• openSUSE
• Tumbleweed
• Server

• Kraityn = Raspberry Pi 4 Model B Rev 1.5 (notes)

• https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw.xz
• https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw.xz.sha256

openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64.raw

• 64GB SD Card

NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
mmcblk0     179:0    0 59.5G  0 disk
├─mmcblk0p1 179:1    0   64M  0 part /boot/efi
├─mmcblk0p2 179:2    0  500M  0 part [SWAP]
└─mmcblk0p3 179:3    0 58.9G  0 part /

• Continue from ssh
• Log-in as root

• Change root user password

passwd

• Users → Add
• Defaults ¹⁾

yast2 'users'

echo 'PermitRootLogin no' | tee '/etc/ssh/sshd_config.d/DenyRootLogin.conf' > '/dev/null' && cat '/etc/ssh/sshd_config.d/DenyRootLogin.conf'

systemctl 'reboot'

sudo sshd -T | grep 'permitrootlogin'

sudo zypper modifyrepo --disable 'repo-openh264'

sudo zypper clean --all && sudo zypper refresh --force --services && sudo zypper dist-upgrade --details --allow-downgrade --allow-name-change --allow-arch-change --allow-vendor-change && sync

• TODO (notes)

• Installs nano
• Sets VISUAL and EDITOR to nano via environment variable
• Sets nowrap for current user

sudo zypper install 'nano' && export 'VISUAL=nano' && export 'EDITOR=nano' && echo -e 'export VISUAL=nano\nexport EDITOR=nano' | sudo tee '/etc/profile.d/editor-nano.sh' > '/dev/null' && cat '/etc/profile.d/editor-nano.sh' && mkdir -p ~/'.config/nano' && echo 'set nowrap' | tee ~/'.config/nano/nanorc' > '/dev/null' && cat ~/'.config/nano/nanorc'

sudo zypper remove --clean-deps 'irqbalance'

sudo zypper addlock 'irqbalance'

sudo zypper install aria2 fastfetch htop 7zip sensors unar

clear && fastfetch -l 'small' && uname -a && date

ssh '192.168.1.152' -t 'clear && fastfetch -l 'small' && uname -a && date'

sudo hostnamectl set-hostname 'Kraityn'

echo '127.0.0.1 Kraityn' | sudo tee --append '/etc/hosts' > '/dev/null'

sudo timedatectl set-timezone 'America/New_York' && sudo timedatectl 'set-ntp' 'true' && timedatectl status

sudo hwclock --systohc

• More DNS Servers

nmcli con show

sudo nmcli connection modify 'Wired connection 1' 'ipv4.dns' '192.168.1.1,1.1.1.2,1.0.0.2'

sudo nmcli connection modify 'Wired connection 1' 'ipv6.dns' '2606:4700:4700::1112,2606:4700:4700::1002'

sudo nmcli connection modify 'Wired connection 1' 'ipv4.address' '192.168.1.152/24'

sudo nmcli connection modify 'Wired connection 1' 'ipv4.gateway' '192.168.1.1'

sudo nmcli connection modify 'Wired connection 1' 'ipv4.method' 'manual'

sudo nmcli connection up 'Wired connection 1'

• Notes

sudo firewall-cmd --get-active-zones

sudo firewall-cmd --permanent --zone='docker' --remove-interface='docker0'

sudo systemctl restart 'firewalld'

sudo yast2 'bootloader'

• Boot Loader: GRUB2 for EFI

• [ ] Secure Boot Support
• [x] Update NVRAM Entry

• Protective MBR flag: do not change

• CPU Mitigations: Auto
• [ ] Graphical console
• [ ] Serial console

• More Kernel Parameters
• Last updated: 2026/07/10

quiet bgrt_disable security='' hibernate='no' idle='halt' nohz='off' preempt='lazy' iommu='pt' memory_corruption_check='0' init_on_alloc='0' init_on_free='0' drm_kms_helper.poll='0' drm_kms_helper.fbdev_emulation='0' hostname='localhost' pci='pcie_bus_perf,notph'

• Timeout in Seconds: 0
• [ ] Probe Foreign OS
• [ ] Hide Menu on Boot
• Default Boot Section: openSUSE Tumbleweed
• [ ] Protect Boot Loader with Password

sudo -e '/boot/efi/extraconfig.txt'

# Disable
dtoverlay=disable-bt
dtoverlay=disable-wifi
disable_splash=1
disable_fw_kms_setup=1

# Tweaks
arm_boost=1
force_turbo=1
over_voltage=15
arm_freq=2100
max_usb_current=1

# End

sudo systemctl enable 'fstrim.timer' --now

sudo systemctl start 'fstrim' && sync && sudo systemctl status 'fstrim' -l

sudo fstrim -v -a

• From LiveUSB/unmounted
• TODO

sudo e2fsck -D -E 'discard,optimize_extents,inode_count_fullmap' -f -v -y '/dev/sda2'

• Notes
• TODO: Maintenance service

sudo e4defrag -v '/dev/sdb'

echo "export LD_BIND_NOW='1'" | sudo tee '/etc/profile.d/general-tweaks.sh' > '/dev/null'

• Notes

sudo -e '/etc/dracut.conf.d/99-tweaks.conf'

compress="gzip"
do_strip="yes"
aggressive_strip="yes"
hostonly="yes"
hostonly_mode="strict"
reproducible="no"
enhanced_cpio="no"
i18n_install_all="no"
kernel_cmdline="rd.luks=0 rd.lvm=0 rd.md=0 rd.dm=0"

# End

sudo dracut --force --regenerate-all

sudo mkdir -p '/etc/systemd/journald.conf.d' && sudo -e '/etc/systemd/journald.conf.d/99-tweaks.conf' && sudo journalctl --vacuum-time='1s' --rotate

[Journal]
Storage=none
Compress=false
MaxLevelStore=0
MaxLevelSyslog=0
MaxLevelKMsg=0
MaxLevelConsole=0
MaxLevelWall=0

# End

sudo journalctl --vacuum-time='1s' --rotate

sudo -e '/etc/fstab'

,discard=once

• https://www.kernel.org/doc/Documentation/filesystems/vfat.txt

• /boot/efi type vfat

,discard

• Fixes timers firing at boot without early accurate time (no RTC)

sudo systemctl enable --now 'systemd-timesyncd.service'

sudo -e '/etc/systemd/system/suse-up.service'

[Service]
Type=oneshot

ExecStartPre='/usr/bin/zypper' clean --all

ExecStart='/usr/bin/zypper' --non-interactive refresh --force --services
ExecStart='/usr/bin/zypper' --non-interactive dist-upgrade --auto-agree-with-licenses --allow-downgrade --allow-name-change --allow-arch-change --allow-vendor-change

ExecStartPost='/usr/bin/sync'
ExecStartPost='/usr/bin/systemctl' reboot

# End

• 06:00 Kraityn

sudo -e '/etc/systemd/system/suse-up.timer' && sudo systemctl daemon-reload && sudo systemctl enable 'suse-up.timer' --now

[Unit]
Description=openSUSE OS Updater
After=network-online.target
Wants=network-online.target

[Timer]
OnCalendar=*-*-* 06:00:00
Persistent=true

[Install]
WantedBy=timers.target

# End

sudo systemctl start 'suse-up'

• See misc