Static replay of the provisioning script's own decision logic (v2.5, Oct 2026). Every combination below was evaluated by the real script on the author's PC and recorded; this page only looks it up. No machine is touched.
ASUS ROG Flow tablet laptop (GZ302 board, 2025): AMD Ryzen AI Max+ 395 with Radeon 8060S graphics and 128 GB of unified memory.
GZ302EA32Display controller [0380]: Advanced Micro Devices, Inc. [AMD/ATI] Strix Halo [Radeon 8060S] [1002:1586] (rev c1)OLLAMA_BACKEND=auto (Ollama backend)INSTALL_ROCM=auto (ROCm)INSTALL_PYTORCH=auto (PyTorch)HIBERNATE=1 (Hibernate)ENABLE_SMARTD=0 (Disk maintenance (opt-in))124 GiB
0-preflightsanity checks + hardware detection + hostname
HIBERNATE=1Run as your normal user (not root) with admin rights, on CachyOS, with network. Hibernation needs disk swap (zram does not count): a swap partition or an active swap file is used as is; with neither and a btrfs / (the Calamares automatic layout) the hibernate step creates a swap file in subvolume @swap at /swap (SWAPFILE_GIB, auto from RAM); with neither on ext4/xfs add a swap partition or set HIBERNATE=0. 'bash node-setup.sh --report' shows what was detected.
1-basefull system update + base tools + paru + Qt/KDE skew guard (stops for a reboot if the kernel was replaced)
archlinux-keyring cachyos-keyringbase-devel git curl wget rsync openssh jq bc usbutils pciutils lm_sensors htop btop tmux vim nano man-db less which inetutils dmidecodeQT_SKEW_FIX=1pacman lock: 'rm /var/lib/pacman/db.lck' if no pacman/paru runs. Keyring: 'pacman -Sy archlinux-keyring cachyos-keyring'. Mirrors: 'cachyos-rate-mirrors'. "installing nvidia-utils (X) breaks dependency 'nvidia-utils=Y' required by linux-cachyos(-lts)-nvidia-open" = the CachyOS repo is caught mid-sync (the NVIDIA modules ship with each kernel build): wait an hour and re-run; never force it with -Sdd. A replaced kernel needs a reboot, then '--from lts'. Black screen / no login screen after an update = Qt skew: on the znver4 repos qt6-base came from Arch extra in Oct 2026 (the v3 repos carry CachyOS's own qt6-base), while the CachyOS repos (preferred) still held Qt modules and KDE built for the previous Qt. This step installs Qt modules behind qt6-base from extra/; other Qt/KDE packages that CachyOS has older than Arch only when the Plasma binaries fail to load. Such a package stays on Arch's build until CachyOS ships a higher version (QT_SKEW_FIX=0 = report only). Check: 'ldd -r /usr/bin/kwin_wayland | grep undefined' (also plasmalogin, plasmashell). Fix: 'pacman -Syu' again later, or 'pacman -S extra/<pkg>' for the package that owns the library named in the error ('pacman -Qo <library>').
keep linux-cachyos-lts (+ headers) as the fallback kernel
linux-cachyos-lts linux-cachyos-lts-headers linux-cachyos-headerslinux linux-headers if IS_ASUS = 1INSTALL_LTS_KERNEL=1linux-cachyos-lts + headers from the CachyOS repo (plus vanilla Arch 'linux' on ASUS laptops); Limine picks up new kernels via the limine-mkinitcpio hook.
2-remotehardened sshd drop-in; login without a key auto-disabled once an authorized key exists
openssh/etc/ssh/sshd_config.d/10-node.conf 644 written by node-setup.sh - edit and 'systemctl reload sshd'sshd.service enable --nowSSH_PORT=22SSH_AUTHORIZED_KEYS_URL=SSH_AUTHORIZED_KEYS_FILE=$SCRIPT_DIR/authorized_keys'sshd -t' shows the bad line. Login without a key is only disabled when ~/.ssh/authorized_keys has a key, so you cannot lock yourself out. Windows has no ssh-copy-id; from PowerShell: Get-Content <your public key file> | ssh <user>@<host> "mkdir -p ~/.ssh && tr -d '\r' >> ~/.ssh/authorized_keys && chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"
ufw is ON by default on CachyOS: allow ssh and the tailnet interface
ufw allow 22/tcp after a check on the nodeufw allow in on tailscale0 if INSTALL_TAILSCALE = 1, after a check on the nodefirewall-cmd --permanent --add-port=22/tcp after a check on the nodefirewall-cmd --reload after a check on the nodeSSH_PORT=22INSTALL_TAILSCALE=1CachyOS enables ufw (deny incoming). 'ufw status verbose'. Manual: 'ufw allow ssh'.
tailscaled installed + enabled (the login itself is the one thing the owner must do)
tailscale/etc/NetworkManager/conf.d/99-tailscale.conf 644 written by node-setup.sh (Arch wiki Tailscale): NetworkManager must not manage the tailnet interface after a check on the nodetailscaled.service enable --nowINSTALL_TAILSCALE=1Package 'tailscale' is in Arch extra. NetworkManager must leave tailscale0 alone: any conf.d file with 'unmanaged-devices=interface-name:tailscale0' counts (read first; only when none has it is 99-tailscale.conf written and NetworkManager reloaded). Login is interactive: 'tailscale up --operator=<your user>' prints a URL (OpenSSH stays the SSH server; no Tailscale SSH); rename with 'tailscale set --hostname NAME'. Set key expiry per node policy (https://tailscale.com/kb/1028/key-expiry): a node whose key has expired drops off the tailnet until it is re-authenticated.
3-appsGoogle Chrome from the AUR
google-chromeINSTALL_CHROME=1AUR builds need a normal user, base-devel and space in ~/.cache/paru. Fallback: 'pacman -S chromium'.
4-vendorasusctl + rog-control-center, asusd running, power-profiles-daemon masked
asusctl rog-control-centerasusd.service enable --now after a check on the nodepower-profiles-daemon.service disable --now after a check on the nodepower-profiles-daemon.service mask after a check on the nodeasusctl infoExpect Repository: extra for asusctl. asusd is udev-triggered; 'journalctl -b -u asusd'. CachyOS kernels 7.0.3+ (and linux-cachyos-lts 6.18.34) can hang ASUS sysfs writes for 60 s with EIO (forum 30468): calls here are time-limited. If they keep failing, boot the vanilla Arch 'linux' entry (installed by the lts step on ASUS laptops). A hung writer cannot be killed: reboot at the machine.
aggressive 8-point fan curves (set before PPT: some ROG firmware needs a curve first)
asusctl fan-curve --mod-profile Performance --enable-fan-curves true after a check on the nodeasusctl fan-curve -m Performance -e true after a check on the nodeFAN_CURVE=30c:40%,40c:50%,50c:65%,60c:80%,70c:95%,80c:100%,90c:100%,100c:100%FAN_PROFILE=PerformanceCustom curves need the asus_custom_fan_curve hwmon device: 'grep -l asus_custom_fan_curve /sys/class/hwmon/hwmon*/name'. Without it the profile keeps the BIOS curve; a community CLI from the AUR is the alternative.
raise power limits (ppt_pl1/pl2/pl3) to the driver's maximum for this board
PPT_MAX=1Needs the asus-armoury driver and a DMI table entry for the board: 'ls /sys/class/firmware-attributes/asus-armoury/attributes/'. Values apply only while 'asusctl profile tuning true'.
battery health + swelling warning; fan + power mode via razer-control-revived only with RAZER_CONTROL=1 (default: the EC's automatic fans)
loginctl enable-linger <NODE_USER>RAZER_CONTROL=0RAZER_POWER_MODE=1RAZER_FAN_RPM=0Default RAZER_CONTROL=0: the EC runs the fans automatically and keeps its power mode; the step prints the battery health (charge_full / charge_full_design), status and charge. RAZER_CONTROL=1: razer-control-revived (AUR razer-control-revived-bin, community) runs as a systemd USER service 'razercontrol' (linger keeps it running headless); the step waits up to 15 s for its socket, and since razer-cli exits 0 even on errors, 'Unknown error!' in its output counts as a failure. Its udev rule (/etc/udev/rules.d/99-hidraw-permissions.rules) sets the device permissions the tool needs on the Razer hidraw nodes; 'ls -l /dev/hidraw*' shows them. Check: 'systemctl --user status razercontrol', 'razer-cli read fan ac' (an EC setpoint: there is no tachometer).
5-powerperformance power profile (ASUS: asusd owns it; others: power-profiles-daemon; Intel laptops except Razer: thermald)
power-profiles-daemon if IS_ASUS != 1thermald if IS_ASUS != 1 and THERMALD_EFF = 1/etc/systemd/system/node-performance.service 644 Node: re-assert the Performance platform profile after boot (asusd owns platform_profile) if IS_ASUS = 1node-performance.service enable --now if IS_ASUS = 1power-profiles-daemon.service unmask if IS_ASUS != 1, after a check on the nodepower-profiles-daemon.service enable --now if IS_ASUS != 1thermald.service enable --now if IS_ASUS != 1 and THERMALD_EFF = 1asusctl profile list if IS_ASUS = 1 and DRY_RUN != 1powerprofilesctl set performance if IS_ASUS != 1powerprofilesctl configure-battery-aware --disable if IS_ASUS != 1ASUS: asusd is the only owner of /sys/firmware/acpi/platform_profile (PPD masked; running both races). Others: 'powerprofilesctl get' should say performance; do not also force the cpufreq governor there (intel_pstate then rejects PPD's EPP writes). thermald is skipped on Razer laptops (the EC manages them, and thermald resets PL1 to the firmware's 60 W); INSTALL_THERMALD=1 forces it there, and then the step runs 60 s of load and warns if PL1, max_perf_pct, no_turbo or the clock drop.
CPU package power cap PL1 45 W / 28 s, PL2 65 W, re-applied at boot and on AC plug/unplug; it only ever lowers a limit (n/a where the CPU's TDP is below the cap, e.g. the U-series Stealth 13)
/usr/local/sbin/node-powercap 755 powercap_script ZONES : /usr/local/sbin/node-powercap (sh). It waits up to 30 s for the zones that/etc/systemd/system/node-powercap.service 644 written by node-setup.sh (powercap step) - re-run on every AC plug/unplug by $POWERCAP_RULE/etc/udev/rules.d/90-node-powercap.rules 644 written by node-setup.sh (powercap step) - the EC may reset the CPU power limits when the charger is plugged in ornode-powercap.service enable after a check on the nodeRAZER_PL1_W=45RAZER_PL1_WINDOW_US=28000000RAZER_PL2_W=65Razer only, and only where RAZER_PL1_W is at most the CPU's TDP (constraint_0_max_power_uw: 45 W on the H-series Blades, 15 W on the U-series Stealth 13, where the step is n/a). /usr/local/sbin/node-powercap, run by node-powercap.service at boot and by /etc/udev/rules.d/90-node-powercap.rules on every AC plug/unplug (the EC may reset the limits), lowers PL1 (constraint_0_power_limit_uw + constraint_0_time_window_us) and PL2 (constraint_1_power_limit_uw) in /sys/class/powercap/intel-rapl:0 and intel-rapl-mmio:0; a limit already at or below the cap is kept (it never raises one, so a higher RAZER_PL1_W/RAZER_PL2_W than the one in force applies after a reboot). Check: 'journalctl -u node-powercap -b', 'grep . /sys/class/powercap/intel-rapl*:0/constraint_[01]_*'. thermald resets PL1: keep INSTALL_THERMALD=0. Off: RAZER_POWERCAP=0 plus 'systemctl disable --now node-powercap.service && rm /etc/udev/rules.d/90-node-powercap.rules', then reboot (the firmware's 60/80 W return). If the EC keeps resetting them: intel-undervolt with 'power package 65 45/28'.
CPU governor/EPP/boost = performance, re-applied at boot (PPD is masked there)
/etc/systemd/system/node-cpu-performance.service 644 Node: CPU governor and EPP = performancenode-cpu-performance.service enable --nowASUS only (PPD masked there). The node-cpu-performance.service rewrites governor, EPP and boost at boot.
cap zram (CachyOS default is zram-size = RAM); swappiness stays CachyOS's (150)
/etc/systemd/zram-generator.conf 644 written by node-setup.sh - CachyOS default (cachyos-settings) is zram-size = ram. if ZRAM_SIZE_EFF is setStrix Halo (or an explicit ZRAM_SIZE): /etc/systemd/zram-generator.conf (overrides the cachyos-settings default zram-size = ram); other machines keep CachyOS's default. vm.swappiness is set to 150 by cachyos-settings' /usr/lib/udev/rules.d/30-zram.rules each time zram0 starts (values above 100 suit in-memory swap: https://docs.kernel.org/admin-guide/sysctl/vm.html); an /etc/sysctl.d/99-node.conf from node-setup <= v2.4 never wins after a boot and can be removed. 'zramctl' shows the device. Hibernation never goes to zram.
Wi-Fi power save off, iwlwifi shutdown hook, MediaTek MT7925 ASPM fix where those cards exist; notes
/etc/NetworkManager/conf.d/90-node-wifi-powersave.conf 644 Oct 2026: always-on node, no Wi-Fi power saving (2 = disable) after a check on the node/usr/lib/systemd/system-shutdown/node-wifi-quiesce.shutdown 755 written by node-setup.sh - iwlwifi has no PCI .shutdown hook: unbind Intel Wi-Fi before reboot/poweroff after a check on the node/etc/modprobe.d/mt7925e.conf 644 written by node-setup.sh - MediaTek MT7925 (Wi-Fi 7) stability: disable PCIe ASPM (community fix) if WIFI_ASPM_FIX = 1, after a check on the nodenmcli general reload conf after a check on the nodeiw dev <w> set power_save off after a check on the nodenmcli connection modify <c> connection.autoconnect-retries 0 after a check on the nodeWIFI_ASPM_FIX=1Wi-Fi: /etc/NetworkManager/conf.d/90-node-wifi-powersave.conf (wifi.powersave = 2, read at the next connection) plus 'iw dev <if> set power_save off' for the running one ('iw dev <if> get power_save' = off); the active Wi-Fi connection retries forever (autoconnect-retries 0). Intel Wi-Fi bound to iwlwifi: /usr/lib/systemd/system-shutdown/node-wifi-quiesce.shutdown unbinds it before reboot/poweroff (iwlwifi has no PCI shutdown hook). An Intel AX200 stuck at 'probe ... failed with error -110' only recovers from a cold boot: charger out, hold power ~15 s, wait 30 s, charger in, power on. MT7925 (PCI 14c3:7925): /etc/modprobe.d/mt7925e.conf; reload: 'modprobe -r mt7925e && modprobe mt7925e'.
EXTRA_KERNEL_PARAMS on the kernel command line (any machine; n/a while it is empty)
EXTRA_KERNEL_PARAMS (keys another step owns are left to that step)EXTRA_KERNEL_PARAMS=EXTRA_KERNEL_PARAMS go to the same managed place as the script's other kernel parameters (Limine: the one KERNEL_CMDLINE[default]+= line in /etc/limine-entry-tool.d/50-node-setup.conf, then 'limine-update'); a key already there gets the new value. Keys another step owns on this machine are not applied here (that step would remove them again on every run): amd_iommu, ttm.pages_limit and amdgpu.gttsize on Strix Halo (IOMMU_OFF=1, TTM_PAGES_LIMIT_GIB, GTT_LEGACY=1), resume and resume_offset while HIBERNATE=1 (the hibernate step computes them). To remove one: delete it from that line, then 'limine-update'. After the reboot: cat /proc/cmdline.
6-gpukernel parameter so the iGPU can pin most of RAM (ttm.pages_limit)
amd-debug-toolsttm.pages_limit=<TTM pages>GTT_LEGACY=0IOMMU_OFF=0Limine: the script's parameters live in /etc/limine-entry-tool.d/50-node-setup.conf (one KERNEL_CMDLINE[default]+=... line, no quotes, no comment after it; /etc/default/limine keeps the installer line) then 'limine-update'; check: grep cmdline /boot/limine.conf (no quote or # in it). systemd-boot: /etc/sdboot-manage.conf then 'sdboot-manage gen'. GRUB: /etc/default/grub then grub-mkconfig. Verify after reboot: cat /sys/module/ttm/parameters/pages_limit (pages; /262144 = GiB).
right driver branch (Pascal 580xx / Turing+ open), no NVIDIA in early boot (hibernation), CUDA
linux-cachyos-headers if NVIDIA_GEN = legacylinux-cachyos-lts-headers if NVIDIA_GEN = legacy, after a check on the nodelinux-cachyos-lts-nvidia-open if NVIDIA_GEN != legacy, after a check on the nodenvidia-open if NVIDIA_GEN != legacy and IS_ASUS = 1 and (NVIDIA_GEN = turing or NVIDIA_GEN = ampere+), after a check on the nodecuda cudnn if CUDA_EFF = 1/etc/modprobe.d/99-node-nvidia-580xx-sleep.conf 644 written by node-setup.sh - legacy 580xx driver: keep video memory across hibernate (no kernel suspend notifiers in 580) if NVIDIA_GEN = legacy/etc/mkinitcpio.conf.d/99-node-no-nvidia-early.conf 644 written by node-setup.sh - keep NVIDIA out of the initramfs: early loading breaks resume from hibernation/etc/modprobe.d/50-node-nvidia-rtd3.conf 644 written by node-setup.sh - Turing laptop: let the dGPU power down when idle (NVIDIA_PERSISTENCE=0) if NVIDIA_PERSISTENCE != 1 and NVIDIA_GEN = turing and IS_LAPTOP = 1/etc/environment.d/90-node-cuda.conf 644 written by node-setup.sh - performance AI node: undo CachyOS nvidia-utils' CUDA_DISABLE_PERF_BOOST=1nvidia-suspend.service enable if NVIDIA_GEN = legacynvidia-hibernate.service enable if NVIDIA_GEN = legacynvidia-resume.service enable if NVIDIA_GEN = legacynvidia-powerd.service disable if (NVIDIA_GEN = turing or NVIDIA_GEN = legacy), after a check on the nodenvidia-persistenced.service enable --now if NVIDIA_PERSISTENCE = 1, after a check on the nodeNVIDIA_PERSISTENCE=1Pascal/Maxwell/Volta (GP/GM/GV) need nvidia-580xx-dkms; Turing+ (TU/GA/AD/GB) use nvidia-open 615. 'chwd --list-installed' shows the installed profile. NVIDIA modules in the initramfs break resume from hibernation (open-gpu-kernel-modules #1343); /etc/mkinitcpio.conf.d/99-node-no-nvidia-early.conf removes them. The images Limine boots are the module_path lines of /boot/limine.conf (/boot/<machine-id>/<kernel>/initramfs; /boot/initramfs-*.img are stale installer copies nothing boots, limine_history/ holds snapshot copies; sections of another install on the same ESP carry another machine-id and are not checked). By hand: lsinitcpio /boot/<machine-id>/linux-cachyos/initramfs | grep -cE '/nvidia[^/]*\.ko' must print 0 (a plain 'grep nvidia' never comes back empty: the kms hook adds nouveau's firmware under usr/lib/firmware/nvidia/, and nvidia-utils' modprobe.d files stay). 580xx (Pascal) needs NVreg_PreserveVideoMemoryAllocations=1 and nvidia-suspend/hibernate/resume enabled. nvidia-powerd (Dynamic Boost: Ampere+ GPU and Comet Lake+ chipset only) is disabled on Turing and older. 'nvidia-smi' must work after a reboot.
7-aiROCm HIP SDK + OpenCL from Arch extra, render/video groups
rocm-hip-sdk rocm-hip-runtime hip-runtime-amd rocminfo rocm-smi-lib rocm-opencl-runtime clinfo/etc/ld.so.conf.d/rocm.conf gets /opt/rocm/lib after a check on the noderender + <NODE_USER> after a check on the nodevideo + <NODE_USER> after a check on the noderocminfo needs the render group: re-login (CachyOS has no sg/newgrp) or 'rocminfo'. No gfx1151 in rocminfo: 'dmesg | grep -i amdgpu'. If rocminfo segfaults on 7.2.x, boot the LTS kernel and compare.
one folder for everything AI: /srv/ai (models, venvs, apps, data, caches), group ai, ~/ai link, README
/srv/ai/README.md 664ai after a check on the nodeai + node user, ollama after a check on the nodeINSTALL_DOCKER=1AI_ROOT=/srv/aiDOCKER_DATA_ROOT=/srv/dockerEverything AI lives under AI_ROOT (default /srv/ai; CachyOS mounts btrfs subvolume @srv at /srv, outside snapper's snapshots of /). Group ai (you + the ollama user) owns it: folders are mode 2775 (setgid: new files get group ai) with a default ACL group:ai:rwx; the membership is active after a re-login ('id' lists ai). Check: ls -ld /srv/ai /srv/ai/*; getfacl /srv/ai. ~/ai is a link to it unless ~/ai already held files (then a warning says how to switch). AI_ROOT's parent missing or read-only: ~/ai is used instead. README.md in the folder maps the tree; a hand-edited README is never overwritten.
AI environment for sh/bash, fish and the desktop session + Ollama service settings for this GPU
/etc/profile.d/node-ai.sh 644/etc/fish/conf.d/node-ai.fish 644/etc/environment.d/90-node-ai.conf 644/etc/systemd/system/ollama.service.d/node.conf 644 written by node-setup.sh (backend: $OLLAMA_BACKEND_EFF) if INSTALL_OLLAMA = 1INSTALL_OLLAMA=1AI_ROOT=/srv/aiWrites the same variables to /etc/profile.d/node-ai.sh (sh/bash), /etc/fish/conf.d/node-ai.fish (fish, the CachyOS login shell, does not read profile.d) and /etc/environment.d/90-node-ai.conf (systemd user manager -> desktop session), plus the Ollama drop-in /etc/systemd/system/ollama.service.d/node.conf (OLLAMA_MODELS in the AI folder; a running Ollama is restarted only when that file changed). Re-login, or 'source /etc/profile.d/node-ai.sh' (bash) / 'source /etc/fish/conf.d/node-ai.fish' (fish).
8-aiOllama (backend chosen for this GPU), Vulkan drivers, Docker (data in /srv/docker, + NVIDIA toolkit), uv, monitors
uv python python-pip cmake ninja clang lld git-lfs btop nvtop vulkan-tools vulkan-icd-loadervulkan-radeon mesa radeontop if HAS_AMD_GPU = 1amdgpu_top if HAS_AMD_GPU = 1vulkan-intel intel-gpu-tools if HAS_INTEL_GPU = 1distrobox podmanlemonade-server if INSTALL_LEMONADE = 1docker docker-compose docker-buildx if INSTALL_DOCKER = 1nvidia-container-toolkit if INSTALL_DOCKER = 1 and HAS_NVIDIA = 1 and NVIDIA_CONTAINER = 1ollama ollama-vulkan if INSTALL_OLLAMA = 1 and OLLAMA_BACKEND_EFF = vulkanollama ollama-rocm if INSTALL_OLLAMA = 1 and OLLAMA_BACKEND_EFF = rocmollama ollama-vulkan ollama-rocm if INSTALL_OLLAMA = 1 and OLLAMA_BACKEND_EFF = bothollama ollama-cuda if INSTALL_OLLAMA = 1 and OLLAMA_BACKEND_EFF = cudaollama if INSTALL_OLLAMA = 1 and OLLAMA_BACKEND_EFF = cpu/etc/docker/daemon.json 644 if INSTALL_DOCKER = 1, after a check on the nodedocker.service enable --now if INSTALL_DOCKER = 1ollama.service enable --now if INSTALL_OLLAMA = 1docker + <NODE_USER> if INSTALL_DOCKER = 1, after a check on the noderender + ollama if INSTALL_OLLAMA = 1, after a check on the nodevideo + ollama if INSTALL_OLLAMA = 1, after a check on the nodeai if INSTALL_OLLAMA = 1, after a check on the nodeai + node user, ollama if INSTALL_OLLAMA = 1, after a check on the nodeINSTALL_OLLAMA=1INSTALL_DOCKER=1INSTALL_LEMONADE=0NVIDIA_CONTAINER=1AI_ROOT=/srv/aiDOCKER_DATA_ROOT=/srv/dockerDocker group needs re-login. ollama.service is restarted only when its backend packages, its groups or its model folder changed (loaded models stay loaded on a re-run). Ollama: 'journalctl -u ollama -b | grep -iE "inference compute|library=|dropping"'. Ollama skips integrated GPUs unless OLLAMA_IGPU_ENABLE=1 (set on Strix Halo, or everywhere with OLLAMA_IGPU=1). Ollama models: 'systemctl show ollama -p Environment' shows OLLAMA_MODELS; old models in /var/lib/ollama are reported with a move command, never moved. Docker data: data-root in /etc/docker/daemon.json is set only before Docker's first start ('docker info | grep "Docker Root Dir"'); existing /var/lib/docker data is never moved (the warning has the commands).
PyTorch in /srv/ai/venvs/torch from the right wheel index for this GPU, with a smoke test
torch[device-gfx1151] torchvision[device-gfx1151] torchaudio from https://stable.repo.amd.com/rocm/whl-next/ if PYTORCH_FLAVOR = rocm-gfx1151torch torchvision torchaudio from https://download.pytorch.org/whl/cu130 if PYTORCH_FLAVOR = cu130torch torchvision torchaudio from https://download.pytorch.org/whl/cu126 if PYTORCH_FLAVOR = cu126/usr/local/bin/node-torch-check 755AI_ROOT=/srv/aivenv: /srv/ai/venvs/torch (AI_ROOT; up to v2.2 it was ~/ai/venv, an old one is left in place). Strix Halo: AMD TheRock index torch[device-gfx1151]. NVIDIA Turing+: download.pytorch.org/whl/cu130. Pascal: whl/cu126 (last CUDA line with sm_6x). If torch.cuda.is_available is False: check the driver (nvidia-smi / rocminfo), groups, then reboot.
9-sleephibernate to swap (partition, or a btrfs swap file it creates); resume=, model unload; no suspend
/etc/systemd/sleep.conf.d/node.conf 644 written by node-setup.sh/usr/local/bin/node-ollama-unload 755 written by node-setup.sh - ask Ollama to unload every loaded model (frees pinned GPU memory before hibernate)/etc/systemd/system/node-ollama-unload.service 644 written by node-setup.sh - runs before the system (and the NVIDIA driver) goes to sleep/etc/systemd/system/node-ollama-resume.service 644 written by node-setup.sh - runs after resume (and after nvidia-resume on the 580xx driver)/etc/fstab gets UUID=<uuid> /swap btrfs subvol=/@swap,defaults,noatime 0 0 after a check on the node/etc/fstab gets UUID=<uuid> none swap defaults 0 0 after a check on the node/etc/fstab gets <SWAP_PATH> none swap defaults 0 0 after a check on the nodenode-ollama-unload.service enablenode-ollama-resume.service enableresume=UUID=<swap> [resume_offset=<first page of the swap file>]btrfs subvolume create <top>/@swap after a check on the nodebtrfs filesystem mkswapfile --size <gib>g --uuid clear /swap/swapfile after a check on the nodeswapon <SWAP_PATH> after a check on the nodeTarget = the largest active non-zram swap (partition or file), >= RAM/0.98. Partition: resume=UUID=<swap UUID> (Calamares adds it when it formatted the swap in the same run; this step adds it if missing). File: resume=UUID=<filesystem UUID> resume_offset=<'btrfs inspect-internal map-swapfile -r FILE' on btrfs, else physical_offset of extent 0 in 'filefrag -v FILE'>. No disk swap + btrfs /: creates subvolume @swap (outside snapper's snapshots of @), mounts it at /swap (fstab), 'btrfs filesystem mkswapfile' /swap/swapfile, fstab, swapon; needs size + 10 GiB free on /. Check: swapon --show; cat /sys/power/resume /sys/power/resume_offset. CachyOS initramfs uses the systemd hook, so no 'resume' hook is needed. node-ollama-unload.service / node-ollama-resume.service run around hibernate (ordered against nvidia-hibernate / nvidia-resume). Razer: if a hibernate stalls ('journalctl -b 0 | grep -iE "Freezing of tasks failed|nvidia-gpu|ucsi"'), blacklist i2c_nvidia_gpu and ucsi_ccg in /etc/modprobe.d/ and run 'limine-mkinitcpio' (Arch wiki Razer_Blade). NVIDIA #1378 (driver 595, S3 suspend, KWin losing outputs) is related, unverified for 615 + hibernate. Test with 'rtcwake -m no' + 'systemctl hibernate', never rtcwake's own disk mode (it skipes systemd's sleep units, so the model unload would not run).
10-headlessnever suspends (logind, sleep.conf.d, Plasma); no screen lock or blanking on a headless node; laptops hibernate at 5 % battery (UPower)
/etc/systemd/logind.conf.d/node.conf 644 written by node-setup.sh - headless node: lid/folio and idle never suspend it/etc/systemd/sleep.conf.d/node.conf 644 written by node-setup.sh/etc/UPower/UPower.conf.d/90-node.conf 644 Oct 2026: always-on laptop on AC; on a long power outage hibernate at 5 % (warn at 8 %). after a check on the node/etc/plasmalogin.conf.d/node-autologin.conf 644 written by node-setup.sh (Arch wiki: Plasma Login Manager) if AUTOLOGIN = 1, after a check on the node/etc/sddm.conf.d/node-autologin.conf 644 written by node-setup.sh if AUTOLOGIN = 1, after a check on the node/etc/xdg/kscreenlockerrc 644 written by node-setup.sh - lock the auto-logged-in session immediately if AUTOLOGIN = 1 and AUTOLOGIN_LOCK = 1AUTOLOGIN=0AUTOLOGIN_LOCK=0Writes /etc/systemd/logind.conf.d/node.conf (lid and idle ignored; logind is reloaded, never restarted: a restart can end the Plasma session), /etc/systemd/sleep.conf.d/node.conf (no suspend; the same file the hibernate step writes), ~/.config/powerdevilrc (LidAction/AutoSuspendAction=0 for AC, Battery, LowBattery) and, on laptops, /etc/UPower/UPower.conf.d/90-node.conf (hibernate at 5 % battery; PowerOff while hibernation is not available; 'upower -d | grep critical-action'). Autologin: an existing plasma-login-manager / sddm drop-in is reported and kept; AUTOLOGIN=1 writes one, AUTOLOGIN_LOCK=1 also locks that session at every login.
10-disksmartd for the system NVMe + a monthly btrfs scrub (ENABLE_SMARTD=1 / ENABLE_SCRUB=1)
smartmontools if ENABLE_SMARTD = 1/etc/smartd.conf 644 if ENABLE_SMARTD = 1, after a check on the nodesmartd.service enable --now if ENABLE_SMARTD = 1btrfs-scrub@-.timer enable --now if ENABLE_SCRUB = 1, after a check on the nodeENABLE_SMARTD=0ENABLE_SCRUB=0Opt-in, each part enables a scheduled job. ENABLE_SMARTD=1: smartmontools; DEVICESCAN in /etc/smartd.conf becomes '/dev/nvmeN -a -W 0,70,80 -s <weekly short self-test>' for the system NVMe (a .bak copy is kept beside it; drop '-s ...' if smartd logs self-test errors: NVMe self-tests are experimental in smartmontools 7.5); smartd enabled; 'journalctl -u smartd -b'. ENABLE_SCRUB=1: btrfs-scrub@-.timer (monthly, idle I/O priority); 'btrfs scrub status /'.
11-donefinal report, reboot advice, "needs the owner" list
Nothing to fix here; it only prints.
bash node-setup.sh --list: rendered from the step table and the applies_* results (checked against the script's own output for the default knobs), not captured on a node.
preflight 0-preflight Preflight checks + hardware detection pending update 1-base Full system update + base tools + paru pending lts 1-base LTS kernel as fallback pending ssh 2-remote SSH daemon, hardened pending firewall 2-remote Firewall (ufw): allow SSH + tailnet pending tailscale 2-remote Tailscale daemon pending chrome 3-apps Google Chrome (AUR) pending asusctl 4-vendor ASUS: asusctl + asusd (sole profile owner) pending fans 4-vendor ASUS: fan curves to max pending ppt 4-vendor ASUS: power limits to board maximum pending razer 4-vendor Razer: battery report, fans + power (opt-in) n/a (not a Razer) perfprofile 5-power Performance power profile pending powercap 5-power Razer: CPU package power cap (PL1/PL2) n/a (not a Razer) cpu 5-power ASUS: CPU governor/EPP/boost performance pending zram 5-power zram size cap (Strix Halo only) pending quirks 5-power Quirks: Wi-Fi power save, iwlwifi, MT7925 pending kparams 5-power EXTRA_KERNEL_PARAMS on the kernel cmdline n/a (EXTRA_KERNEL_PARAMS is empty) gpumem 6-gpu Strix Halo: iGPU unified-memory kernel param pending nvidia 6-gpu NVIDIA: driver branch, hibernate-safe boot, CUDA n/a (no NVIDIA GPU) rocm 7-ai AMD: ROCm HIP SDK + OpenCL pending aidirs 7-ai AI folder layout under /srv/ai pending aienv 7-ai AI environment + Ollama settings pending aitools 8-ai Ollama, Vulkan, Docker, uv, monitors pending pytorch 8-ai PyTorch for this GPU (venv + smoke test) pending hibernate 9-sleep Hibernate to swap partition or file pending headless 10-headless Headless: no sleep/lock/blanking, low battery pending maintenance 10-disk Disk watch: smartd + btrfs scrub (opt-in) n/a (opt-in: ENABLE_SMARTD=1 and/or ENABLE_SCRUB=1 (each enables a scheduled job, which needs the owner's yes)) summary 11-done Final report pending
offline checks passing, 0 failing (Git Bash on a Windows PC, Oct 2026)
1,360 lines, 29 sections, 334 check calls; 1 sits inside an if (the jq merge test) and is skipped when jq is not installed, so the run counts 333. 10 fake machines: gz302, rz-turing, rz-pascal, rz-boardonly, desk, intel-only, asus-desk, asus-rog, amd-mini, amd-dgpu.
| # | Section | Checks | Share |
|---|---|---|---|
| 1 | every step has a function, a hint, and step ids are unique | 2 | |
| 2 | bootloader cmdline editing: Limine (CachyOS default) = a drop-in the script owns | 18 | |
| 3 | dry-run changes nothing | 2 | |
| 3b | Limine migration: the v2.1 inline line (the bug) and the drop-in made by hand on the Strix Halo node | 11 | |
| 4 | systemd-boot (sdboot-manage): exactly the v2.1 marker-line behaviour | 4 | |
| 5 | GRUB (single-quoted default line as CachyOS writes it) | 2 | |
| 6 | write_root_file / ensure_root_line idempotency | 6 | |
| 7 | failure path produces the AI-ready report and a non-zero status | 5 | |
| 8 | a step whose last test is false still passes (set -e trap regression) | 2 | |
| 9 | CLI entry points (executed, not sourced) | 3 | |
| 10 | the hibernate units and the unload script | 5 | |
| 11 | review fixes (v1.2) | 14 | |
| 12 | hardware detection on fake machines (DMI dir, cpuinfo, lspci, power_supply) | 48 | |
| 13 | hibernate target: swap partition, swap file, or a btrfs swap file made on a zram-only install | 24 | |
| 15 | AI folders (v2.3): aidirs, the three env files, Ollama drop-in + model folder, Docker data-root, venv path | 49 | |
| 16 | Qt/KDE skew guard after -Syu (v2.4): the Oct 2026 black screen on the Strix Halo node | 12 | |
| 17 | powercap (v2.5, Razer): PL1 45 W / 28 s, PL2 65 W in both RAPL zones; boot unit + AC udev rule | 20 | |
| 18 | Wi-Fi quirks (v2.5): power save off, iwlwifi shutdown hook, AX200 note, autoconnect-retries 0 | 18 | |
| 19 | headless (v2.5): sleep.conf from both steps, Plasma lock/blank keys, UPower low battery, no DDC/CI | 21 | |
| 20 | zram (v2.5): cap on Strix Halo only, no swappiness file, verify warns on mismatches | 7 | |
| 21 | Razer step (v2.5): battery report; razer-control-revived only with RAZER_CONTROL=1, and then it warns, never dies | 9 | |
| 22 | kparams (v2.5): EXTRA_KERNEL_PARAMS on every machine, in the managed drop-in | 7 | |
| 23 | maintenance (v2.5, opt-in): smartd for the system NVMe, monthly btrfs scrub | 6 | |
| 24 | tailscale key expiry, ssh note, failure-report filter, hibernate note + check, Wi-Fi-only reboot wording | 20 | |
| 25 | nvidia step (v2.5): nvidia-powerd off on Turing; an ASUS laptop with Turing+ gets nvidia-open for vanilla 'linux' | 3 | |
| 26 | thermald on the Razer (v2.5): off by default; INSTALL_THERMALD=1 runs a 60 s load check that warns on a drop | 5 | |
| 27 | the real memory-module parser (v2.5 review: the tests stubbed it away entirely) | 5 | |
| 28 | root is refused for every run that executes or verifies steps (v2.5 review: --only / --from skipped preflight) | 2 | |
| 14 | file hygiene | 4 |
Oct 2026
The first version appended kernel parameters to the installer's Limine line with quotes and a trailing comment, the way a shell file would allow. limine-entry-tool is not a shell: it copied the quotes and the comment into the kernel command line. The script now owns one drop-in file with a single unquoted line and leaves the installer's line untouched; the test harness checks for quotes and '#' on that line.
Oct 2026
A boot unit had both WantedBy=multi-user.target and After=multi-user.target. A review agent flagged it as an ordering cycle; a verifier agent dismissed the finding. On the first boot systemd broke the cycle by deleting the start job, so the CPU performance unit never ran. The unit lost the After= line and the harness now fails any unit that has both.
Measured on the node; no public source
Oct 2026
A full update mixed Arch's newer qt6-base with Qt modules and KDE packages that the CachyOS repositories had built against the previous Qt. Plasma's binaries failed with undefined Qt private-API symbols, so the login screen stayed black while SSH kept working. The update step now runs 'ldd -r' on the Plasma binaries and installs the lagging packages from Arch extra when they fail to load.
Oct 2026
The Razer's Intel AX200 card failed to start after warm reboots (iwlwifi probe error -110); a PCI reset and another warm reboot did not help, a full power-off with the charger unplugged did. The script now installs a shutdown hook that unbinds the card before every reboot or power-off, and the node then passed 3 warm reboots in a row.
Oct 2026
On the 128 GB node, ping over Wi-Fi sat at roughly 90-120 ms. Turning NetworkManager's Wi-Fi power saving off brought it to 2-6 ms. The quirks step now writes that setting on every node with a wireless card and turns power saving off for the running connection too.
Oct 2026
NVIDIA kernel modules inside the initramfs make resume from hibernation fail, and the hardware-detection tool puts them there. The nvidia step adds a later mkinitcpio drop-in that filters them out and survives the tool's rewrites; the verify step reads which images the bootloader actually boots and checks those.
Oct 2026
A community report described a 128 GB Strix Halo laptop freezing while hibernating with large GPU allocations. The hibernate step installs a unit that asks Ollama to unload every model before the system sleeps and one that restores the service after resume. The second hibernate test passed with the GPU pool at 118 GiB and Ollama running.
Oct 2026
The 2019 Blade's firmware sets the CPU's long-term power limit above Intel's 45 W rating. The powercap step caps it at 45 W / 65 W, but the same defaults on a 15 W U-series model would raise its limits. The step is therefore n/a where the cap is above the CPU's TDP, and it never raises a limit that is already lower.
| Setting | Default | Script comment |
|---|---|---|
SSH_PORT | 22 | |
SSH_AUTHORIZED_KEYS_URL | (empty) | e.g. https://github.com/<user>.keys |
SSH_AUTHORIZED_KEYS_FILE | $SCRIPT_DIR/authorized_keys | file beside this script |
INSTALL_TAILSCALE | 1 | |
INSTALL_CHROME | 1 | |
INSTALL_LTS_KERNEL | 1 | |
QT_SKEW_FIX | 1 | update step: Qt modules / Qt-KDE packages the CachyOS repos hold back behind Arch are installed from extra/ (1), or only reported (0) |
INSTALL_OLLAMA | 1 | |
OLLAMA_BACKEND knob | auto | auto | vulkan | rocm | both | cuda | cpu |
OLLAMA_IGPU | 0 | 1 = let Ollama use an integrated AMD/Intel GPU (Strix Halo always does); benchmark first |
INSTALL_DOCKER | 1 | |
INSTALL_PYTORCH knob | auto | auto = only where a supported GPU exists | 1 | 0 |
INSTALL_ROCM knob | auto | auto = Strix Halo only | 1 = any AMD GPU | 0 |
INSTALL_CUDA_TOOLKIT | auto | auto = Turing+ only (Arch cuda 13 dropped Pascal) | 1 | 0 |
INSTALL_LEMONADE | 0 | AMD Lemonade SDK server (Arch extra: lemonade-server) |
INSTALL_THERMALD | auto | auto = Intel laptops except Razer (EC-managed; thermald would reset the powercap step's PL1 to the firmware's 60 W); 1 = also there; 0 = never |
NVIDIA_PERSISTENCE | 1 | keep the NVIDIA GPU initialised (always-on node; disables RTD3) |
NVIDIA_CONTAINER | 1 | nvidia-container-toolkit for Docker GPU access |
TTM_PAGES_LIMIT_GIB | auto | auto = min(120, RAM - 6) GiB the GPU may pin. 1 GiB = 262144 pages |
GTT_LEGACY | 0 | 1 = also set amdgpu.gttsize (deprecated on 6.18+, dmesg warns; harmless) |
IOMMU_OFF | 0 | 1 = amd_iommu=off: community llama.cpp prompt speed +5-12%, generation ~+2%; AMD: not recommended; no NPU, no DMA protection |
EXTRA_KERNEL_PARAMS | (empty) | any machine (kparams step), e.g. reboot=pci; kept in the same managed place |
PPT_MAX | 1 | 1 = push ppt_pl1_spl/pl2_sppt/pl3_fppt to the board maximum (GZ302EA: 80/92/93 W) |
FAN_CURVE | 30c:40%,40c:50%,50c:65%,60c:80%,70c:95%,80c:100%,90c:100%,100c:100% | 8 points, non-decreasing |
FAN_PROFILE | Performance | |
WIFI_ASPM_FIX | 1 | options mt7925e disable_aspm=1 (community stability fix) where an MT7925 exists |
RAZER_CONTROL | 0 | 0 = fans on the EC's automatic control, firmware power mode (default since v2.5, hardware audit); 1 = install razer-control-revived (AUR, community) |
RAZER_POWER_MODE | 1 | RAZER_CONTROL=1 only: 0 Balanced, 1 Gaming, 2 Creator (some models), 3 Silent |
RAZER_FAN_RPM | 0 | RAZER_CONTROL=1 only: 0 = automatic (EC); a fixed RPM on AC is 3500-5000, 3500-5300 on the 2019 Advanced (0245). No tachometer: it is a setpoint |
RAZER_POWERCAP knob | 1 | powercap step: cap the CPU package power (the 2019 Advanced's BIOS/EC sets PL1 60 W / PL2 80 W, above Intel's 45 W TDP); 0 = leave the firmware limits. A cap only lowers: a firmware limit already below it is kept, and the step is n/a where RAZER_PL1_W is above the CPU's TDP (15 W U-series Stealth 13) |
RAZER_PL1_W | 45 | long-term limit PL1 in W (Intel TDP of the i7-9750H); 0 = powercap step off |
RAZER_PL1_WINDOW_US | 28000000 | PL1 time window in us (the hardware rounds it: 28 s reads back 27983872) |
RAZER_PL2_W | 65 | short-term limit PL2 in W (a judgment call below the BIOS 80 W); 0 = step off |
ZRAM_SIZE | auto | auto = min(ram / 8, 16384) on Strix Halo (the iGPU's memory comes out of RAM), elsewhere CachyOS's default 'ram' (no file written); or a zram-generator expression for any machine. Swappiness is left to cachyos-settings (150) |
HIBERNATE knob | 1 | |
SWAPFILE_GIB | 0 | hibernate step, only when there is no disk swap and / is btrfs: size of the swap file it creates in subvolume @swap (0 = auto from RAM: 8->12, 16->20, 32->36, 64->72, 128->140 GiB) |
AUTOLOGIN | 0 | 1 = auto-login the desktop (a drop-in for plasma-login-manager or sddm); 0 = add none (an autologin drop-in already there is reported, kept) |
AUTOLOGIN_LOCK | 0 | |
ENABLE_SMARTD knob | 0 | 1 = smartd watches the system NVMe (weekly short self-test, 70/80 C warnings) |
ENABLE_SCRUB knob | 0 | 1 = monthly btrfs scrub of / at idle priority (btrfs-scrub@-.timer) |
AI_ROOT | /srv/ai | one tree for models, venvs, apps, data, caches (CachyOS: /srv = btrfs subvolume @srv, outside snapper's snapshots of /). Parent missing or read-only: ~/ai |
DOCKER_DATA_ROOT | /srv/docker | Docker images/containers/volumes ("data-root" in daemon.json, set before Docker's first start only; existing data is never moved). Empty = Docker's /var/lib/docker |
Parsed from the script: 35 file writes and 12 service enables reached from the steps (both equal to the call sites in the file), 25 verify functions, 13 applies gates.