Host Inventory: Arch Box
Audited 2026-02-27. This is the complete state of the host machine before SaltStack management. Salt Phase 2 will codify this as states — if reality doesn't match this doc, something drifted.
Hardware
| Component |
Detail |
| CPU |
Intel Core i7-8700K @ 3.70GHz — 12 threads (6 cores HT) |
| RAM |
125Gi total, ~11Gi used, ~114Gi available (no swap) |
| GPU |
NVIDIA GeForce GTX 1070, 8192 MiB VRAM, Driver 580.126.09, CUDA 13.0 |
| Storage |
1.8TB NVMe (ext4), 250G used (15%). 1GB EFI boot partition (vfat). |
| Network |
Intel e1000e (eno2, currently DOWN), Intel WiFi (wlp3s0, 10.0.0.217/24) |
OS & Kernel
| Property |
Value |
| OS |
Arch Linux (rolling) |
| Kernel |
6.18.9-arch1-2 (SMP PREEMPT_DYNAMIC) |
| Python |
3.14.3 (system), 3.12.12 (python312 package — useful for Salt compatibility) |
| Hostname |
archbox |
User & Groups
Filesystem
Network Interfaces
| Interface |
Address |
State |
Purpose |
| lo |
127.0.0.1/8 |
UP |
Loopback |
| eno2 |
— |
DOWN |
Wired ethernet (unused) |
| wlp3s0 |
10.0.0.217/24 |
UP |
WiFi — primary LAN connection (DHCP) |
| wlo1 |
— |
DOWN |
Secondary WiFi adapter (unused) |
| tailscale0 |
100.110.151.59/32 |
UP |
Tailscale overlay — all service ingress |
| docker0 |
172.17.0.1/16 |
DOWN |
Docker bridge (unused, docker installed but idle) |
| flannel.1 |
10.42.0.0/32 |
UP |
k3s pod CIDR overlay |
| cni0 |
10.42.0.1/24 |
UP |
k3s CNI bridge — ~40 veth pairs attached (pods) |
Default route: 10.0.0.1 via wlp3s0 (WiFi)
Listening Ports
| Port |
Interface |
Service |
Security Note |
| 22 |
0.0.0.0 + [::] |
sshd |
Open to all interfaces — should restrict to Tailscale + LAN |
| 443 |
100.110.151.59 (Tailscale) |
Tailscale funnel proxy |
OK — Tailscale only |
| 8443 |
100.110.151.59 (Tailscale) |
Tailscale funnel proxy |
OK — Tailscale only |
| 6443 |
* (all interfaces) |
k8s API server |
EXPOSED — reachable from LAN. Should restrict to localhost + Tailscale |
| 6444 |
127.0.0.1 |
k3s internal |
OK — localhost only |
| 9100 |
* (all interfaces) |
node-exporter |
EXPOSED — Prometheus metrics on LAN |
| 10250 |
* (all interfaces) |
kubelet |
EXPOSED — kubelet API on LAN |
| 11434 |
* (all interfaces) |
Ollama |
EXPOSED — LLM inference API on LAN (OLLAMA_HOST=0.0.0.0) |
| 10248-10259 |
127.0.0.1 |
k3s internal (kubelet, kube-proxy, etc.) |
OK — localhost only |
| 40391 |
127.0.0.1 |
k3s internal |
OK — localhost only |
| 51905 |
100.110.151.59 |
Tailscale |
OK — Tailscale only |
Firewall
Kernel Modules (notable)
| Module |
Purpose |
Loaded by |
| nvidia, nvidia_drm, nvidia_uvm, nvidia_modeset |
GPU driver + container runtime |
System (DKMS) |
| uinput |
Virtual input devices (Sunshine game streaming) |
Palworld/streaming setup |
| xpad |
Xbox controller driver |
Palworld/streaming setup |
| overlay |
Container filesystem overlay |
k3s (ExecStartPre) |
| br_netfilter |
Bridge netfilter (k8s networking) |
k3s (ExecStartPre) |
| nf_tables, nft_chain_nat, nft_compat |
nftables framework |
Kernel (available for firewall) |
| ip_tables, iptable_filter, iptable_nat, iptable_mangle |
iptables (k3s kube-router) |
k3s/kube-router |
| vxlan |
VXLAN tunnel (flannel networking) |
k3s/flannel |
| bluetooth, btusb, iwlmvm, iwlwifi |
Bluetooth + WiFi |
Hardware |
| kvm, kvm_intel |
Virtualization |
Kernel (available) |
| tun |
TUN/TAP (Tailscale) |
Tailscale |
| snd_* (many) |
Audio subsystem (HDA Intel + HDMI) |
Hardware |
Running Services
| Service |
Purpose |
Note |
| k3s.service |
Kubernetes cluster |
Custom unit in /etc/systemd/system/, --disable=traefik |
| tailscaled.service |
Tailscale agent |
System package |
| containerd.service |
Container runtime |
For Docker (k3s has its own embedded containerd) |
| docker.service |
Docker engine |
Installed but not used for k3s — legacy/build tool |
| ollama.service |
LLM inference |
Custom unit + override (OLLAMA_HOST=0.0.0.0, models at /var/lib/ollama) |
| sshd.service |
SSH server |
PermitRootLogin yes — should harden |
| NetworkManager.service |
Network management |
Manages WiFi connection |
| dbus-broker.service |
D-Bus message bus |
System service |
| wpa_supplicant.service |
WiFi authentication |
Used by NetworkManager |
| systemd-journald/logind/udevd/userdbd |
Core systemd services |
Standard |
| getty@tty1, getty@tty2 |
Console logins |
Standard — tty2 used for local Xorg |
| dirmngr@etc-pacman.d-gnupg |
GnuPG network cert management |
For pacman signature verification |
Systemd Overrides
| Unit |
Type |
Detail |
| k3s.service |
Custom unit |
/etc/systemd/system/k3s.service — installed by k3s installer, --disable=traefik |
| ollama.service |
Custom unit + drop-in |
override.conf sets OLLAMA_MODELS=/var/lib/ollama |
| NM-dispatcher |
Symlink |
Standard NetworkManager alias |
k3s Configuration
NVIDIA Container Runtime
SSH Configuration
Tailscale
Explicitly Installed Packages (pacman -Qe)
63 packages total. Grouped by purpose:
Base System
base, base-devel, linux, linux-firmware, linux-headers, grub, efibootmgr, sudo, openssh, networkmanager, dhcpcd, cups
GPU / NVIDIA
nvidia-580xx-dkms, nvidia-container-toolkit, opencl-nvidia-580xx, cuda, nvtop
Containers / Kubernetes
docker, docker-buildx, docker-compose, nerdctl, kubectl, helm, skopeo, opentofu
Tailscale
tailscale
git, github-cli, neovim-nightly-bin, vim, tmux-git, bat, btop, eza, fd, ripgrep, zoxide, atuin, zsh-git, paru, pacman-contrib, tree-sitter-cli, unzip, xclip, sshpass
Languages / Runtimes
python (3.14), python-pip, python-pipx, python312 (3.12), nodejs (25.6), npm, rust, aws-cli-v2
Desktop / Streaming (Palworld)
xorg-server, xorg-server-xvfb, xorg-xinit, xorg-xrandr, xorg-xset, dwm, moonlight-qt, alsa-lib, usbutils
Networking
ngrok
AI/LLM
Ollama installed at /usr/local/bin/ollama (not via pacman — custom service unit). Listening on 0.0.0.0:11434.
Security Findings
- No firewall. nft returns empty. iptables chains from kube-router exist but no host-level inbound filtering.
- k8s API (6443) on all interfaces. Reachable from LAN.
- kubelet (10250) on all interfaces. Reachable from LAN.
- node-exporter (9100) on all interfaces. Prometheus metrics exposed to LAN.
- Ollama (11434) on all interfaces. LLM inference API exposed to LAN.
- SSH allows root login. PermitRootLogin yes, no key-only enforcement.
- Secrets in plaintext. ~/secrets/ directory with unencrypted env files.
plan-2026-02-26-salt-host-management — Phase 2 will codify this inventory as Salt statesplan-2026-02-26-network-security-hardening — addresses the security findings aboveproject-pal-e-platform — parent project page