A_NET=offline # or dhcp, wifi, static
offline | nothing configured; you set it up after boot |
dhcp | DHCP on whichever wired interface comes up — the default on the live ISO |
wifi | wireless via iwd, using the credentials given below |
static | a fixed address, gateway and DNS servers you specify |
A_NET=wifi A_WIFI_SSID=your-network A_WIFI_PSK=your-password A_WIFI_IFACE=wlan0
A_WIFI_IFACE can be left unset — the installer picks
whichever wireless interface actually exists rather than requiring you
to know its kernel-assigned name in advance, which is not always stable
across boots or hardware.
Setting A_WIFI_SSID at all enables the iwd
service at boot, even if A_NET is set to something other
than wifi — iwd is what iwctl talks to, and
there is no reason to leave it disabled if wireless credentials were
configured at all.
Interactively, from a live session or after install, the same thing without touching the config:
iwctl [iwd]# device list [iwd]# station wlan0 scan [iwd]# station wlan0 get-networks [iwd]# station wlan0 connect YOUR-NETWORK
A_NET=static A_IP=192.168.1.50/24 A_GATEWAY=192.168.1.1 A_DNS="1.1.1.1 9.9.9.9"
A_IP takes CIDR notation directly rather than a
separate netmask field. A_DNS accepts more than one
resolver, space separated, written into /etc/resolv.conf
in the order given.
dhcpcd is on the live ISO and is what wired DHCP actually runs
through, both during the live session and, if A_NET=dhcp,
on the installed system afterward. It lives in
/usr/sbin, which is on root's
PATH by default (/usr/local/sbin:/usr/local/bin:
/usr/sbin:/usr/bin:/sbin:/bin) — a merged-/usr
system does not distinguish /sbin from /bin
the way older layouts did, but the historical split between "user"
and "superuser" binaries in PATH for root specifically is
kept for familiarity.
A_FIREWALL=yes
Installs and enables nftables with a default-deny inbound policy — established and related connections and loopback traffic are allowed, everything else inbound is dropped unless something else you installed (sshd, for instance) opens a hole for itself explicitly.
A_SSH=yes A_SSH_PASSWORD_AUTH=yes # set to no to require keys only A_SSH_KEYS="" # public keys to seed into the new user's authorized_keys
Enabling SSH also opens the corresponding hole in the firewall
automatically when A_FIREWALL=yes, rather than leaving you
to notice the two settings need to agree with each other.
This is worth knowing even if you never hit it directly, because it
shaped how service startup logging works today. iwctl used
to report failed to initialize dbus even when
dbus-daemon was running correctly — the actual causes were
three unrelated things, described in full with the real error output at
each stage in troubleshooting. The
short version: /var/run did not exist (iwd's underlying
D-Bus library looks there; dbus itself listens under
/run), the netdev group iwd's own D-Bus policy
references did not exist (dbus silently rejects a policy naming an
unresolvable group), and no machine ID had ever been generated (which
dbus-daemon --system requires to start at all). None of the
three produced an error anyone could see at the time, which is a large
part of why it took real boot-log instrumentation, not guessing, to find
them.
More: arctic linux docs · install · declarative configuration · generations and rollback · init systems · kernels · packages (alpm) · desktops and audio · ephemeral shells · musl · building from source · troubleshooting · install.conf reference