 - A `bash` login shell (zsh users: switch to bash for these prompts to apply)

-## Lint
+## License

-```sh
-shellcheck install.sh bash/bashrc-*
-```
+GPL-3.0-or-later — see [LICENSE](LICENSE).
+
+Copyright (C) 2026 Bastien Chanot.
@@ -111,3 +111,22 @@ function set_prompt {
 trap 'timer_start' DEBUG
 PROMPT_COMMAND='set_prompt'
 ## Lancement des commandes au demarrages
+
+# claude-dans-dtach : creer une session (claude tournant dans dtach, detache via Ctrl-\).
+# Usage : cd ~/projets/seo && cc seo   -> session nommee "seo".
+dtach_claude() {
+  local name="${1:-claude-$(date +%H%M%S)}"
+  systemd-run --user --quiet --collect --scope --slice=dev.slice \
+    --unit="cc-${name}" \
+    dtach -c "$HOME/.dtach/${name}" -e '^\' \
+      bash -c 'set -a; [ -f "$HOME/.claude/.env" ] && . "$HOME/.claude/.env"; set +a; exec claude'
+}
+alias cc='dtach_claude'
+
+# Rappeler a la demande le menu de reprise.
+alias d='source ~/.local/bin/dtach-router'
+
+# Au demarrage d'un shell interactif, proposer de reprendre une session dtach existante
+# (silencieux si aucune). Place ici plutot que dans ~/.profile car les terminaux VS Code
+# Remote-SSH sont non-login et ne lisent pas ~/.profile ; ~/.bashrc, lui, est toujours lu.
+case $- in *i*) [ -x "$HOME/.local/bin/dtach-router" ] && . "$HOME/.local/bin/dtach-router" ;; esac
@@ -0,0 +1,84 @@
+# cloudpex : montage à la demande d'un partage SMB (NAS)
+
+`cloudpex` monte et démonte un partage SMB du NAS sur un point de montage local.
+Le mot de passe SMB est demandé à chaque montage. Rien n'est écrit sur disque,
+rien ne passe en argument (le mot de passe est transmis à `mount.cifs` par la
+variable d'environnement `PASSWD`, invisible dans `ps`).
+
+Les valeurs propres au site (hôte du NAS, nom du partage, utilisateur SMB, point
+de montage, version SMB) ne sont pas dans le script. Elles sont demandées à
+l'installation et écrites dans `/etc/cloudpex.conf`, lisible par root seulement.
+
+## Pourquoi à la demande, et pas dans fstab
+
+Sur l'ancien serveur le partage était monté en permanence, en écriture, avec
+`uid=1000` forcé. Tout processus de l'utilisateur pouvait donc tout effacer, agents
+Claude compris. C'est ce qui a rendu l'incident du 21/09 total (voir
+`RECOVERY/01-prochain-systeme/04-NAS-cloudpex-sauvegardes.md` sur le partage).
+
+Ce script applique la règle 2 de ce document :
+
+- montage à la demande, par un humain, jamais automatique au boot ;
+- aucun identifiant stocké (`/root/.smbcredentials` n'existe plus) ;
+- `noexec,nosuid,nodev` : rien ne s'exécute depuis le partage ;
+- `dir_mode=0750`, propriétaire = l'utilisateur qui a lancé `sudo` : les autres
+  comptes (dont les comptes agents) ne voient pas le contenu.
+
+Démonte quand tu as fini (`cloudpex -u`). Un partage monté reste effaçable par
+tes propres processus.
+
+## Usage
+
+```sh
+cloudpex        # monte (demande le mot de passe SMB)
+cloudpex -s     # état
+cloudpex -u     # démonte (alias : -d, dc, disconnect, disable)
+cloudpex -h     # aide
+```
+
+Le script se relance lui-même via `sudo` : pas besoin de le préfixer.
+
+## Installation
+
+```sh
+./cloudpex/install.sh
+```
+
+Ce que ça fait, à l'identique de cette machine :
+
+| Cible | Détail |
+| --- | --- |
+| `/usr/local/bin/cloudpex` | copie du script, `root:root`, `0755` |
+| `/etc/cloudpex.conf` | les cinq valeurs du site, demandées au clavier, `root:root`, `0600` |
+| point de montage | créé vide (`/mnt/cloudpex` par défaut) |
+| `cifs-utils` | installé via `apt-get` seulement si `mount.cifs` manque |
+
+Questions posées (défaut entre crochets) :
+
+```
+Hôte du NAS (IP ou nom) :
+Nom du partage SMB :
+Utilisateur SMB :
+Point de montage [/mnt/cloudpex] :
+Version SMB [3.0] :
+```
+
+Réexécutable : si `/etc/cloudpex.conf` existe, il est affiché et gardé sauf
+réponse `n`. Sans terminal (`curl | bash`), le script est réinstallé mais la
+config n'est ni créée ni modifiée. `../install.sh` appelle cet installeur sur
+Linux. Rien n'est monté à l'installation.
+
+## Changer de NAS, de partage ou de compte
+
+Relance `./cloudpex/install.sh` et réponds `n` à « La garder ? », ou édite
+`/etc/cloudpex.conf` en root (format `CLÉ=valeur`, une par ligne : `HOST`,
+`SHARE`, `SMB_USER`, `MNT`, `SMB_VERS`). Le script lit ce fichier ligne à ligne,
+il ne l'exécute jamais.
+
+## Dépannage
+
+- `config absente` : lance `./cloudpex/install.sh` depuis un terminal.
+- Échec du montage : `dmesg | tail` (mot de passe, réseau, ou version SMB
+  refusée par le NAS : essayer `SMB_VERS=3.1.1` dans la config).
+- Démontage refusé (fichiers ouverts) : `lsof +D <point de montage>`, fermer,
+  réessayer.
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# cloudpex — monte / démonte le partage SMB du NAS déclaré dans /etc/cloudpex.conf
+# Usage : cloudpex        -> monte (demande le mot de passe)
+#         cloudpex -u     -> démonte
+#         cloudpex -s     -> état
+# Aucun credential n'est écrit sur disque ni passé en argument (invisible dans ps).
+
+set -euo pipefail
+
+CONF="/etc/cloudpex.conf"
+
+# Re-lance le script en root si nécessaire (avant toute saisie du mot de passe,
+# et avant de lire la config, lisible par root seulement)
+if [[ $EUID -ne 0 ]]; then
+    exec sudo -- "$0" "$@"
+fi
+
+# Propriétaire des fichiers montés : l'utilisateur qui a lancé sudo, sinon 1000
+OWNER_UID="${SUDO_UID:-1000}"
+OWNER_GID="${SUDO_GID:-1000}"
+
+die() { echo "Erreur : $*" >&2; exit 1; }
+
+# Valeurs propres au site (hôte, partage, utilisateur, point de montage, version),
+# écrites par cloudpex/install.sh au format CLÉ=valeur. Lues ligne à ligne,
+# jamais sourcées : le fichier de config n'exécute rien.
+conf_get() { sed -n "s/^$1=//p" "$CONF" | head -n 1; }
+
+[[ -r $CONF ]] || die "config absente : $CONF (lance cloudpex/install.sh)"
+HOST="$(conf_get HOST)"
+SHARE_NAME="$(conf_get SHARE)"
+SMB_USER="$(conf_get SMB_USER)"
+MNT="$(conf_get MNT)"
+SMB_VERS="$(conf_get SMB_VERS)"
+[[ -n $HOST && -n $SHARE_NAME && -n $SMB_USER && -n $MNT && -n $SMB_VERS ]] \
+    || die "config incomplète : $CONF (relance cloudpex/install.sh)"
+[[ $MNT == /* ]] || die "MNT doit être un chemin absolu ($CONF)"
+SHARE="//${HOST}/${SHARE_NAME}"
+
+is_mounted() { mountpoint -q "$MNT"; }
+
+do_status() {
+    if is_mounted; then
+        echo "Monté : $SHARE -> $MNT"
+        df -h "$MNT" | tail -n 1
+    else
+        echo "Non monté."
+    fi
+}
+
+do_umount() {
+    is_mounted || { echo "Déjà démonté."; return 0; }
+    umount "$MNT" || die "démontage impossible (fichiers ouverts ? voir : lsof +D $MNT)"
+    echo "Démonté : $MNT"
+}
+
+do_mount() {
+    command -v mount.cifs >/dev/null || die "cifs-utils absent (sudo apt install cifs-utils)"
+    is_mounted && { echo "Déjà monté : $MNT"; return 0; }
+
+    mkdir -p "$MNT"
+
+    local pass
+    read -rsp "Mot de passe SMB pour ${SMB_USER}@${SHARE} : " pass
+    echo
+    [[ -n "$pass" ]] || die "mot de passe vide"
+
+    # mount.cifs lit PASSWD dans l'environnement : pas d'exposition dans ps ni sur disque
+    if PASSWD="$pass" mount -t cifs "$SHARE" "$MNT" \
+        -o "username=${SMB_USER},uid=${OWNER_UID},gid=${OWNER_GID},iocharset=utf8,vers=${SMB_VERS},file_mode=0640,dir_mode=0750,nosuid,nodev,noexec"; then
+        unset pass
+        echo "Monté : $SHARE -> $MNT"
+    else
+        unset pass
+        die "échec du montage (mot de passe, réseau ou version SMB ; voir : dmesg | tail)"
+    fi
+}
+
+case "${1:-}" in
+    "")        do_mount ;;
+    -u|-d|--umount|dc|disconnect|disable) do_umount ;;
+    -s|--status) do_status ;;
+    -h|--help) sed -n '2,6p' "$0" ;;
+    *)         die "option inconnue : $1 (voir -h)" ;;
+esac
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# cloudpex/install.sh — installe la commande `cloudpex` (montage à la demande d'un
+# partage SMB, voir README.md) telle qu'elle est déployée ici :
+#   /usr/local/bin/cloudpex   le script, root:root 0755
+#   /etc/cloudpex.conf        hôte, partage, utilisateur SMB, point de montage,
+#                             version SMB : demandés ici, root:root 0600
+#   cifs-utils                installé si mount.cifs manque (apt-get)
+# Réexécutable : réinstalle le script en place et propose de garder la config
+# existante. Sans terminal (curl | bash), la config n'est ni créée ni modifiée.
+# Ne monte rien, ne stocke aucun mot de passe.
+# Usage : ./cloudpex/install.sh   (appelé aussi par ../install.sh sur Linux)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+TARGET=/usr/local/bin/cloudpex
+CONF=/etc/cloudpex.conf
+
+die() { echo "Erreur : $*" >&2; exit 1; }
+
+# Saisie validée : ask VAR "libellé" "défaut" "regex autorisée". Redemande tant
+# que la valeur ne correspond pas ; la valeur vide prend le défaut.
+ask() {
+	local value
+	while :; do
+		read -rp "$2${3:+ [$3]} : " value || die "saisie interrompue"
+		value="${value:-$3}"
+		[[ $value =~ ^$4$ ]] && break
+		echo "  valeur invalide, format attendu : $4" >&2
+	done
+	printf -v "$1" '%s' "$value"
+}
+
+# Demande les cinq valeurs propres au site et les écrit dans $CONF (root, 0600).
+# Les formats refusent ce qui casserait la ligne d'options de mount.cifs
+# (virgule, espace, guillemet) ; seul le nom de partage admet des espaces.
+write_conf() {
+	local host share user mnt vers tmp
+	ask host  "Hôte du NAS (IP ou nom)" ""              '[A-Za-z0-9.-]+'
+	ask share "Nom du partage SMB"      ""              '[A-Za-z0-9._ -]+'
+	ask user  "Utilisateur SMB"         ""              '[A-Za-z0-9._-]+'
+	ask mnt   "Point de montage"        "/mnt/cloudpex" '/[A-Za-z0-9._/-]+'
+	ask vers  "Version SMB"             "3.0"           '[0-9]+(\.[0-9]+)*'
+	tmp="$(mktemp)"
+	printf 'HOST=%s\nSHARE=%s\nSMB_USER=%s\nMNT=%s\nSMB_VERS=%s\n' \
+		"$host" "$share" "$user" "$mnt" "$vers" > "$tmp"
+	sudo install -m 0600 -o root -g root "$tmp" "$CONF"
+	rm -f "$tmp"
+}
+
+# Config : créée au clavier, ou gardée si elle existe déjà (répondre n pour la
+# refaire). Sans terminal, rien n'est demandé.
+configure() {
+	local keep=""
+	if [ ! -t 0 ]; then
+		[ -f "$CONF" ] || echo "Pas de terminal : $CONF non créé, relance ./cloudpex/install.sh depuis un terminal" >&2
+		return 0
+	fi
+	if [ -f "$CONF" ]; then
+		echo "Configuration existante ($CONF) :"
+		sudo sed 's/^/  /' "$CONF"
+		read -rp "La garder ? [Y/n] " keep || true
+		case "$keep" in
+			[nN]*) write_conf ;;
+		esac
+	else
+		write_conf
+	fi
+}
+
+# Le point de montage déclaré dans la config, créé vide s'il manque.
+ensure_mountpoint() {
+	local mnt
+	[ -f "$CONF" ] || return 0
+	mnt="$(sudo sed -n 's/^MNT=//p' "$CONF" | head -n 1)"
+	[ -n "$mnt" ] && sudo install -d -m 0755 "$mnt"
+}
+
+if ! command -v mount.cifs >/dev/null 2>&1; then
+	command -v apt-get >/dev/null 2>&1 || die "mount.cifs absent et apt-get introuvable : installe cifs-utils à la main"
+	sudo apt-get install -y cifs-utils
+fi
+
+sudo install -m 0755 -o root -g root "$SCRIPT_DIR/cloudpex" "$TARGET"
+configure
+ensure_mountpoint
+echo "cloudpex installé : $TARGET (monter : cloudpex · état : cloudpex -s · démonter : cloudpex -u)"
@@ -0,0 +1,4 @@
+// Automatic security updates, deployed by install.sh. Same content as
+// `dpkg-reconfigure -plow unattended-upgrades` writes, without the prompt.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
@@ -0,0 +1,8 @@
+# earlyoom settings, sourced by earlyoom.service (rules of the previous server).
+# -r 60     memory report in the journal every minute
+# -m 10     act when available RAM drops under 10% ...
+# -s 10     ... and free swap under 10% (both conditions)
+# --avoid   never kill sshd, systemd, logind, dbus, containerd
+# --prefer  kill the agent runtimes first: java, node, pnpm, esbuild
+# Quotes inside the value are honoured by systemd's $VAR word splitting.
+EARLYOOM_ARGS="-r 60 -m 10 -s 10 --avoid '^(sshd|systemd|systemd-logind|dbus-daemon|containerd)$' --prefer '^(java|node|pnpm|esbuild)$'"
@@ -0,0 +1,20 @@
+# fail2ban local settings, deployed by install.sh. Debian's defaults-debian.conf
+# enables the sshd jail; this file decides how it bans.
+[DEFAULT]
+# Never ban loopback or the private LAN ranges: five typos from the LAN must not
+# lock the admin out for an hour. Trade-off: a compromised LAN host is never banned.
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+bantime  = 1h
+findtime = 10m
+maxretry = 5
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
+[sshd]
+enabled = true
+# Read the journal directly: works with or without /var/log/auth.log (rsyslog).
+backend = systemd
+journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
+# Ban the offender on every port, so the port sshd listens on is irrelevant. The
+# previous server's jail banned port 22 only while sshd listened on 337.
+banaction = %(banaction_allports)s
@@ -0,0 +1,19 @@
+#!/bin/sh
+# disk-usage-warning.sh — login-time low-disk warning.
+# Deployed to /etc/profile.d/ by install.sh, so every login shell sources it.
+# Warns in bold red when / or /home crosses THRESHOLD% usage.
+THRESHOLD=85
+
+check_disk() {
+    mount_point="$1"
+    usage=$(df "$mount_point" --output=pcent 2>/dev/null | tail -1 | tr -dc '0-9')
+    [ -z "$usage" ] && return
+    if [ "$usage" -ge "$THRESHOLD" ]; then
+        printf '\033[1;31m'   # rouge gras
+        printf '⚠  WARNING: %s à %s%% (seuil %s%%)\n' "$mount_point" "$usage" "$THRESHOLD"
+        printf '\033[0m'
+    fi
+}
+
+check_disk /home
+check_disk /
@@ -0,0 +1,5 @@
+# sshd hardening, deployed by install.sh. Only settings that cannot lock anyone
+# out: authentication methods, ports and user lists are left to the host.
+PermitRootLogin no
+MaxAuthTries 3
+LoginGraceTime 20
@@ -0,0 +1,8 @@
+# ssh.service drop-in: keep sshd alive when RAM runs out (rules of the previous server).
+# OOMScoreAdjust=-1000  the kernel OOM killer never selects sshd.
+# MemoryMin=256M        reclaim protection for the daemon's own cgroup. Login sessions
+#                       live in user.slice (logind), so this cannot reserve RAM for an
+#                       interactive shell — earlyoom is what frees memory in time.
+[Service]
+MemoryMin=256M
+OOMScoreAdjust=-1000
@@ -0,0 +1,5 @@
+# /tmp on disk (install.sh masks tmp.mount): keep the tmpfs semantics — wipe /tmp
+# at boot (D) and purge entries untouched for 10 days. Same file name as
+# /usr/lib/tmpfiles.d/tmp.conf, so this REPLACES it: the /var/tmp rule must stay.
+D /tmp 1777 root root 10d
+q /var/tmp 1777 root root 30d
@@ -27,6 +27,25 @@ install_docker() {
 	sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 }

+# NVIDIA driver: only when an NVIDIA GPU is on the PCI bus (vendor id 10de), so the
+# script stays hardware-agnostic elsewhere. ubuntu-drivers picks the driver the distro
+# recommends for the card (595-open on the RTX 3060 Ti this was written on) instead of
+# pinning a version that ages. Idempotent: a no-op when the recommended driver is in.
+# The driver loads at the next reboot. Ubuntu-only (ubuntu-drivers-common).
+install_nvidia_driver() {
+	if ! command -v ubuntu-drivers >/dev/null 2>&1; then
+		echo "ubuntu-drivers not found — skipping NVIDIA driver" >&2
+		return 0
+	fi
+	if [ -z "$(lspci -d 10de: 2>/dev/null)" ]; then
+		echo "No NVIDIA GPU detected — skipping NVIDIA driver"
+		return 0
+	fi
+	echo "NVIDIA GPU detected — installing the recommended driver"
+	sudo ubuntu-drivers install
+	echo "NVIDIA driver loads at the next reboot."
+}
+
 # RDP "gate" credentials: a shared username/password that unlocks the GDM
 # login screen (each user then logs into GDM with his own account). Required —
 # without it the RDP server rejects every connection (mstsc error 0x904). It is
@@ -102,19 +121,175 @@ setup_remote_desktop() {
 	sudo systemctl restart gnome-remote-desktop.service
 }

+# Disk-usage login warning: a profile.d snippet that warns (bold red) at login when
+# / or /home cross the usage threshold. Deployed system-wide so every login shell
+# sources it. /etc/profile.d is a Debian/Ubuntu convention and df --output=pcent is
+# GNU-only, so this is Linux-only (called from the apt-get block). Idempotent: install
+# overwrites in place and -D creates the dir if missing.
+install_disk_warning() {
+	echo "Installing disk-usage login warning to /etc/profile.d"
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/profile.d/disk-usage-warning.sh" \
+		/etc/profile.d/disk-usage-warning.sh
+}
+
+# The dtach session-resume menu now ships in ~/.bashrc (deployed above): every interactive
+# shell sources it, including VS Code Remote-SSH terminals, which are non-login and therefore
+# never read ~/.profile. This strips any dtach block a previous install left in ~/.profile —
+# the marker-delimited managed one AND the legacy execute-based one (DT=$(dt ls) ... fi) — so
+# the menu does not also fire from there (a plain SSH login sources ~/.bashrc via ~/.profile,
+# which would otherwise prompt twice). No-op when absent. User scope, no sudo.
+unwire_dtach_profile() {
+	local profile="$HOME/.profile"
+	[ -f "$profile" ] || return 0
+	grep -qF 'dtach-router' "$profile" || return 0
+
+	awk '
+		$0 == "# >>> claude-dtach >>>" { drop = 1; next }
+		$0 == "# <<< claude-dtach <<<" { drop = 0; next }
+		drop { next }
+		$0 == "DT=$(dt ls)", $0 == "fi" { next }
+		{ print }
+	' "$profile" > "$profile.tmp" && mv "$profile.tmp" "$profile"
+}
+
+# NAS helper: deploys the on-demand CloudPex SMB mount command to /usr/local/bin
+# (see cloudpex/README.md). Nothing is mounted and no credential is stored.
+# Linux-only (cifs-utils); the helper's own installer is idempotent.
+install_cloudpex() {
+	echo "Installing the cloudpex mount helper"
+	bash "$SCRIPT_DIR/cloudpex/install.sh"
+}
+
+# fail2ban: bans an IP on every port after repeated SSH failures. The sshd jail
+# reads the journal (works with or without /var/log/auth.log) and bans all ports,
+# so the port sshd listens on does not matter — the previous server's jail only
+# banned port 22 while sshd listened on 337. Private LAN ranges are never banned.
+# nftables is the ban backend. Idempotent: config overwritten, service restarted.
+install_fail2ban() {
+	echo "Installing fail2ban (sshd jail, all-ports ban)"
+	sudo apt-get install -y fail2ban nftables
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/fail2ban/jail.d/local.conf" \
+		/etc/fail2ban/jail.d/local.conf
+	sudo systemctl enable fail2ban
+	sudo systemctl restart fail2ban
+}
+
+# Automatic security updates: the file dpkg-reconfigure would write, deployed
+# directly so the install stays non-interactive. Idempotent.
+install_unattended_upgrades() {
+	echo "Enabling unattended security upgrades"
+	sudo apt-get install -y unattended-upgrades
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/apt/apt.conf.d/20auto-upgrades" \
+		/etc/apt/apt.conf.d/20auto-upgrades
+}
+
+# sshd hardening drop-in (PermitRootLogin, MaxAuthTries, LoginGraceTime): only
+# settings that cannot lock anyone out; authentication methods stay untouched.
+# Validated with sshd -t before the reload. A rejected file is removed rather than
+# left in place, so sshd keeps starting on the next boot; the install goes on and
+# the warning tells you.
+harden_sshd() {
+	echo "Deploying sshd hardening drop-in"
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/ssh/sshd_config.d/20-hardening.conf" \
+		/etc/ssh/sshd_config.d/20-hardening.conf
+	if ! sudo sshd -t; then
+		sudo rm -f /etc/ssh/sshd_config.d/20-hardening.conf
+		echo "sshd rejected 20-hardening.conf — removed, sshd config unchanged" >&2
+		return 0
+	fi
+	sudo systemctl reload ssh
+}
+
+# Yes/no prompt for the optional system changes offered at the end of the install.
+# Declines (returns 1) when no terminal is attached (curl | bash), so an offer is
+# skipped with a hint instead of blocking; re-run ./install.sh from a terminal to
+# get it offered again.
+confirm() {
+	local answer=""
+	if [ ! -t 0 ]; then
+		echo "Skipped (no terminal attached): $1" >&2
+		return 1
+	fi
+	read -rp "$1 [y/N] " answer || true
+	case "$answer" in
+		[yY]|[yY][eE][sS]) return 0 ;;
+		*) return 1 ;;
+	esac
+}
+
+# /tmp on disk instead of the tmpfs Ubuntu mounts by default (RAM-backed, capped at
+# 50% of RAM). Agent runs fill it: that eats half the RAM and, once the cap is hit,
+# every temp-file creation fails with ENOSPC — which is what breaks shells. Masking
+# tmp.mount leaves /tmp on the root filesystem; the tmpfiles rule keeps the tmpfs
+# semantics (wiped at boot, entries older than 10 days purged). Takes effect at the
+# next reboot: a busy /tmp is never unmounted live. Idempotent.
+offer_tmp_on_disk() {
+	if [ "$(systemctl is-enabled tmp.mount 2>/dev/null)" = "masked" ]; then
+		echo "/tmp already on disk (tmp.mount masked) — skipping"
+		return 0
+	fi
+	if [ "$(findmnt -n -o FSTYPE -T /tmp)" != "tmpfs" ]; then
+		echo "/tmp is not a tmpfs — nothing to do"
+		return 0
+	fi
+	confirm "Move /tmp from RAM (tmpfs) to disk? Agents fill it and break shells" || return 0
+	sudo systemctl mask tmp.mount
+	sudo install -D -m 0644 "$SCRIPT_DIR/etc/tmpfiles.d/tmp.conf" /etc/tmpfiles.d/tmp.conf
+	echo "/tmp moves to disk at the next reboot."
+}
+
+# Keep SSH reachable when RAM runs out — the two rules the previous server ran:
+#  - ssh.service drop-in: OOMScoreAdjust=-1000 (the kernel OOM killer never picks
+#    sshd) + MemoryMin=256M (reclaim protection for the daemon's cgroup);
+#  - earlyoom: kills the single largest process (node preferred, sshd/systemd spared)
+#    once free RAM and free swap both drop under 10%, before the box thrashes.
+# MemoryMin covers sshd only: logind puts login sessions in user.slice, so nothing can
+# reserve RAM for a future shell — earlyoom acting in time is the real protection.
+# Idempotent: each piece is skipped when already in place. Restarting ssh keeps the
+# current sessions alive (KillMode=process).
+offer_ssh_memory_guard() {
+	local dropin="/etc/systemd/system/ssh.service.d/override.conf"
+	local ssh_done=0 oom_done=0
+	cmp -s "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin" && ssh_done=1
+	if cmp -s "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom \
+		&& [ "$(systemctl is-enabled earlyoom 2>/dev/null)" = "enabled" ]; then
+		oom_done=1
+	fi
+	if [ "$ssh_done" = 1 ] && [ "$oom_done" = 1 ]; then
+		echo "SSH memory guard already in place — skipping"
+		return 0
+	fi
+	confirm "Protect SSH under memory pressure (sshd OOM-exempt + earlyoom)?" || return 0
+	if [ "$ssh_done" = 0 ]; then
+		sudo install -D -m 0644 "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin"
+		sudo systemctl daemon-reload
+		sudo systemctl restart ssh
+	fi
+	if [ "$oom_done" = 0 ]; then
+		sudo apt-get install -y earlyoom
+		sudo install -m 0644 "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom
+		sudo systemctl enable earlyoom
+		sudo systemctl restart earlyoom
+	fi
+}
+
 # System packages: Debian/Ubuntu only. Skipped where apt-get is absent (e.g. macOS).
 if command -v apt-get >/dev/null 2>&1; then
 	sudo apt-get update
 	sudo apt-get upgrade -y

-	# Build + version control + C dev tooling.
+	# Build + version control + C dev tooling (gitleaks backs the pre-commit hook).
+	# Web stack: MariaDB + PHP modules for local WordPress/LAMP work; the php-* metapackages
+	# follow the distro's PHP version instead of pinning php8.x-*.
 	sudo apt-get install -y \
-		vim git git-lfs git-filter-repo gcc make pkg-config dkms valgrind shellcheck \
+		vim git git-lfs git-filter-repo gitleaks gcc make pkg-config dkms valgrind shellcheck \
 		curl gnupg ca-certificates apt-transport-https \
 		unzip tree tmux fzf dtach net-tools \
 		openssh-server cifs-utils lftp ftp \
 		nodejs python3-pip pipx php-cli \
-		ffmpeg weasyprint poppler-utils qpdf webp libavif-bin
+		ffmpeg weasyprint poppler-utils qpdf webp libavif-bin gh \
+		mariadb-server imagemagick \
+		php-mysql php-gd php-imagick php-mbstring php-xml php-intl php-curl

 	# Docker (separate repo).
 	install_docker
@@ -125,8 +300,26 @@ if command -v apt-get >/dev/null 2>&1; then
 	fi
 	sudo systemctl enable --now "code-server@$USER"

+	# GNOME desktop (GDM + Shell): the RDP remote login below needs a GNOME session
+	# to hand out; a bare server install has none. Ubuntu-only metapackage.
+	sudo apt-get install -y ubuntu-desktop-minimal
+
 	# Remote desktop (gnome-remote-desktop — see the function header for why not xrdp).
 	setup_remote_desktop
+
+	# NVIDIA driver, only when an NVIDIA GPU is present.
+	install_nvidia_driver
+
+	# Low-disk login warning (system-wide profile.d snippet).
+	install_disk_warning
+
+	# On-demand NAS mount helper (cloudpex/).
+	install_cloudpex
+
+	# Security baseline: brute-force bans, automatic security updates, sshd limits.
+	install_fail2ban
+	install_unattended_upgrades
+	harden_sshd
 else
 	echo "apt-get not found — skipping system packages (install vim/git manually)."
 fi
@@ -182,15 +375,14 @@ cp "$SCRIPT_DIR"/bin/* "$HOME/.local/bin/"
 chmod +x "$HOME"/.local/bin/dt "$HOME"/.local/bin/dtach-router "$HOME"/.local/bin/claude-provider


-# Append the dtach auto-router to ~/.profile once, so each login resumes sessions.
-if ! grep -q "Aucune session dtach." "$HOME/.profile" 2>/dev/null; then
-	cat >> "$HOME/.profile" << 'EOF'
+# Remove any stale dtach wiring from ~/.profile (the menu now ships in ~/.bashrc; see above).
+unwire_dtach_profile

-DT=$(dt ls)
-if [ "$DT" != "Aucune session dtach." ]; then
-	dtach-router
-fi
-EOF
+# Optional system changes, offered last so the base install is complete even when
+# declined. Linux/systemd only. Each prompts [y/N] on a terminal, is skipped otherwise.
+if command -v apt-get >/dev/null 2>&1; then
+	offer_tmp_on_disk
+	offer_ssh_memory_guard
 fi

 echo "Done. Restart your shell or run: source ~/.bashrc"
Author	SHA1	Message	Date
bastien	1a4f8d4715	Merge feature/apt-packages into develop	2026-09-28 21:57:04 +02:00
bastien	ba1817a4e9	chore(memory): BDR-014 apt mirror choices, LRN-013 gitleaks version probe	2026-09-28 21:57:03 +02:00
bastien	3c5b1ece6e	chore(memory): journal — apt packages feature, gitleaks hook fix	2026-09-28 21:41:27 +02:00
bastien	9e49b9d92c	chore(githooks): refresh pre-commit (gitleaks protect fallback) + track reference-transaction	2026-09-28 21:41:06 +02:00
bastien	0bc9e3f467	feat(install): mirror this machine's apt packages gitleaks, web stack (mariadb-server, imagemagick, unversioned php-* modules), ubuntu-desktop-minimal before the RDP setup, and a lspci-gated install_nvidia_driver() that runs ubuntu-drivers install. README + TODO updated.	2026-09-28 21:41:05 +02:00
bastien	58adb28ec2	chore(memory): journal, branch cleanup + gitea-deploy split out	2026-09-22 18:03:46 +02:00
bastien	a42e8f6024	chore(githooks): refresh pre-commit/post-commit/post-merge from the lib (gitleaks backstop, autopush)	2026-09-22 17:55:41 +02:00
bastien	cfd144d158	chore(memory): journal, security baseline merged	2026-09-22 17:53:53 +02:00
bastien	a6c416e1cf	Merge feature/security-baseline into develop	2026-09-22 17:53:46 +02:00
bastien	26c8e345c5	chore(memory): BDR-013 security baseline, LRN-012 fail2ban port vs allports, journal	2026-09-22 17:47:35 +02:00
bastien	55ede6f08c	feat(install): security baseline: fail2ban, unattended-upgrades, sshd hardening Always applied in the Linux block, no prompt, idempotent: - install_fail2ban: fail2ban + nftables, etc/fail2ban/jail.d/local.conf. sshd jail reads the journal (backend systemd, works with or without auth.log) and bans the offender on every port, so the SSH port is irrelevant: the previous server's jail banned 22 while sshd listened on 337. 5 failures / 10 min / 1 h. Loopback + RFC1918 never banned. - install_unattended_upgrades: package + 20auto-upgrades (the file dpkg-reconfigure writes, without the prompt). - harden_sshd: sshd_config.d/20-hardening.conf (PermitRootLogin no, MaxAuthTries 3, LoginGraceTime 20), sshd -t gated: a rejected file is removed and the install continues with a warning. Auth methods, port and user lists untouched. Docs: README table + step 13 + packages, CLAUDE.md layout.	2026-09-22 17:47:34 +02:00
bastien	0d2e96819a	chore(memory): journal 2026-09-22, round-2 TODO closed	2026-09-22 17:35:05 +02:00
bastien	836bb675bf	Merge feature/tmp-disk-ssh-oom-cloudpex into develop	2026-09-22 17:34:31 +02:00
bastien	6e38c3b6cf	Merge main into develop	2026-09-22 17:34:30 +02:00
bastien	a9f7b6437f	chore(memory): capitalize /tmp on disk, SSH guard, cloudpex conf (BDR-010..012, LRN-009..011, BLK-005/006, EVAL-002)	2026-09-22 17:34:18 +02:00
bastien	4f8bb61458	feat(cloudpex): site values out of the script, prompted at install into /etc/cloudpex.conf cloudpex/cloudpex no longer carries the NAS host, share name, SMB user, mount point or SMB version. It reads /etc/cloudpex.conf (root:root 0600, KEY=value) line by line, never sources it, and dies with a hint when the file is missing, incomplete or has a relative mount point. cloudpex/install.sh prompts for the five values (regex-validated, re-asked on bad input so the main installer never aborts), shows and keeps an existing config unless answered n, and skips the config when no terminal is attached. README (FR) + root README + CLAUDE.md updated.	2026-09-22 17:34:18 +02:00
bastien	872079bafb	feat(install): offer /tmp on disk + SSH memory guard, deploy cloudpex helper /tmp is a RAM-backed tmpfs on Ubuntu (50% of RAM). Agent runs fill it: half the RAM goes, then every temp-file creation fails with ENOSPC and shells break. Swap does not lift the cap, so the fix is /tmp on disk. End-of-install offers (Linux, [y/N], skipped without a terminal, idempotent): - offer_tmp_on_disk: mask tmp.mount + etc/tmpfiles.d/tmp.conf (wipe at boot, 10-day purge, /var/tmp rule kept). Effective at next reboot. - offer_ssh_memory_guard: the previous server's rules. ssh.service drop-in (OOMScoreAdjust=-1000, MemoryMin=256M) + earlyoom with --avoid sshd and --prefer node/java. MemoryMin covers sshd only; earlyoom is the real guard. install_cloudpex deploys the NAS mount helper in the Linux block. Docs: README steps 12-14 + table, CLAUDE.md layout + lint command.	2026-09-22 16:57:08 +02:00
bastien	9dacef3823	feat(cloudpex): track the on-demand SMB mount helper, add installer + README cloudpex/cloudpex mounts //192.168.1.111/CloudPex on /mnt/cloudpex on demand (password prompted, nothing stored, noexec/nosuid/nodev, dir_mode 0750). cloudpex/install.sh reproduces the live deployment: /usr/local/bin/cloudpex root:root 0755, /mnt/cloudpex, cifs-utils if mount.cifs is missing. README (FR) explains why on-demand and not fstab (RECOVERY doc 04).	2026-09-22 16:57:08 +02:00
bastien	a210d0173b	added correct dtach	2026-09-22 02:07:49 +00:00
Bastien Chanot	5a8b575f1a	added the gh package instalation in install script	2026-07-01 21:25:14 +02:00
Bastien Chanot	bd593e007d	Merge feature/doc-sync into develop	2026-07-01 14:31:36 +02:00
Bastien ChanotandClaude Opus 4.8	bfd9f31ff0	docs: install.sh OS auto-detect Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNaYKPEkjH1jbgoX1TwKMX	2026-07-01 14:31:36 +02:00
Bastien Chanot	b866004456	Merge chore/reconcile-memory into develop	2026-07-01 14:27:48 +02:00
Bastien ChanotandClaude Opus 4.8	c4586599d1	chore(memory): reconcile TODO + registries (BDR/LRN/BLK supersessions, LICENSE done) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNaYKPEkjH1jbgoX1TwKMX	2026-07-01 00:20:23 +02:00
Bastien Chanot	8fd32631fe	chore: adopt gitflow socle + pre-commit hook	2026-06-29 02:27:57 +02:00
Bastien ChanotandClaude Opus 4.8	ea33e231ef	docs(memory): add BDR-009 + LRN-008 (dtach menu -> ~/.bashrc, VS Code non-login) - BDR-009: reverses BDR-007; menu moved to ~/.bashrc because VS Code Remote-SSH terminals are non-login; per-tab firing accepted over a once-per-connection sentinel. - LRN-008: VS Code Remote-SSH (Linux) terminals are non-login -> skip ~/.profile; hook ~/.bashrc for "run once at session start"; diagnose via VSCODE_IPC_HOOK_CLI + no login-bash ancestry + shopt -q login_shell. - journal: 2026-06-25 session entry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM	2026-06-26 00:09:16 +02:00
Bastien ChanotandClaude Opus 4.8	e37eb77ed5	fix(dtach): wire resume menu into ~/.bashrc for non-login VS Code shells VS Code Remote-SSH integrated terminals are non-login interactive shells: they source ~/.bashrc but never ~/.profile, where the resume menu was wired (login-scope, BDR-007). The auto-check therefore never fired in the user's actual environment, even after install.sh. Source dtach-router from bashrc-linux (every interactive shell) instead, and turn install.sh's wire_dtach_profile() into unwire_dtach_profile(): it now strips any stale ~/.profile block so a plain SSH login (which reads ~/.bashrc via ~/.profile) does not prompt twice. README updated to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM	2026-06-26 00:09:16 +02:00
Bastien ChanotandClaude Opus 4.8	4f03d87a86	docs(memory): add LRN-007 (doc-drift) + BDR-008 (GPL-3.0) - LRN-007: doc-drift detection by file mtime misses partial doc updates; cross-reference feature commits, not the doc timestamp. - BDR-008: repo licensed GPL-3.0-or-later (copyleft), with rejected alternatives and reversibility note. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P8QfqokDoggsPVhEp7FnCa	2026-06-25 11:19:21 +02:00
Bastien ChanotandClaude Opus 4.8	00d88f723f	docs(readme): document code-server + RDP, add License section The feature batch in `0bd936b` shipped code-server and gnome-remote-desktop RDP login, but the later README edit (`46512ee`) only fixed the package list, leaving both features undocumented. - Add install steps for code-server (browser VS Code) and gnome-remote-desktop RDP remote login. - Add a "Remote access" bullet to the apt package list (gnome-remote-desktop, openssl, code-server). - Broaden the install.sh summary row in "What's inside". - Replace the Lint section with a License section (GPL-3.0-or-later). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P8QfqokDoggsPVhEp7FnCa	2026-06-25 11:19:21 +02:00
Bastien ChanotandClaude Opus 4.8	40c6524348	chore: add GPL-3.0 license Add verbatim GPL-3.0 text (copied from /usr/share/common-licenses/GPL-3). Repo is now licensed GPL-3.0-or-later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P8QfqokDoggsPVhEp7FnCa	2026-06-25 11:19:21 +02:00
Bastien ChanotandClaude Opus 4.8	46512ee2de	docs(readme): fix stale wkhtmltopdf -> weasyprint in package list install.sh installs weasyprint (HTML/CSS->PDF), not wkhtmltopdf; the apt package list in README was stale. Mirror the installer verbatim. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM	2026-06-24 18:02:23 +02:00
Bastien ChanotandClaude Opus 4.8	dafe9ea185	fix(install): source dtach-router at login instead of executing it Executing dtach-router broke its return-based interactive guard and errored on /dev/tty in non-interactive login shells (bash -lc, cron, scp). It is now sourced via a guarded, idempotent ~/.profile block (case $- in i) ... . dtach-router) installed by wire_dtach_profile(), which migrates the old execute-based block. Also adds cc (create) and d (re-summon) aliases to bashrc-linux. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM	2026-06-24 18:00:52 +02:00
Bastien ChanotandClaude Opus 4.8	c0fddc6f94	feat(install): system-wide low-disk login warning via /etc/profile.d Add etc/profile.d/disk-usage-warning.sh (POSIX sh) that warns in bold red at login when / or /home cross 85% usage. Deployed system-wide via install_disk_warning() (sudo install -D -m 0644), gated inside the apt-get block since df --output=pcent and /etc/profile.d are GNU/Debian conventions absent on macOS. Idempotent and re-runnable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN1KSmsuLG6TxSeN5m8xvM	2026-06-24 18:00:17 +02:00
Bastien ChanotandClaude Opus 4.8	57cdfeaf25	docs(memory): add BDR-005 — gnome-remote-desktop over xrdp on Wayland GNOME Record the architecture decision (rationale + rejected alternatives) behind replacing xrdp with gnome-remote-desktop system "Remote Login" on Wayland-only GNOME. Cross-refs LRN-004 / BLK-004. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JSFhCiEgndbRrMf7s8mmth	2026-06-23 17:55:50 +02:00