From 372b8b27a64179602a8c81fe9d12931ebb5b8cef Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Tue, 21 Apr 2026 01:23:46 +0100
Subject: feat(etc): drift detection + auto-enumerating deploy template

- `just etc-drift` reports /etc files modified from pacman defaults
  (via pacman -Qii) and user-created files (via pacman -Qo), subtracting
  already-managed paths and patterns listed in etc/.ignore.
- Refactor run_onchange_after_deploy-etc.sh.tmpl to enumerate files under
  etc/ automatically via find; single combined hash via chezmoi output +
  sha256sum, so new files only need to be dropped into etc/.
- etc/.ignore seeds noise filters: machine-id, ssh host keys, pacman
  keyring, mirrorlist, shadow/passwd backups, sbctl keys, ca-certs.
---
 etc/.ignore | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 etc/.ignore

(limited to 'etc/.ignore')

diff --git a/etc/.ignore b/etc/.ignore
new file mode 100644
index 0000000..c15fb70
--- /dev/null
+++ b/etc/.ignore
@@ -0,0 +1,35 @@
+# Paths excluded from `just etc-drift` output.
+# Shell-glob patterns (case $path in $pat) work here: *, ?, [].
+
+# Per-host state / auto-generated
+/etc/machine-id
+/etc/adjtime
+/etc/.updated
+/etc/.pwd.lock
+/etc/mtab
+/etc/ld.so.cache
+
+# Per-host identity / secrets
+/etc/ssh/ssh_host_*
+/etc/shadow
+/etc/shadow-
+/etc/gshadow
+/etc/gshadow-
+/etc/passwd-
+/etc/group-
+
+# Regenerated by tools (not worth versioning)
+/etc/resolv.conf
+/etc/ssl/certs/*
+/etc/ca-certificates/extracted/*
+/etc/pacman.d/gnupg/*
+/etc/pacman.d/mirrorlist
+
+# Managed by useradd (podman uses them)
+/etc/subuid
+/etc/subgid
+/etc/subuid-
+/etc/subgid-
+
+# sbctl signed-boot state (keys live here; never commit)
+/etc/secureboot/*
-- 
cgit v1.2.3-70-g09d2