Refactored installer into modular library structure with improved error handling and logging.

The changes include:
- Split monolithic script into lib/, config/, profiles/, and files/ directories
- Added error handling with cleanup on failure
- Added installation logging to /var/log/arch-install.log
- Added username validation

files/etc/nftables.conf

@@ -0,0 +1,41 @@
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif lo counter accept comment "accept any localhost traffic"
+		ct state { established, related } counter accept comment "accept established,related"
+		ct state invalid counter drop comment "drop invalid"
+		meta l4proto { icmp, ipv6-icmp } counter accept comment "accept ICMP"
+
+		tcp dport ssh ct state new counter accept comment "accept new SSH connections"
+
+		counter comment "count any other dropped traffic"
+	}
+
+	chain output {
+		type filter hook output priority filter; policy drop;
+
+		oif lo counter accept comment "accept any localhost traffic"
+		ct state { established, related } counter accept comment "accept established,related"
+		ct state invalid counter drop comment "drop invalid"
+		meta l4proto { icmp, ipv6-icmp } counter accept comment "accept ICMP"
+
+		udp dport https ct state new counter reject comment "reject new HTTP/3 connections"
+		ct state new counter accept comment "accept new outbound connections"
+
+		counter comment "count any other dropped traffic"
+	}
+
+	chain forward {
+		type filter hook forward priority filter; policy drop;
+
+		# Drop everything forwarded to us. This device is not a router and does not forward.
+
+		counter comment "count dropped traffic"
+	}
+}

files/etc/ssh/sshd_config

@@ -0,0 +1,11 @@
+AllowUsers PLACEHOLDER
+AuthenticationMethods publickey,password
+Ciphers aes256-gcm@openssh.com
+Compression no
+HostKey /etc/ssh/ssh_host_ed25519_key
+HostKeyAlgorithms ssh-ed25519
+KexAlgorithms mlkem768x25519-sha256
+MACs umac-128-etm@openssh.com
+PermitRootLogin no
+PubkeyAcceptedAlgorithms ssh-ed25519
+Subsystem sftp internal-sftp

files/etc/sysctl.d/90-bbr.conf

@@ -0,0 +1 @@
+net.ipv4.tcp_congestion_control = bbr

files/etc/systemd/network/50-default-ether.network

@@ -0,0 +1,16 @@
+[Match]
+Type=ether
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+IPv6AcceptRA=yes
+EmitLLDP=yes
+
+[DHCPv4]
+RouteMetric=100
+
+[IPv6AcceptRA]
+RouteMetric=100

files/etc/systemd/network/50-default-wlan.network

@@ -0,0 +1,19 @@
+[Match]
+Type=wlan
+WLANInterfaceType=station
+SSID=*
+
+[Link]
+RequiredForOnline=routable
+
+[Network]
+DHCP=yes
+IPv6AcceptRA=yes
+IgnoreCarrierLoss=3s
+EmitLLDP=yes
+
+[DHCPv4]
+RouteMetric=200
+
+[IPv6AcceptRA]
+RouteMetric=200

files/etc/systemd/resolved.conf.d/90-no-fallbackdns.conf

@@ -0,0 +1,2 @@
+[Resolve]
+FallbackDNS=

files/etc/systemd/resolved.conf.d/90-no-llmnr.conf

@@ -0,0 +1,2 @@
+[Resolve]
+LLMNR=no

files/etc/systemd/resolved.conf.d/90-no-mdns.conf

@@ -0,0 +1,2 @@
+[Resolve]
+MulticastDNS=no