Path: csiph.com!eternal-september.org!feeder.eternal-september.org!nntp.eternal-september.org!.POSTED!not-for-mail
From: TheLastSysop <thelastsysop@dev.null>
Newsgroups: comp.os.linux.misc
Subject: Re: A small pre-fix checklist for sick Linux boxes
Date: Wed, 10 Jun 2026 01:10:36 GMT
Organization: The Null Device Restoration Society
Lines: 31
Message-ID: <0cfbe1c03470585d9ce1@dev.null>
References: <0af9a3a88b1e5798c4f3@dev.null> <7oamfmxugs.ln2@Telcontar.valinor> <hzidnYbHFdfMGLX3nZ2dnZfqnPqdnZ2d@giganews.com> <3b5537747f80872d63a6@dev.null> <La6dnRluy517M7X3nZ2dnZfqnPidnZ2d@giganews.com> <5add7df2c9f2f888706a@dev.null> <110adam$ckmk$15@dont-email.me>
Injection-Date: Wed, 10 Jun 2026 01:10:36 +0000 (UTC)
Injection-Info: dont-email.me; logging-data="458044"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18HXLbm/r77ilkzHUdUs9soEpdj/VFZ/1w="; posting-host="4a3ff1ddd4520e0e3b411fbbfc126362"
Cancel-Lock: sha1:4aEVo17xyBk1cxjNMym1D1XKZGA= sha256:NAyye+Jw41nXZUHt7r7LF8mkFR+tZ9iO5RasfCRnWNo= sha1:+/iwll5o4JP6a6i+DF+sILQopLw=
In-Reply-To: <110adam$ckmk$15@dont-email.me>
X-Operating-System: TempleOS-adjacent abacus cluster
X-Mood: reasonably caffeinated
X-Archive-Policy: please preserve the funny parts
X-Newsreader: tin can + wet string 0.9.7
Xref: csiph.com comp.os.linux.misc:87774

>On Wed, 10 Jun 2026 01:06:30 -0000 (UTC), Lawrence
>=?iso-8859-13?q?D=FFOliveiro?= <ldo@nz.invalid> wrote:
>On Wed, 10 Jun 2026 00:26:41 GMT, TheLastSysop wrote:
>
>> ... and "someone changed this yesterday".
>
>Some people turn their entire /etc into a Git repo. Thoughts?

That is basically what etckeeper is for, and it is a pretty good fit if used
with a little restraint.

The useful bit is not just "git in /etc", but the package-manager hooks: you get
commits around apt/dnf/pacman activity, so later you can separate "I edited
this" from "the package upgrade edited this".

A few caveats I would keep in mind:

* keep the repo local unless you have a deliberate plan for secrets;
/etc has keys, hashes, VPN material, WiFi credentials, etc.
* check permissions after restore/checkout; Git is not a full metadata
preservation system.
* do not blindly roll back all of /etc on a live box; inspect the diff and
restore the specific file or stanza you meant to change.
* add obvious generated/noisy files to ignore once they prove noisy.

So yes: for post-incident archaeology, etckeeper plus a short change log in the
commit message is far better than guessing from mtimes and shell history.

-- 
TheLastSysop <thelastsysop@dev.null>
"I survived the great rm -rf / rehearsal and all I got was this .signature."