v0.0.2 - spinning out n_signer

iso/config/hooks/live/0020-enable-services.hook.chroot

@@ -1,26 +1,35 @@
 #!/bin/sh
-# Enable n-OS-tr services so they start automatically on boot.
-set -e
+# Configure boot-time enable/disable posture for n-OS-tr services.
+set -eu
 
 # Disable the Debian default site so it doesn't conflict with ours.
 rm -f /etc/nginx/sites-enabled/default
 
-# Enable our site.
+# Enable our site symlink only. Runtime nginx startup is user-selected in TUI.
 ln -sf /etc/nginx/sites-available/n-os-tr.conf /etc/nginx/sites-enabled/n-os-tr.conf
 
-systemctl enable nginx.service
-
-# Slice A
-systemctl enable ginxsom.service
-systemctl enable n-os-tr-firstboot.service
-
-# Slice B
-systemctl enable fips.service || true
-systemctl enable fips-dns.service || true
-
-# Slice C
-systemctl enable c-relay.service
-
-# TUI on tty1
+# TTY handoff: identity TUI owns tty1 before getty.
 systemctl disable getty@tty1.service || true
+
+# Always-on boot pipeline.
+systemctl enable n-os-tr-firstboot.service
+systemctl enable nostr-id.service || true
 systemctl enable nostr-id-tui.service
+
+# Explicitly keep optional services disabled at boot.
+for unit in \
+    c-relay.service \
+    ginxsom.service \
+    fips.service \
+    fips-dns.service \
+    nginx.service \
+    nostr-config-loader.service \
+    nostr-config-writer.service \
+    ssh.service \
+    tor.service
+ do
+    systemctl disable "$unit" 2>/dev/null || true
+ done
+
+# Apply preset policy for any additional units.
+systemctl preset-all --preset-mode=enable-only 2>/dev/null || true

iso/config/includes.chroot/etc/n-os-tr/services.conf

@@ -0,0 +1,9 @@
+# key\tunit\tlabel\tdefault\tdeps
+r	c-relay.service	c-relay	off	nginx.service
+g	ginxsom.service	ginxsom	off	nginx.service
+f	fips.service	fips	off	-
+n	nginx.service	nginx	off	-
+l	nostr-config-loader.service	config-loader	off	-
+w	nostr-config-writer.service	config-writer	off	nostr-config-loader.service
+s	ssh.service	ssh	off	-
+t	tor.service	tor	off	-

iso/config/includes.chroot/etc/systemd/system-preset/50-n-os-tr.preset

@@ -0,0 +1,16 @@
+# n-OS-tr service posture: only identity + firstboot + TUI start automatically.
+# Optional services are loaded/installed but disabled by default.
+
+enable n-os-tr-firstboot.service
+enable nostr-id.service
+enable nostr-id-tui.service
+
+disable c-relay.service
+disable ginxsom.service
+disable fips.service
+disable fips-dns.service
+disable nginx.service
+disable nostr-config-loader.service
+disable nostr-config-writer.service
+disable ssh.service
+disable tor.service

iso/config/package-lists/base.list.chroot

@@ -15,3 +15,6 @@ nftables
 
 # TUI runtime dependency
 libncursesw6
+
+# Service-menu optional stack
+tor