numerous updates

install.sh

@@ -70,7 +70,8 @@ echo "Starting full system setup..."
 
 # Bring the system fully up to date before installing anything new
 echo "Updating system..."
-sudo pacman -Syu --noconfirm
+sudo pacman -Sy --needed --noconfirm archlinux-keyring
+sudo pacman -Su --noconfirm
 
 cd ~/
 
@@ -168,6 +169,26 @@ if ! systemctl is-active tailscaled &> /dev/null; then
   sudo systemctl start tailscaled
 fi
 
+# SSH keepalives, login lockout, shutdown timeout, OOM protection, boot, SSH PATH
+echo "Applying system defaults..."
+bash ~/.local/share/coredesktop/system/defaults.sh
+
+# Block incoming connections except SSH, mDNS, LocalSend and Tailscale
+echo "Configuring the firewall..."
+bash ~/.local/share/coredesktop/system/firewall.sh
+
+# Snapshot / before each update (btrfs only)
+echo "Configuring Snapper..."
+bash ~/.local/share/coredesktop/system/snapper.sh
+
+echo "Installing GPU drivers..."
+bash ~/.local/share/coredesktop/system/vulkan.sh
+bash ~/.local/share/coredesktop/system/nvidia.sh
+
+# Prompt, zoxide, fzf key bindings, aliases and functions
+echo "Configuring the shell..."
+bash ~/.local/share/coredesktop/shell/setup.sh
+
 # Apply GNOME dconf settings only if the settings file has changed since last run
 bash ~/.local/share/coredesktop/gnome/apply-gnome-settings.sh
 
@@ -177,6 +198,11 @@ if systemctl is-enabled systemd-resolved.service &> /dev/null; then
   bash ~/.local/share/coredesktop/fixmdns.sh
 fi
 
+# Run one-time migrations not yet recorded on this machine. On a fresh install
+# they repeat setup done above, which is safe because each one is idempotent.
+echo "Running migrations..."
+run_migrations
+
 # Check whether the running kernel matches the installed modules — if not, a
 # newer kernel was installed during this run and a reboot is required
 if ! ls /usr/lib/modules/$(uname -r) > /dev/null 2>&1; then