numerous updates

README.md

@@ -93,6 +93,48 @@ The printing service (cups) is turned on. This may need more work to "just work"
 
 mDNS is installed and enabled so the your can find and SSH to your machine on your LAN using {machinename}.local.
 
+### Firewall
+
+The ufw firewall is on. It blocks incoming connections except SSH (22), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale. ufw-docker is installed too, because ports published by Docker containers otherwise get around ufw. To let a container's port through, use `sudo ufw-docker allow {container} {port}`. To open a port for something else, e.g. a dev server you want to reach from another machine, use `sudo ufw allow {port}/tcp`. `sudo ufw status` shows the current rules.
+
+### Shell
+
+Your ~/.bashrc sources ~/.local/share/coredesktop/shell/bashrc, which sets up the starship prompt, zoxide (`z {part of a path}` jumps to a directory you've used before), fzf key bindings (Ctrl-R searches history, Ctrl-T inserts a file path), eza for `ls`/`ll`/`la`/`lt`, and the aliases and functions in [shell/](shell/). If you already have ~/.config/starship.toml, your prompt config is used. Anything you add to ~/.bashrc after the CoreDesktop line overrides it.
+
+### Snapshots
+
+If / is btrfs (the archinstall default), Snapper takes a snapshot of / before every `update` and keeps the last 5. /home is a separate subvolume and isn't included, so rolling back never touches your files. `sudo snapper -c root list` shows the snapshots.
+
+These snapshots can't be picked from the boot menu. To roll back after a bad update, boot the Arch ISO and replace the @ subvolume with a snapshot:
+
+```
+mount -o subvolid=5 /dev/{root partition} /mnt
+mv /mnt/@ /mnt/@.broken
+btrfs subvolume snapshot /mnt/@.snapshots/{number}/snapshot /mnt/@
+reboot
+```
+
+If the disk is encrypted, open it with `cryptsetup open` first and mount the opened device. Once the system works again, free the space the broken root used:
+
+```
+sudo mount -o subvolid=5 /dev/{root partition} /mnt
+sudo btrfs subvolume delete /mnt/@.broken
+sudo umount /mnt
+```
+
+### GPU drivers
+
+The installer adds the Vulkan driver for Intel and AMD GPUs. If there's an NVIDIA GPU and archinstall's proprietary driver wasn't chosen, it installs NVIDIA's driver: the open kernel modules for GTX 16xx / RTX 20xx and newer, or the 580xx legacy driver for older cards back to the GTX 900 series. Reboot afterwards.
+
+### System defaults
+
+- SSH connections notice a dropped link within a minute instead of hanging (override per host in ~/.ssh/config).
+- Logins allow 10 wrong passwords before locking the account for 2 minutes (Arch's default is 3 tries, then 10 minutes).
+- Shutdown waits at most 10 seconds for a service that won't stop, instead of 90.
+- If memory runs out, systemd-oomd closes the app causing it instead of the whole desktop freezing.
+- Boot no longer waits for the network.
+- Commands run over SSH (`ssh {machine} {command}`) can find tools in ~/.local/bin and mise.
+
 ## Keep your System Up-to-date
 
 From time-to-time, you'll want to update your system. Hopefully you'll do this more than once-a-month.
@@ -103,7 +145,16 @@ To update the system type into the terminal:
 update
 ```
 
-The script does three things. It runs 'flatpak update' to update your Flatpak apps, it runs 'gem update' to update your Rails environment, and it runs 'sudo pacman -Syu' to update your Arch and Gnome installation.
+The script pulls the latest CoreDesktop, then runs each step in ~/.local/share/coredesktop/updates.d/ in order. Among other things it:
+
+- stops if there's less than 10 GiB free on / (run `UPDATE_FORCE=1 update` to skip the check)
+- snapshots / first, if Snapper is set up (see Snapshots above)
+- updates the Arch keyring, then Arch and GNOME, then AUR packages, Flatpaks, Ruby, GNOME extensions and firmware
+- warns you not to reboot if the initramfs failed to rebuild
+- runs any one-time migrations, the way existing machines pick up new CoreDesktop setup
+- lists packages that are no longer needed, and the command to remove them
+
+If a step fails, the other steps still run, and the failed ones are listed at the end.
 
 It is a good idea to reboot after an update especially if you see you have a new Linux kernel installed (and that happens frequently enough for Arch).
 
@@ -141,6 +192,8 @@ If you want to use mDNS networking on your LAN (the ability to log in to other l
 
 This whole "project" is licensed under the MIT License. Want to help make CoreDesktop better? Awesome! We welcome any and all help. Just contribute a PR and we're off to a better CoreDesktop.
 
+Changes to install.sh only reach new installs. If existing machines need the change too, also add a migration: a script named `migrations/$(date +%s).sh` that `update` runs once on each machine. It may also run on fresh installs, so make it safe to repeat.
+
 ## Bonus
 
 Bonus: here's a [nice song to listen to while you're installing](https://music.youtube.com/watch?v=y-5o2f9wzmw&si=_z9kcKHRwj-KTs7w).