Single SSH session takes a fresh Arch box to a locked-down server running
native OMATERM (28allday/omaterm@native-frozen, fetched read-only at runtime).
- Phase A: hardening (deploy user, key-only SSH, ufw 22+tailscale0, fail2ban,
weekly updates, swap, journal cap) — proven on tyler + durden 2026-06-06
- Phase B: hands off to install-native.sh as the deploy user with a real TTY;
recovery net resumes first-run setup and lands in a shell if the chain
exits early instead of dropping the SSH session
- Every answer asked once: machine name = hostname + tailnet name + ssh
alias; git identity pre-seeds ~/.gitconfig so omaterm setup skips it;
answers survive the kernel-upgrade reboot
- Kernel-upgrade guard offers the reboot in-script with exact resume command
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
