feat(packages): add audio, bluetooth, and wifi support with firewalld migration

- Replace ufw with firewalld for enhanced network security
- Add Pipewire audio stack (pipewire, pipewire-alsa, pipewire-jack, pipewire-pulse, wireplumber)
- Add audio utilities (pamixer, playerctl) and gst plugin
- Add Bluetooth utilities (bluetui) alongside bluez stack
- Add WiFi tools (wireless-regdb, impala, broadcom-wl-dkms)
- Remove broadcom-wl from base packages (moved to extra with dkms)
- Add firewalld.sh post-boot script for firewall initialization
- Update post-boot script list to use firewalld.sh instead of ufw.sh

commit: c456b6d7fe9ba5e1095e0ff541673af6cd1b52c2
author: brice · 9mo ago · 2026-01-25 18:00 UTC
parent: 5675604
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

4 files · +37 -6

M install/base.packages +0 -1


@@ -21,7 +21,6 @@ ttf-jetbrains-mono-nerd
21	21
22	22		# Networking
23	23		networkmanager
24		-	broadcom-wl
25	24		openssh
26	25
27	26		# Essential Tools


@@ -21,7 +21,6 @@ ttf-jetbrains-mono-nerd
21			21
22		# Networking	22	# Networking
23		networkmanager	23	networkmanager
24	-	broadcom-wl
25		openssh	24	openssh
26			25
27		# Essential Tools	26	# Essential Tools

M install/extra.packages +17 -2


@@ -20,14 +20,29 @@ unzip
20	20		tlp
21	21
22	22		# Security
23		-	ufw
	23	+	firewalld
	24	+
	25	+	# Audio (Pipewire stack)
	26	+	pipewire
	27	+	pipewire-alsa
	28	+	pipewire-jack
	29	+	pipewire-pulse
	30	+	wireplumber
	31	+	gst-plugin-pipewire
	32	+	libpulse
	33	+	pamixer
	34	+	playerctl
24	35
25	36		# Bluetooth
26	37		bluez
27	38		bluez-utils
	39	+	bluetui
28	40
29		-	# Alternative WiFi
	41	+	# WiFi
30	42		iwd
	43	+	wireless-regdb
	44	+	impala
	45	+	broadcom-wl-dkms
31	46
32	47		# Shell enhancements
33	48		bash-completion


@@ -20,14 +20,29 @@ unzip
20		tlp	20		tlp
21			21
22		# Security	22		# Security
23	-	ufw	23	+	firewalld
			24	+
			25	+	# Audio (Pipewire stack)
			26	+	pipewire
			27	+	pipewire-alsa
			28	+	pipewire-jack
			29	+	pipewire-pulse
			30	+	wireplumber
			31	+	gst-plugin-pipewire
			32	+	libpulse
			33	+	pamixer
			34	+	playerctl
24			35
25		# Bluetooth	36		# Bluetooth
26		bluez	37		bluez
27		bluez-utils	38		bluez-utils
			39	+	bluetui
28			40
29	-	# Alternative WiFi	41	+	# WiFi
30		iwd	42		iwd
			43	+	wireless-regdb
			44	+	impala
			45	+	broadcom-wl-dkms
31			46
32		# Shell enhancements	47		# Shell enhancements
33		bash-completion	48		bash-completion

M install/mandatory/post-boot/all.sh +3 -3


@@ -21,10 +21,10 @@ if [ -f /usr/local/share/archup/post-boot/snapper.sh ]; then
21	21		fi
22	22		fi
23	23
24		-	# Configure UFW firewall
25		-	if [ -f /usr/local/share/archup/post-boot/ufw.sh ]; then
	24	+	# Configure firewalld
	25	+	if [ -f /usr/local/share/archup/post-boot/firewalld.sh ]; then
26	26		echo "Configuring firewall..." >> "$LOG_FILE"
27		-	if bash /usr/local/share/archup/post-boot/ufw.sh >> "$LOG_FILE" 2>&1; then
	27	+	if bash /usr/local/share/archup/post-boot/firewalld.sh >> "$LOG_FILE" 2>&1; then
28	28		echo "Firewall configured successfully" >> "$LOG_FILE"
29	29		else
30	30		echo "Firewall configuration failed (non-critical)" >> "$LOG_FILE"


@@ -21,10 +21,10 @@ if [ -f /usr/local/share/archup/post-boot/snapper.sh ]; then
21		fi	21		fi
22		fi	22		fi
23			23
24	-	# Configure UFW firewall	24	+	# Configure firewalld
25	-	if [ -f /usr/local/share/archup/post-boot/ufw.sh ]; then	25	+	if [ -f /usr/local/share/archup/post-boot/firewalld.sh ]; then
26		echo "Configuring firewall..." >> "$LOG_FILE"	26		echo "Configuring firewall..." >> "$LOG_FILE"
27	-	if bash /usr/local/share/archup/post-boot/ufw.sh >> "$LOG_FILE" 2>&1; then	27	+	if bash /usr/local/share/archup/post-boot/firewalld.sh >> "$LOG_FILE" 2>&1; then
28		echo "Firewall configured successfully" >> "$LOG_FILE"	28		echo "Firewall configured successfully" >> "$LOG_FILE"
29		else	29		else
30		echo "Firewall configuration failed (non-critical)" >> "$LOG_FILE"	30		echo "Firewall configuration failed (non-critical)" >> "$LOG_FILE"

A install/mandatory/post-boot/firewalld.sh +17 -0

@@ -0,0 +1,17 @@
	1	+	#!/bin/bash
	2	+	# Post-boot: Configure firewalld with basic protection
	3	+
	4	+	# Enable and start firewalld
	5	+	systemctl enable --now firewalld.service
	6	+
	7	+	# Set default zone to drop (deny all incoming by default)
	8	+	firewall-cmd --set-default-zone=drop
	9	+
	10	+	# Allow outgoing connections (drop zone blocks incoming only)
	11	+	# Add common services if needed
	12	+	# firewall-cmd --permanent --add-service=ssh
	13	+
	14	+	# Reload to apply changes
	15	+	firewall-cmd --reload
	16	+
	17	+	echo "Firewall configured (default deny incoming)"

@@ -0,0 +1,17 @@
	1	+	#!/bin/bash
	2	+	# Post-boot: Configure firewalld with basic protection
	3	+
	4	+	# Enable and start firewalld
	5	+	systemctl enable --now firewalld.service
	6	+
	7	+	# Set default zone to drop (deny all incoming by default)
	8	+	firewall-cmd --set-default-zone=drop
	9	+
	10	+	# Allow outgoing connections (drop zone blocks incoming only)
	11	+	# Add common services if needed
	12	+	# firewall-cmd --permanent --add-service=ssh
	13	+
	14	+	# Reload to apply changes
	15	+	firewall-cmd --reload
	16	+
	17	+	echo "Firewall configured (default deny incoming)"