dotfiles/etc/systemd/system, branch masterMy linux config and rc fileshttps://git.sommerfeld.dev/dotfiles/atom/etc/systemd/system?h=master2026-09-30T07:54:59ZBind TPM pcrlock policy to GPT measurements2026-09-30T07:54:59Zsommerfeldsommerfeld@sommerfeld.dev2026-09-30T07:54:59Zurn:sha1:67b03911aa43bac7c324c01bdb2bb6a31121acb5Enable signed initrd and NvPCR measurements2026-09-30T07:54:59Zsommerfeldsommerfeld@sommerfeld.dev2026-09-30T07:54:59Zurn:sha1:c1f7133be790a972400ba63ca40f92ed699d216eMask unused NvPCR measurements on the Arch host2026-09-30T07:54:59Zsommerfeldsommerfeld@sommerfeld.dev2026-09-30T07:54:59Zurn:sha1:76db86a22a23ccfed07d6160cfdab4ef60067ef0Maintain the approved PCR 7 unlock policy2026-09-17T14:05:36Zsommerfeldsommerfeld@sommerfeld.dev2026-09-17T14:05:36Zurn:sha1:dd45f3ad88b544f065f27143801306a7d6dffd02Prefer the dock camera and use the camera portal2026-09-17T14:05:35Zsommerfeldsommerfeld@sommerfeld.dev2026-09-17T14:05:35Zurn:sha1:3aa51a5c01e7832605705cb71dc9a14f315c6e79Remove former work environment configuration2026-08-14T13:21:05Zsommerfeldsommerfeld@sommerfeld.dev2026-08-14T13:21:05Zurn:sha1:315e7580b35f2535319bbd852d443c3c9bcb4d41Reduce AUR package surface2026-06-14T23:55:43Zsommerfeldsommerfeld@sommerfeld.dev2026-06-14T23:55:43Zurn:sha1:bb607b3cdb027a2d02cf2111b8ee12dab172efad
Move pass-secret-service, snx-rs, and Sparrow under Nix/Home Manager.
Track the snx-rs system unit, pass-secret-service user unit, and pacman cache cleanup hook in the repo.
Drop the mkinitcpio firmware metapackage, overdue, pacman-cleanup-hook, and the standalone btc package group.
Move more host tooling to Nix2026-06-05T10:06:02Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:02Zurn:sha1:b0e83e2ee3fc328e55119ee7c1f09ad7ed20a635feat(lostfiles): filter known/private/cache paths via auto-synced ignore2026-05-13T12:43:39Zsommerfeldsommerfeld@sommerfeld.dev2026-05-13T12:43:39Zurn:sha1:2026f98babdcdd34c09eb59479a02a5603fc70a2
Upstream lostfiles has no extension mechanism; the weekly report ends
up dominated by files this repo intentionally deploys plus host-private
files we deliberately don't track plus regenerated GTK caches.
Add etc/lostfiles.ignore.tmpl which renders /etc/lostfiles.ignore from
two sources:
1. Every file under etc/ in the repo (auto-enumerated at chezmoi-apply
time, same find-sort pattern the etc deploy script uses). This
keeps the ignore list in sync with what we actually deploy with
zero manual maintenance.
2. A static block for: the sudo-i symlink, host-private
systemd-networkd units (99-hodor*, 99-mandibles*) which contain
WireGuard secrets, the getty@tty1 autologin override which
contains the username, and known pacman-hook-generated caches
under /usr/lib/{gdk-pixbuf-2.0,gtk-4.0}/.
Wrap /usr/bin/lostfiles in lostfiles.service via grep -vFxf, with a
fallback when /etc/lostfiles.ignore doesn't yet exist (first deploy).
feat(lostfiles): weekly unowned-files refresh + waybar reminder2026-05-13T12:43:35Zsommerfeldsommerfeld@sommerfeld.dev2026-05-13T12:43:35Zurn:sha1:54eacef87b906835f9778d9c4b02128398bf88d0
Wiring (mirrors arch-audit, with weekly cadence and Nice=19/idle I/O):
lostfiles.timer (weekly, Persistent=true, RandomizedDelaySec=1h)
→ lostfiles.service
→ /run/lostfiles.txt (default mode — strict produces too many
false positives for a passive reminder)
→ custom/lostfiles waybar module (interval 600s)
→ mako 'normal' once/7d while count > 0
→ on-click: `ghostty -e nvim -R /run/lostfiles.txt`
Default mode (no `strict` argument) is intentional: it already filters
the package's curated false-positive list at /etc/lostfiles.conf, which
is what we want for a low-noise weekly nudge. Switching to `strict` is
a one-line change in lostfiles.service if signal-vs-noise tilts later.