update

9 files changed, 103 insertions, 51 deletions

diff --git a/etc/.cfgl/config b/etc/.cfgl/config
index 905f17be..ca4ebfad 100644
--- a/etc/.cfgl/config
+++ b/etc/.cfgl/config
@@ -11,12 +11,6 @@
 	fetch = +refs/heads/*:refs/remotes/origin/*
 [commit]
 	gpgsign = false
-[branch "master"]
-	remote = origin
-	merge = refs/heads/master
-[remote "usb"]
-	url = /run/media/xyz/Ventoy/git_bare_repos/config_local_arch
-	fetch = +refs/heads/*:refs/remotes/usb/*
 [branch "studio"]
 	remote = origin
 	merge = refs/heads/studio
diff --git a/etc/locale.conf b/etc/locale.conf
index 6737e875..01ec548f 100644
--- a/etc/locale.conf
+++ b/etc/locale.conf
@@ -1 +1 @@
-LANG=en_US.utf8
+LANG=en_US.UTF-8
diff --git a/etc/locale.gen b/etc/locale.gen
index a094efe7..a4e3c9f3 100644
--- a/etc/locale.gen
+++ b/etc/locale.gen
@@ -9,17 +9,11 @@
 #  where <locale> is one of the locales given in /usr/share/i18n/locales
 #  and <charset> is one of the character sets listed in /usr/share/i18n/charmaps
 #
-#  Examples:
-#  en_US ISO-8859-1
-#  en_US.UTF-8 UTF-8
-#  de_DE ISO-8859-1
-#  de_DE@euro ISO-8859-15
-#
 #  The locale-gen command will generate all the locales,
 #  placing them in /usr/lib/locale.
 #
-#  A list of supported locales is included in this file.
-#  Uncomment the ones you need.
+#  A list of supported locales is given in /usr/share/i18n/SUPPORTED
+#  and is included in this file. Uncomment the needed locales below.
 #
 #aa_DJ.UTF-8 UTF-8  
 #aa_DJ ISO-8859-1  
@@ -99,7 +93,6 @@
 #bs_BA.UTF-8 UTF-8  
 #bs_BA ISO-8859-2  
 #byn_ER UTF-8  
-C.UTF-8 UTF-8
 #ca_AD.UTF-8 UTF-8  
 #ca_AD ISO-8859-15  
 #ca_ES.UTF-8 UTF-8  
@@ -398,6 +391,7 @@ en_US ISO-8859-1
 #pt_PT@euro ISO-8859-15  
 #quz_PE UTF-8  
 #raj_IN UTF-8  
+#rif_MA UTF-8  
 #ro_RO.UTF-8 UTF-8  
 #ro_RO ISO-8859-2  
 #ru_RU.KOI8-R KOI8-R  
@@ -446,6 +440,7 @@ en_US ISO-8859-1
 #sv_SE ISO-8859-1  
 #sw_KE UTF-8  
 #sw_TZ UTF-8  
+#syr UTF-8  
 #szl_PL UTF-8  
 #ta_IN UTF-8  
 #ta_LK UTF-8  
diff --git a/etc/nftables.conf b/etc/nftables.conf
index 47605bfb..999b91ac 100644
--- a/etc/nftables.conf
+++ b/etc/nftables.conf
@@ -6,8 +6,7 @@
 # some codes from https://wiki.archlinux.org/title/Nftables
 
 # needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf`
-table inet my_table
-delete table inet my_table
+flush ruleset
 
 table inet my_table {
 
@@ -22,9 +21,8 @@ table inet my_table {
 		meta l4proto ipv6-icmp accept
 
 		tcp dport ssh accept
-		#tcp dport searx accept
-		tcp dport qrcp accept
 		udp dport mdns accept
+		#tcp dport iperf3 accept
 
 		pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
 		counter comment "count any other traffic"
diff --git a/etc/pacman.conf b/etc/pacman.conf
index 49ff54d0..293be916 100644
--- a/etc/pacman.conf
+++ b/etc/pacman.conf
@@ -34,7 +34,7 @@ Color
 #NoProgressBar
 CheckSpace
 #VerbosePkgLists
-ParallelDownloads = 5
+ParallelDownloads = 8
 
 # By default, pacman accepts packages signed by keys that its local keyring
 # trusts (see pacman-key and its man page), as well as unsigned packages.
@@ -69,11 +69,11 @@ LocalFileSigLevel = Optional
 # repo name header and Include lines. You can add preferred servers immediately
 # after the header, and they will be used before the default mirrors.
 
-[fly]
-Server = file:///home/xyz/programs/repos/fly/$arch
+#[fly]
+#Server = file:///home/xyz/programs/repos/fly/$arch
 
-#[fly-any]
-#Server = file:///home/xyz/programs/repos/fly/any
+[fly-any]
+Server = file:///home/xyz/programs/repos/fly/any
 
 #[core-testing]
 #Include = /etc/pacman.d/mirrorlist
diff --git a/etc/resolv.conf b/etc/resolv.conf
new file mode 120000
index 00000000..36396629
--- /dev/null
+++ b/etc/resolv.conf
@@ -0,0 +1 @@
+/run/systemd/resolve/stub-resolv.conf
\ No newline at end of file
diff --git a/etc/services b/etc/services
index 4bbdc73e..32ae60c0 100644
--- a/etc/services
+++ b/etc/services
@@ -1366,6 +1366,8 @@ apex-mesh         912/tcp
 apex-mesh         912/udp
 apex-edge         913/tcp
 apex-edge         913/udp
+rift-lies         914/udp
+rift-ties         915/udp
 rndc              953/tcp
 ftps-data         989/tcp
 ftps-data         989/udp
@@ -3848,6 +3850,8 @@ simple-tx-rx     2257/tcp
 simple-tx-rx     2257/udp
 rcts             2258/tcp
 rcts             2258/udp
+bid-serv         2259/tcp
+bid-serv         2259/udp
 apc-2260         2260/tcp
 apc-2260         2260/udp
 comotionmaster   2261/tcp
@@ -4066,6 +4070,8 @@ service-ctrl     2367/tcp
 service-ctrl     2367/udp
 opentable        2368/tcp
 opentable        2368/udp
+bif-p2p          2369/tcp
+bif-p2p          2369/udp
 l3-hbmon         2370/tcp
 l3-hbmon         2370/udp
 rda              2371/tcp
@@ -5901,6 +5907,8 @@ deskview         3298/udp
 pdrncs           3299/tcp
 pdrncs           3299/udp
 ceph             3300/tcp
+tarantool        3301/tcp
+tarantool        3301/udp
 mcs-fastmail     3302/tcp
 mcs-fastmail     3302/udp
 opsession-clnt   3303/tcp
@@ -7217,8 +7225,8 @@ iconp            3972/tcp
 iconp            3972/udp
 progistics       3973/tcp
 progistics       3973/udp
-citysearch       3974/tcp
-citysearch       3974/udp
+xk22             3974/tcp
+xk22             3974/udp
 airshot          3975/tcp
 airshot          3975/udp
 opswagent        3976/tcp
@@ -7677,7 +7685,7 @@ trim-event       4322/tcp
 trim-event       4322/udp
 trim-ice         4323/tcp
 trim-ice         4323/udp
-geognosisman     4325/tcp
+geognosisadmin   4325/tcp
 geognosisman     4325/udp
 geognosis        4326/tcp
 geognosis        4326/udp
@@ -8084,6 +8092,8 @@ xmcp             4788/tcp
 vxlan            4789/udp
 vxlan-gpe        4790/udp
 roce             4791/udp
+unified-bus      4792/tcp
+unified-bus      4792/udp
 iims             4800/tcp
 iims             4800/udp
 iwec             4801/tcp
@@ -8450,6 +8460,8 @@ padl2sim         5236/tcp
 padl2sim         5236/udp
 mnet-discovery   5237/tcp
 mnet-discovery   5237/udp
+attune           5242/tcp
+xycstatus        5243/tcp
 downtools        5245/tcp
 downtools-disc   5245/udp
 capwap-control   5246/udp
@@ -8890,6 +8902,7 @@ icmpd            5813/tcp
 icmpd            5813/udp
 spt-automation   5814/tcp
 spt-automation   5814/udp
+autopassdaemon   5820/tcp
 shiprush-d-ch    5841/tcp
 reversion        5842/tcp
 wherehoo         5859/tcp
@@ -8901,17 +8914,38 @@ diameters        5868/sctp
 jute             5883/tcp
 rfb              5900/tcp
 rfb              5900/udp
-cm               5910/tcp
-cm               5910/udp
+ff-ice           5903/tcp
+ff-ice           5903/udp
+ff-ice           5903/sctp
+ag-swim          5904/tcp
+ag-swim          5904/udp
+ag-swim          5904/sctp
+asmgcs           5905/tcp
+asmgcs           5905/udp
+asmgcs           5905/sctp
+rpas-c2          5906/tcp
+rpas-c2          5906/udp
+rpas-c2          5906/sctp
+dsd              5907/tcp
+dsd              5907/udp
+dsd              5907/sctp
+ipsma            5908/tcp
+ipsma            5908/udp
+ipsma            5908/sctp
+agma             5909/tcp
+agma             5909/udp
+agma             5909/sctp
+ats-atn          5910/tcp
+ats-atn          5910/udp
 cm               5910/sctp
-cpdlc            5911/tcp
-cpdlc            5911/udp
+ats-acars        5911/tcp
+ats-acars        5911/udp
 cpdlc            5911/sctp
-fis              5912/tcp
-fis              5912/udp
+ais-met          5912/tcp
+ais-met          5912/udp
 fis              5912/sctp
-ads-c            5913/tcp
-ads-c            5913/udp
+aoc-acars        5913/tcp
+aoc-acars        5913/udp
 ads-c            5913/sctp
 indy             5963/tcp
 indy             5963/udp
@@ -9365,6 +9399,7 @@ acmsoda          6969/tcp
 acmsoda          6969/udp
 conductor        6970/tcp
 conductor-mpx    6970/sctp
+qolyester        6980/udp
 MobilitySrv      6997/tcp
 MobilitySrv      6997/udp
 iatp-highpri     6998/tcp
@@ -9640,12 +9675,13 @@ imqbrokerd       7676/tcp
 imqbrokerd       7676/udp
 sun-user-https   7677/tcp
 sun-user-https   7677/udp
-pando-pub        7680/tcp
-pando-pub        7680/udp
+ms-do            7680/tcp
+ms-do            7680/udp
 dmt              7683/tcp
 bolt             7687/tcp
 collaber         7689/tcp
 collaber         7689/udp
+sovd             7690/tcp
 klio             7697/tcp
 klio             7697/udp
 em7-secom        7700/tcp
@@ -9822,6 +9858,7 @@ senomix07        8058/udp
 senomix08        8059/tcp
 senomix08        8059/udp
 aero             8060/udp
+nikatron-dev     8061/tcp
 toad-bi-appsrvr  8066/tcp
 infi-async       8067/tcp
 ucs-isc          8070/tcp
@@ -9923,8 +9960,8 @@ synapse-nhttps   8243/tcp
 synapse-nhttps   8243/udp
 espeasy-p2p      8266/udp
 robot-remote     8270/tcp
-pando-sec        8276/tcp
-pando-sec        8276/udp
+ms-mcc           8276/tcp
+ms-mcc           8276/udp
 synapse-nhttp    8280/tcp
 synapse-nhttp    8280/udp
 libelle          8282/tcp
@@ -9977,6 +10014,7 @@ espeech-rtp      8417/tcp
 espeech-rtp      8417/udp
 aritts           8423/tcp
 pgbackrest       8432/tcp
+aws-as2          8433/udp
 cybro-a-bus      8442/tcp
 cybro-a-bus      8442/udp
 pcsync-https     8443/tcp
@@ -9985,6 +10023,7 @@ pcsync-http      8444/tcp
 pcsync-http      8444/udp
 copy             8445/tcp
 copy-disc        8445/udp
+matrix-fed       8448/tcp
 npmp             8450/tcp
 npmp             8450/udp
 nexentamv        8457/tcp
@@ -10289,6 +10328,7 @@ secure-ts        9318/udp
 guibase          9321/tcp
 guibase          9321/udp
 gnmi-gnoi        9339/tcp
+gribi            9340/tcp
 mpidcmgr         9343/tcp
 mpidcmgr         9343/udp
 mphlpdmc         9344/tcp
@@ -10675,6 +10715,7 @@ warehouse       12322/tcp
 warehouse       12322/udp
 italk           12345/tcp
 italk           12345/udp
+carb-repl-ctrl  12546/tcp
 tsaf            12753/tcp
 tsaf            12753/udp
 netperf         12865/tcp
@@ -10719,6 +10760,7 @@ dsmcc-download  13821/udp
 dsmcc-ccp       13822/tcp
 dsmcc-ccp       13822/udp
 bmdss           13823/tcp
+a-trust-rpc     13832/tcp
 ucontrol        13894/tcp
 ucontrol        13894/udp
 dta-systems     13929/tcp
@@ -10817,6 +10859,7 @@ amt-redir-tls   16995/tcp
 amt-redir-tls   16995/udp
 isode-dua       17007/tcp
 isode-dua       17007/udp
+ncpu            17010/tcp
 vestasdlp       17184/tcp
 soundsvirtual   17185/tcp
 soundsvirtual   17185/udp
@@ -10920,8 +10963,10 @@ faircom-db      19790/tcp
 iec-104-sec     19998/tcp
 dnp-sec         19999/tcp
 dnp-sec         19999/udp
+dnp-sec         19999/sctp
 dnp             20000/tcp
 dnp             20000/udp
+dnp             20000/sctp
 microsan        20001/tcp
 microsan        20001/udp
 commtact-http   20002/tcp
@@ -10970,6 +11015,7 @@ vofr-gateway    21590/tcp
 vofr-gateway    21590/udp
 tvpm            21800/tcp
 tvpm            21800/udp
+sal             21801/tcp
 webphone        21845/tcp
 webphone        21845/udp
 netspeak-is     21846/tcp
@@ -11333,6 +11379,7 @@ ng-control      38412/sctp
 xn-control      38422/sctp
 e1-interface    38462/sctp
 f1-control      38472/sctp
+psqlmws         38638/tcp
 sruth           38800/tcp
 secrmmsafecopya 38865/tcp
 vroa            39063/tcp
@@ -11366,6 +11413,7 @@ candrp          42509/tcp
 candrp          42509/udp
 caerpc          42510/tcp
 caerpc          42510/udp
+curiosity       42999/tcp
 recvr-rc        43000/tcp
 recvr-rc-disc   43000/udp
 reachout        43188/tcp
@@ -11461,6 +11509,4 @@ nusrp           49001/tcp
 nusdp-disc      49001/udp
 inspider        49150/tcp
 # my services
-jackett         9117/tcp
-searx           49152/tcp
-qrcp            49153/tcp
+iperf3          53497/tcp
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
index ad7e1f20..1438778c 100644
--- a/etc/ssh/sshd_config
+++ b/etc/ssh/sshd_config
@@ -1,4 +1,15 @@
-#	$OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+# `man sshd_config` says "for each keyword, the first obtained value will be used". So I decided to put my configs before all others to override them all.
+# Based on manpage, setting PasswordAuthentication no, and Arch Linux default KbdInteractiveAuthentication no, with other defaults seems already equivalent to AuthenticationMethods publickey, but I still put it here for redundancy.
+# https://wiki.archlinux.org/title/OpenSSH#Force_public_key_authentication
+AuthenticationMethods publickey
+PermitRootLogin no
+PasswordAuthentication no
+# KbdInteractiveAuthentication no and UsePAM yes are Arch Linux default settings see /etc/ssh/sshd_config.d/00-archlinux.conf, I need these configs, I put them here just in case Arch Linux change the defaults in the future.
+KbdInteractiveAuthentication no
+UsePAM yes
+
+# Include drop-in configurations
+Include /etc/ssh/sshd_config.d/*.conf
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -29,7 +40,7 @@
 # Authentication:
 
 #LoginGraceTime 2m
-PermitRootLogin no
+#PermitRootLogin prohibit-password
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -54,11 +65,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-PasswordAuthentication no
+#PasswordAuthentication yes
 #PermitEmptyPasswords no
 
 # Change to no to disable s/key passwords
-KbdInteractiveAuthentication no
+#KbdInteractiveAuthentication yes
 
 # Kerberos options
 #KerberosAuthentication no
@@ -75,11 +86,11 @@ KbdInteractiveAuthentication no
 # be allowed through the KbdInteractiveAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via KbdInteractiveAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
+# the setting of "PermitRootLogin prohibit-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and KbdInteractiveAuthentication to 'no'.
-UsePAM yes
+#UsePAM no
 
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
@@ -88,7 +99,7 @@ UsePAM yes
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
-PrintMotd no # pam does that
+#PrintMotd yes
 #PrintLastLog yes
 #TCPKeepAlive yes
 #PermitUserEnvironment no
diff --git a/etc/sudoers b/etc/sudoers
index 65cd7ca1..cfd22989 100644
--- a/etc/sudoers
+++ b/etc/sudoers
@@ -59,15 +59,22 @@
 ## Uncomment to use a hard-coded PATH instead of the user's to find commands
 # Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 ##
+## Uncomment to restore the historic behavior where a command is run in
+## the user's own terminal.
+# Defaults !use_pty
+##
 ## Uncomment to send mail if the user does not enter the correct password.
 # Defaults mail_badpass
 ##
 ## Uncomment to enable logging of a command's output, except for
 ## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
+## Sudo will create up to 2,176,782,336 I/O logs before recycling them.
+## Set maxseq to a smaller number if you don't have unlimited disk space.
 # Defaults log_output
 # Defaults!/usr/bin/sudoreplay !log_output
 # Defaults!/usr/local/bin/sudoreplay !log_output
 # Defaults!REBOOT !log_output
+# Defaults maxseq = 1000
 
 ##
 ## Runas alias specification
@@ -82,7 +89,7 @@ root ALL=(ALL:ALL) ALL
 %wheel ALL=(ALL:ALL) ALL
 
 ## Same thing without a password
-#%wheel ALL=(ALL:ALL) NOPASSWD: ALL
+# %wheel ALL=(ALL:ALL) NOPASSWD: ALL
 
 ## Uncomment to allow members of group sudo to execute any command
 # %sudo	ALL=(ALL:ALL) ALL