crates/nornir-build-thing/src/kconfig/nuked.config
# nordisk NUKED overlay — merged LAST over the `slim` set (tinyconfig + the
# measured boot contract). What a tunnr-class appliance is, stated as absence.
#
# The machine this describes has: a serial console, virtio-net, TUN (userspace
# WireGuard — the boringtun ruling, `CONFIG_WIREGUARD` is deliberately absent
# everywhere), virtio-blk, and a DHCP client in userspace. Nothing else.
#
# Every veto below is a `# CONFIG_X is not set` line, so the canary loop catches
# it CREEPING BACK IN (`KERNEL-CONFIG-REFUSED: … crept back in`) — a nuked
# kernel that quietly regrew a framebuffer is not a nuked kernel.
#
# NOTE, honestly: this overlay is the DECLARED shape. It is not measured until a
# nuked kernel has been built and probe-booted end to end (design §7 step 3/4);
# until then treat a build of it as an experiment, not a shipping appliance.
# ── graphics: an appliance has a serial console — and a VGA TEXT console ────
# The install record's console lesson is SERIAL; the framebuffer (DRM/FB) and the
# boot logo exist only to draw a login nobody types into, and stay vetoed. The
# virtual-terminal layer + the VGA text console are NOT vetoed any more, MEASURED
# 2026-08-28 on UpCloud: a cloud VM has no serial line an operator can read —
# the ONLY console is VNC — and the installed appliance stopped somewhere after
# `korp-boot-bios: handing over to the kernel` with nothing on screen, because
# this file had taken the kernel's text console away. VT + VGA_CONSOLE are
# ~30 KB and are now part of the boot contract (base.config), so the printk
# stream and gunnar's own lines reach the screen a cloud operator actually has.
# Since 2026-10-30 (owner, option A) the appliance-boot CONTRACT carries the same
# three lines for every consumer (kernel_requires.rs). A k8s node's ROW lifts the
# contract's FB (with FB_EFI and FRAMEBUFFER_CONSOLE) so its console shows under
# UEFI; that node rides the `slim` preset, so this preset veto still stands for
# every nuked kernel. DRM and LOGO are never lifted.
# CONFIG_DRM is not set
# CONFIG_FB is not set
# CONFIG_LOGO is not set
# ── sound: there is no speaker on a virtio machine ─────────────────────────
# CONFIG_SOUND is not set
# CONFIG_SND is not set
# ── input: the VNC keyboard reaches the VGA console (CONFIG_VT selects INPUT —
# MEASURED 2026-08-28: keeping the INPUT veto made the canary refuse VT=y); the
# keyboard/mouse DRIVERS stay out, the input core comes with the console ──
# CONFIG_INPUT_KEYBOARD is not set
# CONFIG_INPUT_MOUSE is not set
# ── USB: no port is plugged into a KVM guest ───────────────────────────────
# CONFIG_USB_SUPPORT is not set
# ── wireless: the data plane is a userspace WireGuard tunnel over virtio-net ─
# CONFIG_WLAN is not set
# CONFIG_BT is not set
# ── legacy storage: the disk is `vda`, virtio. ─────────────────────────────
# The preset vetoes ATA/SCSI, so a CONSUMER requirement for them is refused
# against `nuked`. A DONOR may still carry the cdrom stack in its own
# kconfig_fragment, which is merged after this file: tunnr's appliance donors
# do (ATA ATA_SFF ATA_BMDMA ATA_PIIX SATA_AHCI SCSI BLK_DEV_SR, tunnr 3f7c2ff),
# so the installer medium is read as `sr0`, not only from a virtio copy (`vdb`).
# CONFIG_ATA is not set
# CONFIG_SCSI is not set
# ── IPv6: NOT in the appliance kernel (the user's law, stated twice) ────────
# MEASURED 2026-08-29 on the UpCloud VGA console of the installed gunnar disk:
# `NET: Registered PF_INET6 protocol family`, `Segment Routing with IPv6`,
# `IOAM`, `sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver` — IPV6 defaults
# to y the moment INET=y (deps-tinyconfig.config) and nothing had vetoed it.
# The appliance speaks IPv4 (DHCPv4 in userspace, the WireGuard tunnel over
# virtio-net); the v6 stack, its segment routing, IOAM and the sit/tunnel drivers
# are code nobody drives. Vetoed by name so the canary refuses a creep-back; the
# children are named too so a fragment merged later cannot re-enable one alone.
# CONFIG_IPV6 is not set
# CONFIG_IPV6_SIT is not set
# CONFIG_IPV6_TUNNEL is not set
# CONFIG_IPV6_SEG6_LWTUNNEL is not set
# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
# CONFIG_INET6_AH is not set
# CONFIG_INET6_ESP is not set
# ── ONE user, and that user is root (lane AE, 2026-08-30) ──────────────────
# `CONFIG_MULTIUSER=n` makes every process run as UID 0/GID 0 with all
# capabilities and COMPILES OUT the setuid/setgid/capset family (`kernel/sys.c`,
# `kernel/capability.c`). That is exactly the appliance: korp-start is PID 1 as
# root, it fexecve()s the verified payload as root, and there is no second user
# to drop to — nothing in korp-start, korp-installer or gunnar-server calls one
# of those syscalls. MEASURED on this kernel's own built .config before the
# veto: the only two subsystems in 6.12.104 that `depends on MULTIUSER` and that
# an appliance could plausibly want — `CONFIG_NAMESPACES` and `CONFIG_SECURITY`
# — were ALREADY `# is not set`, so this takes nothing derived away with it.
# It replaces the `CONFIG_MULTIUSER=y` that sat in deps-tinyconfig.config as a
# closure parent nothing had ever asked for.
#
# MOVED to the appliance-boot CONTRACT (lane HOLGER-MEDIA, 2026-10-23): the
# directive itself is no longer in this preset. Single-user is a property of
# the CONSUMER's payload, not of the kernel kind: Holger's main and twin run
# every scan in a container (a user namespace, cgroups), which `depends on
# MULTIUSER`, while Gunnar's boxes keep one user. So the contract carries
# `# CONFIG_MULTIUSER is not set` as every consumer's default (the merged
# fragment is unchanged for them), and a consumer whose own rows require
# `CONFIG_MULTIUSER=y` lifts that one row BY NAME (`requires.rs`,
# `ApplianceBootContract`). A preset veto could not be lifted at all: "a
# requirement is never merged over a veto".
# ── kernel WireGuard stays absent BY NAME, on purpose ──────────────────────
# Measured (.nornir/wg-appliance.md, the OS-less ruling): userspace WG needs
# ZERO modules and stops caring which kernel was packed. A kernel WG module here
# would be a second data plane nobody drives.
# CONFIG_WIREGUARD is not set