numerous updates

system/defaults.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+#
+# Purpose : System defaults adapted from Omarchy: SSH keepalives, a gentler
+#           login lockout, faster shutdown, out-of-memory protection, faster
+#           boot, and a PATH for commands run over SSH
+
+set -e
+
+# SSH client: notice a dropped connection within a minute instead of hanging
+# until TCP gives up. Settings in ~/.ssh/config still win per host.
+echo "Configuring SSH keepalives..."
+sudo install -d -m 755 /etc/ssh/ssh_config.d
+sudo tee /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf > /dev/null << 'EOF'
+# CoreDesktop: notice dropped connections quickly instead of hanging until TCP
+# times out. Settings in ~/.ssh/config take precedence over these defaults.
+Host *
+  ServerAliveInterval 15
+  ServerAliveCountMax 3
+  ConnectTimeout 10
+EOF
+
+# Login lockout: Arch locks an account for 10 minutes after 3 wrong passwords.
+# Allow 10 tries and unlock after 2 minutes.
+echo "Relaxing the failed-login lockout..."
+sudo sed -i -E \
+  -e 's/^#?[[:space:]]*deny[[:space:]]*=.*/deny = 10/' \
+  -e 's/^#?[[:space:]]*unlock_time[[:space:]]*=.*/unlock_time = 120/' \
+  /etc/security/faillock.conf
+
+# Shutdown: don't wait 90 seconds on a service or app that won't stop
+echo "Shortening the shutdown timeout..."
+sudo install -d -m 755 /etc/systemd/system.conf.d /etc/systemd/user.conf.d
+printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
+  | sudo tee /etc/systemd/system.conf.d/10-coredesktop-timeout.conf > /dev/null
+printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
+  | sudo tee /etc/systemd/user.conf.d/10-coredesktop-timeout.conf > /dev/null
+
+# Out of memory: let systemd-oomd kill the app causing memory pressure instead
+# of the whole session freezing. GNOME launches apps into app.slice, so GNOME
+# Shell itself is never a candidate.
+echo "Enabling out-of-memory protection..."
+sudo install -d -m 755 /etc/systemd/user/app.slice.d
+sudo tee /etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf > /dev/null << 'EOF'
+[Slice]
+ManagedOOMMemoryPressure=kill
+ManagedOOMSwap=kill
+EOF
+sudo systemctl daemon-reload
+sudo systemctl enable --now systemd-oomd.service
+
+# Boot: nothing on the desktop needs to wait for the network to come up
+echo "Masking NetworkManager-wait-online..."
+sudo systemctl mask NetworkManager-wait-online.service
+
+# `ssh host command` runs without a login shell, so ~/.bashrc never sets PATH
+# and tools in ~/.local/bin or installed with mise aren't found. PAM sets the
+# environment for every login, including those. @{HOME} expands per user.
+if ! grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf; then
+  echo "Adding user tool paths for SSH commands..."
+  sudo tee -a /etc/security/pam_env.conf > /dev/null << 'EOF'
+
+# CoreDesktop: give SSH commands and other non-shell logins the user-level tool paths
+PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
+EOF
+fi