From 0748ab43a0ae3fd1f60e23b01e7a9f36e46d9dab Mon Sep 17 00:00:00 2001
From: Vladimir Eremin <personal@ermnvldmr.com>
Date: Sun, 27 Sep 2026 21:41:02 +0300
Subject: [PATCH] feat: Add memory retention policies for apt and
 systemd-journal

---
 actions/configure/base.py           | 30 +++++++++++++++++++++++++++++
 ci/packer/scripts/01-base-system.sh | 10 ++++++++++
 2 files changed, 40 insertions(+)

diff --git a/actions/configure/base.py b/actions/configure/base.py
index ce39036..b5ecc09 100644
--- a/actions/configure/base.py
+++ b/actions/configure/base.py
@@ -19,6 +19,36 @@ def run(ctx, args):
     else:
         log.info("Essential packages already installed.")
     s.ensure_running("rsyslog")
+
+    # Configure APT to discard downloaded archives
+    apt_clean_path = "/etc/apt/apt.conf.d/99-apex"
+    apt_clean_content = 'APT::Keep-Downloaded-Packages "0";\n'
+    if os.path.exists("/etc/apt/apt.conf.d/01clean"):
+        s.sudo(["rm", "-f", "/etc/apt/apt.conf.d/01clean"])
+    try:
+        current_apt = open(apt_clean_path).read() if os.path.exists(apt_clean_path) else None
+    except Exception:
+        current_apt = None
+    if current_apt != apt_clean_content:
+        log.info("Configuring APT to discard downloaded archives...")
+        s.sudo(["tee", apt_clean_path], input=apt_clean_content)
+
+    # Limit systemd-journald max disk usage
+    journal_d = "/etc/systemd/journald.conf.d"
+    journal_conf = os.path.join(journal_d, "99-apex.conf")
+    journal_content = "[Journal]\nSystemMaxUse=200M\n"
+    if os.path.exists(os.path.join(journal_d, "maxuse.conf")):
+        s.sudo(["rm", "-f", os.path.join(journal_d, "maxuse.conf")])
+    try:
+        current_journal = open(journal_conf).read() if os.path.exists(journal_conf) else None
+    except Exception:
+        current_journal = None
+    if current_journal != journal_content:
+        log.info("Configuring systemd-journald SystemMaxUse=200M...")
+        s.sudo(["mkdir", "-p", journal_d])
+        s.sudo(["tee", journal_conf], input=journal_content)
+        s.sudo(["systemctl", "restart", "systemd-journald"])
+
     if not shutil.which("ufw"):
         log.info("Installing UFW..."); s.sudo(["apt-get", "install", "-y", "-o", "DPkg::Lock::Timeout=60", "ufw"])
     else:
diff --git a/ci/packer/scripts/01-base-system.sh b/ci/packer/scripts/01-base-system.sh
index 4f327f8..c0b829a 100755
--- a/ci/packer/scripts/01-base-system.sh
+++ b/ci/packer/scripts/01-base-system.sh
@@ -10,6 +10,16 @@ apt-get install -y --no-install-recommends \
   parted fdisk pciutils usbutils smartmontools tmux vim less tree bash-completion \
   git python3 python3-minimal sudo rsyslog cron qemu-guest-agent
 
+# Prevent apt from retaining downloaded archives on disk
+echo 'APT::Keep-Downloaded-Packages "0";' > /etc/apt/apt.conf.d/99-apex
+
+# Limit systemd journal disk usage
+mkdir -p /etc/systemd/journald.conf.d
+cat << 'EOF_JOURNAL' > /etc/systemd/journald.conf.d/99-apex.conf
+[Journal]
+SystemMaxUse=200M
+EOF_JOURNAL
+
 echo "=== [2/6] Configuring Sudo & Passwordless Escalation ==="
 cat << 'EOF_SUDO' > /etc/sudoers.d/99-apex
 %sudo ALL=(ALL:ALL) NOPASSWD: ALL