AcreetionOS Server — headless server variant for infrastructure deployment

[spivanatalie64]

Summary

Create and publish AcreetionOS Server, a headless server variant of the main AcreetionOS distribution. Strips all desktop components (Cinnamon, Xorg, audio, Calamares GUI) and replaces them with server-oriented tooling for bare metal, VM, and cloud deployment.

Why

I trust our OS enough to deploy it on our own infrastructure. We need a minimal, hardened, deployment-ready ISO that we can use for:

• Internal infrastructure (web servers, database servers, container hosts)
• Cloud/VM provisioning via cloud-init
• CI/CD runner nodes
• Network appliances (routers, firewalls, VPN gateways)
• Monitoring infrastructure (Prometheus, Grafana, Netdata)
• Container orchestration hosts (Docker, Docker Compose, BuildKit)

Instead of installing the desktop variant and stripping it down manually every time, we build a purpose-built server ISO from the same archiso foundation.

What Changed

Stripped (server doesn't need these)

• Cinnamon desktop environment and all applets/extensions
• Xorg display server and graphics drivers
• LightDM display manager
• Audio stack (PipeWire, ALSA, PulseAudio)
• Calamares graphical installer
• Plymouth boot splash
• Firefox, Electron, VLC, and other desktop applications
• Themes, icons, fonts, wallpapers
• chatbot-ui, peertube, web content

Added (server-focused tooling)

• Web serving: nginx-mainline, apache, certbot
• Databases: mariadb, postgresql, redis, sqlite
• Containers: docker, docker-compose, containerd, buildkit
• Monitoring: prometheus, grafana, node_exporter, netdata
• Networking: bind, dnsmasq, wireguard-tools, nftables, frr, bird
• Cloud Init: cloud-init, cloud-guest-utils
• Remote access: openssh, mosh, tigervnc
• Backup: restic, borg
• Virtualization: qemu-desktop, libvirt, edk2-ovmf
• Dev tools: base-devel, git, go, rust, nodejs, python
• Network diagnostics: nmap, tcpdump, ethtool, traceroute, mtr

Repositories

The server variant is forked/mirrored across all platforms:

Platform	URL
GitHub (org)	https://github.com/AcreetionOS-Code/acreetionos-server
GitHub (personal)	https://github.com/spivanatalie64/acreetionos-server
GitLab.com	https://gitlab.com/sprungles/acreetionos-server
GitLab (self-hosted)	https://gitlab.acreetionos.org/natalie/acreetionos-server
Codeberg	https://codeberg.org/sprunglesontheberg/acreetionos-server

Build

git clone git@github.com:AcreetionOS-Code/acreetionos-server.git
cd acreetionos-server
./build.sh

Output ISO lands in ../ISO/.

Status

• ✅ Initial commit with server-optimized package list
• ✅ All repositories created and synced
• ⏳ First ISO build needed (requires sudo for archiso operations)
• ⏳ Documentation for deployment scenarios
• ⏳ cloud-init configuration templates
• ⏳ CI/CD pipeline for automated ISO builds

[spivanatalie64]

Update: Redesigned as Auto-Installing Server with Desktop Experience

After discussion, the design has been pivoted. AcreetionOS Server is now modeled after Windows Server with Desktop Experience:

How it works

1. Boot the ISO → it automatically installs to the first available disk
2. Wait ~10 minutes → the system reboots
3. Login with admin / acreetion to a Cinnamon desktop pre-loaded with server tools

Key differences from v1

• Auto-installation: Zero interaction required. Systemd service triggers the installer on boot. 10-second countdown to abort before disk wipe.
• Desktop Experience: Cinnamon DE + LightDM + Xorg + PipeWire. You get a GUI for server management, not just a terminal.
• Pre-configured: admin user created, sudo/docker/libvirt groups set, services enabled, GRUB installed.
• Self-destructing installer: The service disables itself after successful install.

Architecture

ISO Boot
  └─ systemd service triggers acreetionos-server-installer
       ├─ Detects disk (skips ISO media)
       ├─ GPT: 1GB EFI + rest as ext4
       ├─ pacstrap base system
       ├─ genfstab, chroot configure
       │    ├─ locale, hostname, timezone
       │    ├─ users (root + admin), sudo
       │    ├─ mkinitcpio, GRUB install
       │    └─ enable services (NetworkManager, sshd, docker, libvirtd, lightdm)
       ├─ Install packages (cinnamon + server tools)
       ├─ Enable lightdm + graphical.target
       └─ Reboot
              └─ Desktop login: admin / acreetion

Package profile

• Desktop: Cinnamon (minimal core), LightDM, Xorg, PipeWire/PulseAudio
• Servers: nginx, apache, mariadb, postgresql, redis, docker, containerd
• Monitoring: prometheus, grafana, node_exporter, netdata
• Networking: bind, dnsmasq, wireguard, nftables, frr, bird
• Cloud: cloud-init, cloud-guest-utils
• Virtualization: qemu, libvirt, edk2-ovmf
• Tools: base-devel, git, go, rust, nodejs, python, htop, tmux, nmap

⚠️ Security

Default credentials are admin/acreetion and root/acreetion. Change on first login. This is a development/deployment ISO, not a production security appliance.

What's NOT included

No Firefox, no VLC, no office suite, no media codecs, no games, no desktop eye candy. This is a server with a management GUI, not a workstation.

[spivanatalie64]

🔒 Security fix: no hardcoded passwords in repo

The previous commit had randomly-generated passwords hardcoded in the installer script and pushed to all public mirrors. This has been fixed by rewriting git history and redesigning the credential flow:

What changed

• No passwords in the repo at all — not even temporary ones
• Installer generates both root and admin passwords at install time using openssl rand -base64 24
• Passwords are 32-character random strings, unique per installation
• They are displayed on screen during installation and saved to /root/.credentials.txt (chmod 600) on the installed system
• All previously-compromised commits have been removed via force-push

What to do if you cloned the old history

If you have a local clone with the old commits (e012a25 or earlier), reset to the latest clean history:

git remote add upstream git@github.com:AcreetionOS-Code/acreetionos-server.git
git fetch upstream
git reset --hard upstream/main

Password flow (new)

installer starts
  └─ openssl rand -base64 24  →  root password (32 chars)
  └─ openssl rand -base64 24  →  admin password (32 chars)
  └─ chpasswd during chroot config
  └─ written to /root/.credentials.txt on installed system
  └─ displayed on screen before reboot
  └─ user copies them down, changes after first login

[spivanatalie64]

Update v3: Full Desktop Experience + First-Boot GUI/TTY Toggle

What changed

1. Same desktop experience as the desktop version
The server ISO now ships with the full Cinnamon desktop — all applets, themes, icons (Adwaita + Faenza), fonts, plymouth boot splash, Vulkan/OpenGL support, and the complete audio stack (PipeWire + PulseAudio). It looks and feels identical to the desktop edition, just with everything pre-installed.

2. First-boot wizard — keep GUI or strip to TTY
On first boot after installation, a dialog appears (zenity in GUI mode, whiptail in TTY mode):

"Do you want to KEEP the desktop GUI?"
→ Yes: Continue with the full desktop experience
→ No: Strip to TTY (removes cinnamon, xorg, lightdm, pipewire, saves ~500MB)

If the user says No, the system cleanly removes the desktop packages and reboots into multi-user.target. Reversible with sudo acreetionos-install-gui.

3. acreetionos-maintain — built-in maintenance TUI
A one-stop interactive tool accessible via sudo acreetionos-maintain:

• System updates, cache cleaning, orphan removal
• Journal log inspection, SMART disk health, ncdu disk usage
• Interactive nftables firewall wizard (SSH-only / HTTP+HTTPS / wide open)
• Docker status + prune, SSL cert expiry check, DB service status
• Network diagnostics (ip, ping, traceroute)
• Auto-update setup (systemd timer, weekly)
• Strip/reinstall GUI toggle

4. Full maintenance tooling (Arch-based, just better)
Added: btop, ncdu, timeshift, testdisk, fsarchiver, ddrescue, partclone, pkgfile, arch-audit, pacman-contrib, reflector

User flow

Boot ISO → auto-install → reboot
  └─ First boot: wizard asks "Keep GUI?"
       ├─ YES → full Cinnamon desktop with server tools
       └─ NO  → packages stripped, reboot to TTY
                  └─ sudo acreetionos-maintain for everything

[spivanatalie64]

Update v4: Welcome Terminal, Docs, Custom Repos, Quarterly CI

🖥️ Welcome terminal on first desktop login

A gnome-terminal window opens automatically on first desktop login with:

• Welcome message and mission statement
• What big corporate does vs what we do differently
• Full explanation of built-in tools (acreetionos-maintain, strip-gui, install-gui)
• Release schedule (quarterly LTS-based Semi-LTS)
• How they can help — bug reports, contributing, spreading the word
• #KeepLinuxFree #AcreetionOSWillAlwaysBeFree

📚 Documentation

Full docs deployed to /usr/local/share/acreetionos/ and /docs/:

• MISSION.md — Why we exist, what big corporate does, what we do differently
• HOW_TO_HELP.md — Bug reports, feature requests, code contributions, spreading the word
• RELEASE_SCHEDULE.md — Quarterly LTS-based Semi-LTS (Jan/Apr/Jul/Oct), 2-year support window
• TOOLS.md — Complete guide to acreetionos-maintain, strip-gui, install-gui, pacman, systemctl

🔒 Custom repository configuration

Pacman is now configured exclusively for our repos:

• [acreetionos-main] — LTS-stable curated packages (primary)
• [personal] — Additional tools & utilities
• [acur] — AcreetionOS Community User Repository (AUR-compatible)
• Standard Arch Linux repositories are explicitly not included

🤖 Quarterly CI/CD pipeline

GitHub Actions workflow builds ISOs automatically:

• Cron: 1st of January, April, July, October at 06:00 UTC
• Manual trigger available for urgent releases
• Builds in archlinux container, uploads artifact, creates GitHub Release
• 120-minute timeout for full ISO build

⚠️ Clear reboot notices

acreetionos-strip-gui now shows a prominent warning before reboot:

• Box-drawn banner: "GUI stripped successfully"
• "THE SYSTEM IS GOING TO REBOOT" in bold
• 10-second countdown with per-second feedback
• Instructions for after reboot and how to reinstall GUI

[spivanatalie64]

Update v5: Server Toolbox — 90+ tools across 15 categories

Added acreetionos-toolbox — a categorized TUI launcher for every server maintainer's dream toolkit. Browse categories, read descriptions, and launch tools directly.

Categories & Tools

Category	Tools
Web Admin	Cockpit, Cockpit Machines, Cockpit Podman, Cockpit Storage
Monitoring	htop, btop, glances, atop, bottom, procs, bpytop, nvtop, iotop, netdata
Storage	ncdu, gdu, duf, dust, dua-cli, testdisk, ddrescue, fsarchiver, timeshift
Network	nmap, tcpdump, wireshark-cli, ngrep, iperf3, nethogs, bmon, vnstat, mtr, dog, arp-scan, socat
Files	mc (Midnight Commander), ranger, lf, nnn
Modern CLI	bat, ripgrep, fd, jq, yq, delta, sd, fzf, zoxide, micro, tldr, tealdeer, choose, hexyl, hyperfine
Logs	lnav, journalctl
Containers	lazydocker, ctop, docker, docker-compose
Database	mycli, pgcli, usql, mariadb, postgresql, redis
Security	lynis, rkhunter, chkrootkit, fail2ban, clamav, nftables
Dev	git, gh, glab, httpie, curlie, make, cmake
Remote	ssh, mosh, byobu, tmux, screen
Backup	restic, borg, timeshift
Misc	asciinema, entr, parallel, units, bandwhich, pv, zstd

Run it with:

sudo acreetionos-toolbox

Welcome terminal and docs updated to reference the toolbox as the primary entry point.

[spivanatalie64]

Update v6: IAM-like User Model — Purpose-Built Accounts

Replaced the sudo-everything pattern with dedicated user accounts that have
group-based permissions. Like AWS IAM roles — you log in AS the role,
no elevation needed.

Users created during install

User	Groups	What they can do without sudo
admin	wheel, docker, libvirt, journal	full admin (sudo requires password)
dbadmin	postgres, mysql	mycli, pgcli, psql, mysql — DB operations
webadmin	http	systemctl nginx/apache, certbot
ops	docker, libvirt, journal	docker, lazydocker, ctop, virsh, logs
backup	storage	restic, borg, timeshift, ddrescue
root	(superuser)	everything (use sparingly)

Sudoers rules (group-based, passwordless for specific tools)

• %docker → NOPASSWD: docker, docker-compose, ctop, lazydocker
• %libvirt → NOPASSWD: virsh, virt-manager, qemu-system-*
• %http → NOPASSWD: systemctl for nginx/apache, certbot
• %storage → NOPASSWD: restic, borg, timeshift, ddrescue, fsarchiver
• %systemd-journal → NOPASSWD: journalctl
• %wheel → full sudo (password required, 30min timeout)

Updated everywhere

• Toolbox shows current user + groups + user recommendations
• Maintain script checks wheel group membership
• Welcome terminal explains the user model
• TOOLS.md has full reference table
• Credentials display shows all 6 users with their groups

Switch users

su - admin      # full administration
su - dbadmin    # database work
su - webadmin   # web servers
su - ops        # containers + monitoring
su - backup     # backup tasks