updates to the content

content/system.md

@@ -1,6 +1,6 @@
 ---
 title: "System"
-description: "How Federated CoreDesktop sets up your system: tiling, the shell, the firewall, Snapper snapshots, GPU drivers, mDNS, printing, open-port audits and sensible defaults."
+description: "How Federated CoreDesktop sets up your system: tiling, the shell, SSH, the firewall, Snapper snapshots, GPU drivers, mDNS, printing and sensible defaults, every setting it changes, and how to undo it."
 sections:
   - type: hero
     compact: true
@@ -35,7 +35,7 @@ sections:
     kicker: "Firewall"
     headline: "ufw is on, and Docker can't get around it."
     body: |
-      Incoming connections are blocked except SSH (22), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale.
+      Incoming connections are blocked except SSH (22, keys only), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale.
 
       Docker normally publishes container ports around ufw, so **ufw-docker** is installed too. To let a container's port through, or to open a port for something else, such as a dev server you want to reach from another machine:
 
@@ -47,6 +47,25 @@ sections:
 
       To see every open port and who can reach it, run [audit](/utilities/#audit).
 
+  - type: text
+    id: ssh
+    kicker: "SSH"
+    headline: "Reach this machine with a key, not a password."
+    body: |
+      The SSH server is on, so you can reach this computer from your other ones, and it accepts keys only. On a laptop at a café or a conference, that means nobody on the same Wi-Fi can try to guess your password. To log in over SSH, copy your public key to this computer once, from the computer you connect from:
+
+      ```
+      ssh-copy-id you@machine.local
+      ```
+
+      To allow passwords again, delete `/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf` and run `sudo systemctl reload sshd`.
+
+      On machines installed earlier, where someone has logged in over SSH with a password, `update` leaves password login on, so nobody is locked out. Add your key, then switch with:
+
+      ```
+      bash ~/.local/share/coredesktop/system/sshd.sh
+      ```
+
   - type: text
     id: snapshots
     kicker: "Snapshots"
@@ -92,10 +111,49 @@ sections:
       - "If memory runs out, systemd-oomd closes the app causing it, instead of the whole desktop freezing."
       - "Boot no longer waits for the network."
       - "Commands run over SSH (`ssh {machine} {command}`) can find tools in `~/.local/bin` and mise."
+      - "SSH uses Bitwarden's SSH agent while Bitwarden is running it (turn it on in Bitwarden's settings), and GNOME's otherwise. A terminal opened before Bitwarden started uses GNOME's; open a new one."
 
   - type: callout
     text: "On a machine without systemd-resolved, set up mDNS yourself with `bash ~/.local/share/coredesktop/fixmdns.sh`. See the [Arch wiki](https://wiki.archlinux.org/title/Avahi#Hostname_resolution) for more."
 
+  - type: table
+    id: what-coredesktop-changes
+    kicker: "What CoreDesktop changes"
+    headline: "Every system setting, beyond the software."
+    lede: "Listed so you know what you're running, and so you can undo what you don't want."
+    headers: ["Area", "What changes"]
+    rows:
+      - ["`/etc/pacman.conf`", "Adds the `[federated]` repository and trusts its signing key"]
+      - ["SSH", "sshd is on, with key login only (`/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf`). Client keepalives are in `/etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf`"]
+      - ["Firewall", "ufw is on, with the [rules above](#firewall), and ufw-docker's rules in `/etc/ufw/after.rules`"]
+      - ["Login lockout", "`deny` and `unlock_time` in `/etc/security/faillock.conf`"]
+      - ["systemd", "A 10-second stop timeout (`/etc/systemd/system.conf.d/` and `/etc/systemd/user.conf.d/10-coredesktop-timeout.conf`), systemd-oomd for apps (`/etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf`), and NetworkManager-wait-online masked"]
+      - ["`/etc/security/pam_env.conf`", "A PATH line, so SSH commands find `~/.local/bin` and mise"]
+      - ["mDNS", "Avahi is on, nss-mdns is added to `/etc/nsswitch.conf`, and SSH is advertised in `/etc/avahi/services/ssh.service`"]
+      - ["Services", "Avahi, Bluetooth, CUPS, fwupd, GDM, NetworkManager, sshd, Docker, Tailscale, ufw and systemd-oomd are turned on. Your user is added to the docker group"]
+      - ["Snapper", "btrfs only: a config for `/` in `/etc/snapper/configs/root`"]
+      - ["NVIDIA", "Only if it installs the driver: `/etc/mkinitcpio.conf.d/nvidia.conf` and NVIDIA's suspend services"]
+      - ["Your home folder", "Lines in `~/.bashrc` (CoreDesktop's shell setup, `~/.local/bin` on PATH, the Bitwarden SSH agent), the commands in `~/.local/bin` (update, refresh, sibling, version, configure, audit), GNOME extensions and their settings, Claude Code's `~/.claude/settings.json` if you had none, a user timer that checks for updates, and a user service that pauses your Core's email if its password stops working"]
+      - ["configure", "Only for what you set up: your Nextcloud files mount in `/etc/fstab`, GNOME Online Accounts, passwords in your GNOME keyring, and the backup timer"]
+
+  - type: text
+    id: uninstalling
+    kicker: "Uninstalling"
+    headline: "Undo CoreDesktop by hand."
+    body: |
+      CoreDesktop doesn't have an uninstaller, but you can undo it yourself. If you set up a Core, do this first, while `configure` is still installed, so your app passwords are revoked: `configure backup` (turn backups off), `configure tailscale` (leave the network), then `configure core` and **Remove a Core** for each Core.
+
+      Then remove CoreDesktop's own files:
+
+      ```
+      systemctl --user disable --now coredesktop-update-check.timer coredesktop-backup.timer coredesktop-email-watch.service
+      rm -f ~/.config/systemd/user/coredesktop-*
+      rm -f ~/.local/bin/{update,refresh,sibling,version,configure,audit}
+      rm -rf ~/.local/share/coredesktop ~/.local/share/siblings ~/.local/state/coredesktop ~/.config/coredesktop
+      ```
+
+      Delete the CoreDesktop lines from `~/.bashrc`, and undo the [system settings](#what-coredesktop-changes) you don't want. The software stays installed: remove what you don't want with `sudo pacman -Rns <package>` and `flatpak uninstall <app>`.
+
   - type: final-cta
     headline: "Keep it all current with one command."
     body: "`update` snapshots first, then updates everything, and tells you what failed."