Save and apply

Every line of drift has two possible fixes: change the repo to match the machine, or change the machine to match the repo. admin save and admin apply are the two.

Change the repo: admin save

When the drift is something you meant, record it:

Run this on the new machine:
admin save
(stdout)
Wrote /home/admin/arch/aconfmgr/99-unsorted.sh. Move what you meant into a numbered
file, delete the rest (and 'admin apply' to undo it), then commit.

99-unsorted.sh holds the same lines admin diff printed. Files it copied – the sysctl file, here – are under aconfmgr/files/. It is git-ignored on purpose: it is a to-do list, not configuration, and it should not survive the review.

Review and commit

Sort each line into the place it belongs. In this repo, that is usually not another aconfmgr file, but the plain file aconfmgr reads:

Line in 99-unsorted.sh Where it goes
AddPackage foo foo on a line of packages.txt
CopyFile /etc/... the file, moved from aconfmgr/files/etc/... to etc/...
CreateLink /etc/systemd/... the unit in units.txt
anything that is state an IgnorePath in aconfmgr/90-ignore.sh
anything you did not mean nowhere: delete it, and admin apply will undo it on the machine

For the example above:

Run this on the new machine:
cd ~/arch
echo htop >> packages.txt
mkdir -p etc/sysctl.d
mv aconfmgr/files/etc/sysctl.d/99-swappiness.conf etc/sysctl.d/
rm -r aconfmgr/99-unsorted.sh aconfmgr/files
admin diff
git add -A
git commit -m "htop; lower swappiness"

The second admin diff is the check that the sorting was right: it should say there is no drift. save writes and never commits, and that review is the whole point – it is the moment the machine’s history gets a reason attached to it.

Change the machine: admin apply

Edit the repo, commit, and apply:

Run this on the new machine:
echo ripgrep >> ~/arch/packages.txt
git -C ~/arch commit -am "Add ripgrep"
admin apply

aconfmgr shows each change before it makes it and asks. It installs what is missing, puts files back the way the repo has them, and enables units.

apply removes things too

apply makes the machine match the repo exactly. A package installed by hand and not in packages.txt is uninstalled (aconfmgr marks it as a dependency, then removes orphans); a file that the repo does not describe and 90-ignore.sh does not ignore is deleted. That is what makes it an undo button, and also why you should run admin diff first and admin save anything you want to keep. Read what it proposes before answering yes, and do not get into the habit of admin apply --yes.

This is also how a second machine picks up a change: pull the repo there and apply.

Packages from the AUR

The AUR is not a repository of packages but of build recipes, contributed by users and reviewed by nobody. Nothing in packages.txt can come from it, because pacstrap and pacman only know the official repositories. aconfmgr calls anything pacman did not install from a repository a foreign package, and describes it with a --foreign flag:

Edit this file: ~/arch/aconfmgr/50-packages.sh
AddPackage --foreign yay          # Yet another yogurt. Pacman wrapper and AUR helper written in go.
AddPackage --foreign solo2-cli    # A CLI for SoloKeys Solo 2 devices

You rarely type those lines yourself. Install something from the AUR by hand and admin save writes them for you, comment and all, exactly as it does for a package from the repos – which is the point: a foreign package that is not described is drift, and admin apply would remove it.

What makes this work without any setting of your own is how aconfmgr finds a builder. It looks for aurman, pacaur, yaourt, yay, paru, aura and then makepkg, in that order, and uses the first one on PATH; --aur-helper HELPER overrides the choice. And if one of those names is itself in the list of foreign packages it is about to install, it builds that one first, with makepkg, and then uses it for the rest. So a single AddPackage --foreign yay bootstraps itself on a machine that has never had an AUR helper.

base-devel is not installed

makepkg is what every one of those helpers ultimately runs, and it needs the toolchain in base-devel – which setup does not install, because a machine that builds nothing does not need a compiler. Add it before the first foreign package, or the build fails on a missing fakeroot:

echo base-devel >> ~/arch/packages.txt

makepkg also refuses to run as root, which is why admin apply runs aconfmgr as admin and lets it call sudo for the parts that need it.

admin upgrade does not upgrade them

admin upgrade runs pacman -Syu, which has never heard of the AUR, and then admin apply, which installs foreign packages that are missing but does not rebuild ones that are merely out of date. So foreign packages stay at whatever version you built, including when that version grows a security hole. Upgrading them is a separate habit – yay -Sua – and the honest reason to keep the --foreign list short.

Untested

No machine built by this book has installed an AUR package yet. The behaviour above is read from the pinned aconfmgr (96ab414) rather than observed.

// settings
theme:
fx: