====== Information ======

  * openSUSE
  * Tumbleweed
  * Server

  * Kraityn = Raspberry Pi 4 Model B Rev 1.5 ([[linux:notes:rpi4_ostw|notes]])

====== Download ======

  * https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw.xz
  * https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw.xz.sha256

  openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw

====== Installation Notes ======

===== Partitioning =====

  * 64GB SD Card

<code>
NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
mmcblk0     179:0    0 59.5G  0 disk
├─mmcblk0p1 179:1    0   64M  0 part /boot/efi
├─mmcblk0p2 179:2    0  500M  0 part [SWAP]
└─mmcblk0p3 179:3    0 58.9G  0 part /</code>

====== Initial Set-up ======

  * Continue from ''ssh''
  * Log-in as ''root''

===== passwd =====

  * :!: Change ''root'' user password

  passwd

===== Create User =====

  * Users -> Add
  * Defaults ((UID ''1000'', Groups ''users''))

  yast2 'users'

===== Disable Root SSH =====

  echo 'PermitRootLogin no' | tee '/etc/ssh/sshd_config.d/DenyRootLogin.conf' > '/dev/null' && cat '/etc/ssh/sshd_config.d/DenyRootLogin.conf'

  systemctl 'reboot'

  sudo sshd -T | grep 'permitrootlogin'

====== Software ======

===== Disable Open H.264 Repo =====

  sudo zypper modifyrepo --disable 'repo-openh264'

===== Update =====

==== System ====

  sudo zypper clean --all && sudo zypper refresh --force --services && sudo zypper dist-upgrade --details --allow-downgrade --allow-name-change --allow-arch-change --allow-vendor-change && sync

==== EEPROM ====

  * TODO ([[linux:notes:rpi4_ostw#eeprom|notes]])

===== GNU nano =====

  * Installs ''nano''
  * Sets ''VISUAL'' and ''EDITOR'' to ''nano'' via environment variable
  * Sets ''nowrap'' for current user

  sudo zypper install 'nano' && export 'VISUAL=nano' && export 'EDITOR=nano' && echo -e 'export VISUAL=nano\nexport EDITOR=nano' | sudo tee '/etc/profile.d/editor-nano.sh' > '/dev/null' && cat '/etc/profile.d/editor-nano.sh' && mkdir -p ~/'.config/nano' && echo 'set nowrap' | tee ~/'.config/nano/nanorc' > '/dev/null' && cat ~/'.config/nano/nanorc'

===== Remove =====

  sudo zypper remove --clean-deps 'irqbalance'

  sudo zypper addlock 'irqbalance'

===== General =====

  sudo zypper install aria2 fastfetch htop 7zip sensors unar

===== Specs =====

  clear && fastfetch -l 'small' && uname -a && date

  ssh '192.168.1.152' -t 'clear && fastfetch -l 'small' && uname -a && date'

====== Settings ======

===== Hostname =====

  sudo hostnamectl set-hostname 'Kraityn'

  echo '127.0.0.1 Kraityn' | sudo tee --append '/etc/hosts' > '/dev/null'

===== Time =====

  sudo timedatectl set-timezone 'America/New_York' && sudo timedatectl 'set-ntp' 'true' && timedatectl status

===== Network =====

==== DNS ====

  * [[servers:upstream_dns_servers|More DNS Servers]]

<code>nmcli con show</code>

<code>sudo nmcli connection modify 'Wired connection 1' 'ipv4.dns' '192.168.1.1,1.1.1.2,1.0.0.2'</code>

<code>sudo nmcli connection modify 'Wired connection 1' 'ipv6.dns' '2606:4700:4700::1112,2606:4700:4700::1002'</code>

<code>sudo nmcli connection modify 'Wired connection 1' 'ipv4.address' '192.168.1.152/24'</code>

<code>sudo nmcli connection modify 'Wired connection 1' 'ipv4.gateway' '192.168.1.1'</code>

<code>sudo nmcli connection modify 'Wired connection 1' 'ipv4.method' 'manual'</code>

<code>sudo nmcli connection up 'Wired connection 1'</code>

==== Firewalld ====

  * [[linux:notes:firewalld|Notes]]

  sudo firewall-cmd --get-active-zones

  sudo firewall-cmd --permanent --zone='docker' --remove-interface='docker0'

  sudo systemctl restart 'firewalld'

====== Boot Loader ======

===== YaST =====

  sudo yast2 'bootloader'

==== Boot Code Options ====

  * Boot Loader: ''GRUB2 for EFI''

  * ''[ ]'' Secure Boot Support
  * ''[x]'' Update NVRAM Entry

  * Protective MBR flag: ''do not change''

==== Kernel Parameters ====

  * CPU Mitigations: ''Auto''
  * ''[ ]'' Graphical console
  * ''[ ]'' Serial console

=== Kraityn ===

  * [[linux:notes:kernel_parameters|More Kernel Parameters]]
  * Last updated: 2026/07/10

  quiet bgrt_disable security='' hibernate='no' idle='halt' nohz='off' preempt='lazy' iommu='pt' memory_corruption_check='0' init_on_alloc='0' init_on_free='0' drm_kms_helper.poll='0' drm_kms_helper.fbdev_emulation='0' hostname='localhost' pci='pcie_bus_perf,notph'

=== Default ===

  security=selinux selinux=1 loglevel=3 splash=silent systemd.show_status=1

==== Bootloader Options ====

  * Timeout in Seconds: ''0''
  * ''[ ]'' Probe Foreign OS
  * ''[ ]'' Hide Menu on Boot
  * Default Boot Section: ''openSUSE Tumbleweed''
  * ''[ ]'' Protect Boot Loader with Password

===== config.txt =====

  sudo -e '/boot/efi/extraconfig.txt'

<code>
# Disable
dtoverlay=disable-bt
dtoverlay=disable-wifi
disable_splash=1
disable_fw_kms_setup=1

# Tweaks
arm_boost=1
force_turbo=1
over_voltage=15
arm_freq=2100
max_usb_current=1

# End</code>

====== Drive Maintenance ======

===== Trim =====

  sudo systemctl enable 'fstrim.timer' --now

  sudo systemctl start 'fstrim' && sync && sudo systemctl status 'fstrim' -l

  sudo fstrim -v -a

===== ext2 =====

  * :!: From LiveUSB/unmounted
  * TODO

  sudo e2fsck -D -E 'discard,optimize_extents,inode_count_fullmap' -f -v -y '/dev/sda2'

===== ext4 NAS =====

  * [[linux:notes:ext4|Notes]]
  * TODO: Maintenance service

  sudo e4defrag -v '/dev/sdb'

====== Tweaks ======

===== General =====

  echo "export LD_BIND_NOW='1'" | sudo tee '/etc/profile.d/general-tweaks.sh' > '/dev/null'

===== modprobe.d =====

  * [[linux;notes;modprobe.d_tweaks#alira|Notes]]

===== Dracut =====

  sudo -e '/etc/dracut.conf.d/99-tweaks.conf'

<code>
compress="gzip"
do_strip="yes"
aggressive_strip="yes"
hostonly="yes"
hostonly_mode="strict"
reproducible="no"
enhanced_cpio="no"
i18n_install_all="no"
kernel_cmdline="rd.luks=0 rd.lvm=0 rd.md=0 rd.dm=0"

# End</code>

  sudo dracut --force --regenerate-all

===== journald =====

  sudo mkdir -p '/etc/systemd/journald.conf.d' && sudo -e '/etc/systemd/journald.conf.d/99-tweaks.conf' && sudo journalctl --vacuum-time='1s' --rotate

<code>
[Journal]
Storage=none
Compress=false
MaxLevelStore=0
MaxLevelSyslog=0
MaxLevelKMsg=0
MaxLevelConsole=0
MaxLevelWall=0

# End</code>

  sudo journalctl --vacuum-time='1s' --rotate

===== fstab =====

  sudo -e '/etc/fstab'

==== swap ====

  ,discard=once

==== EFI ====

  * https://www.kernel.org/doc/Documentation/filesystems/vfat.txt

  * ''/boot/efi type vfat''

  ,discard

====== Automatic Updates ======

===== Time Sync =====

  * Fixes timers firing at boot without early accurate time (no RTC)
  * :!: WIP
  * https://raspberrypi.stackexchange.com/questions/94635/how-can-i-delay-the-startup-of-systemd-services-until-the-datetime-is-set-no-rt/95195#95195
  * https://terinstock.com/post/2021/12/Systemds-clock-epoch-for-RTC-less-systems/

  sudo systemctl enable --now 'systemd-timesyncd.service'

===== Service =====

  sudo -e '/etc/systemd/system/suse-up.service'

<code>
[Service]
Type=oneshot

ExecStartPre='/usr/bin/zypper' clean --all

ExecStart='/usr/bin/zypper' --non-interactive refresh --force --services
ExecStart='/usr/bin/zypper' --non-interactive dist-upgrade --auto-agree-with-licenses --allow-downgrade --allow-name-change --allow-arch-change --allow-vendor-change

ExecStartPost='/usr/bin/sync'
ExecStartPost='/usr/bin/systemctl' reboot

# End</code>

===== Timer =====

  * ''06:00'' Kraityn

  sudo -e '/etc/systemd/system/suse-up.timer' && sudo systemctl daemon-reload && sudo systemctl enable 'suse-up.timer' --now

<code>
[Unit]
Description=openSUSE OS Updater
After=network-online.target
Wants=network-online.target

[Timer]
OnCalendar=*-*-* 06:00:00
Persistent=true

[Install]
WantedBy=timers.target

# End</code>

  sudo systemctl start 'suse-up'

====== Notable Folders and Commands ======

  * See [[linux:notes:misc]]