tilde.club/docs/current-system.md

Current system

This records the operator's inventories and selected configs collected on October 22, 2026. It describes the existing shell host. The installation guide and examples make separate choices for a new host; they do not silently claim those choices are already deployed here.

Machine

• Fedora Linux 43, x86-64, 8 logical CPUs, about 29 GiB usable RAM.
• About 1 TiB on the root XFS filesystem; /home and /var are on that mount.
• Root mount options include user and group quotas.
• SELinux disabled on the recorded host; CSF is the active firewall manager.

These are the resources on the existing machine, not minimum requirements. Exact user inventories, addresses, private keys, credentials, and raw config dumps are deliberately not part of this public record.

Services

Purpose	Confirmed configuration
Shell access	OpenSSH main service; separate restricted legacy service on 2222.
Authentication	Key login, or PAM password/TOTP path; the collected main config does not require both paths together.
Onboarding	Local makeuser, Ruby firstlogin, skeleton marker, Google Authenticator wrapper.
Web	nginx, root /usr/share/nginx/html, /~USER/ and /u/USER/ publishing.
PHP	Shared php-user:club pool for user pages; nginx:nginx pool for main site applications.
CGI	fcgiwrap instance with a local override running as cgiwrap.
Mail	Postfix 3.10.14, Dovecot/Pigeonhole 2.4.5, Maildir at ~/.mail.
Mail filtering	OpenDKIM and Rspamd on configured local milter endpoints; pyspf-milter also running.
Webmail	nginx vhost points to SnappyMail.
Usenet	INN 2.7.3 running on the shell host.
Gopher	Fossor socket activation; dedicated gopher service identity.
Gemini	gemserv, running from /srv/gemini/gemserv, as gemini.
Finger	Local Python fingerd.py, service identity efingerd.
IRC support	oidentd and ZNC running. Network-server location/daemon was not established by this collection.
Database/cache	MariaDB and Valkey running.
Accounting	psacct active.
Certificates	Custom twice-daily standalone Certbot timer that stops/starts nginx.
Backups	Root cron at 03:00, explicit /usr/bin/borgmatic 2.1.9 with Borg 1.4.5.

The compiled services and private application integration code need their own version/update records. Installed RPMs are not an installation manifest: the host has accumulated optional tools and old builds over time.

Details worth keeping straight

/usr/local/bin/borgmatic is a different, older installation (1.5.21). Manual invocation through PATH is not necessarily the program run by the backup job.

/home is not an independent mount here. Quota commands need the containing mountpoint /; the collector's /home quota query printed an error.

The per-user FPM pool generator exists, but the collected main nginx route uses the shared socket. A generated per-user pool alone does not route a member's requests to it.

The supplied main SSH config does not include sshd_config.d; collecting those files does not establish that the daemon reads them. The effective global AuthenticationMethods was any. The SSH chapter explains the key and PAM paths, with an explicit MFA example for a new installation.

The aggregate user.slice reported no finite memory or task limit. Individual user slices and PAM limits were not comprehensively collected, so no complete production resource policy is claimed here.

The Gopher service reads options from /etc/default/fossor and /etc/sysconfig/fossor; those files were not supplied. Gemini's service uses /srv/gemini/gemserv/config.toml, which was also not supplied. The publishing chapter identifies the runtime layout and points to version-matched upstream configuration rather than inventing live option values.

The backup repository, complete source list, retention, and restore history were not supplied. The backup chapter's example is explicitly separate from the confirmed scheduler and executable versions.