System settings: optional SELinux disable; btrfs snapper + zstd compression

New section between base and DE menus:
- 'Disable SELinux permanently?' — default no; writes SELINUX=disabled with a
  backup, warns about the security tradeoff.
- When / is btrfs: 'snapper + grub-btrfs + compression?' — default yes. Shows
  subvolume list + fstab, appends ,compress=zstd:1 to btrfs fstab entries that
  lack a compress= option (idempotent, fstab backed up), then runs the
  SysGuides sysguides-snapper-fedora installer (snapper root+home, grub-btrfs,
  DNF5 pre/post snapshot actions).
- Flags for unattended runs: --selinux=keep|disabled, --snapper=yes|no.
- Fix found by the harness: the flag initializers sat after the arg loop and
  wiped parsed values; --snapper=no was silently ignored. Initializers moved
  before the loop.
README + section renumbering updated.

README.md

@@ -83,6 +83,26 @@ compositors — do not expect the same config story from it.
   Wayland compositors *and* X11 sessions in one menu.
 * Either way `graphical.target` becomes the default.
 
+
+## System settings
+
+Between base setup and the DE menu, the script asks two questions:
+
+1. **Disable SELinux permanently?** — default **no**. Writes `SELINUX=disabled`
+   to `/etc/selinux/config` (backup kept); a reboot applies it. Recommended
+   answer is no.
+2. **Snapper + grub-btrfs + zstd compression** — only asked when `/` is btrfs,
+   default **yes**. Runs, in order:
+   - `btrfs subvolume list /` and the fstab btrfs entries are shown
+   - every fstab btrfs entry with a `subvol=` but no `compress=` gets
+     `,compress=zstd:1` appended (fstab backed up first; re-runs cannot stack
+     duplicate options)
+   - the [SysGuides installer](https://github.com/SysGuides/sysguides-snapper-fedora)
+     sets up snapper (root + home), grub-btrfs, and DNF5 pre/post snapshot hooks,
+     so every `dnf` transaction is snapshotted and `snapper undochange` works.
+
+Unattended equivalents: `--selinux=keep|disabled` and `--snapper=yes|no`.
+
 ## Design rules
 
 1. **Fail loudly, early.** `set -e` is on unless `--debug`. Unsupported distro,

lib/common.sh

@@ -201,3 +201,85 @@ install_nerd_font() {
     fc-cache -f "$dest" >/dev/null 2>&1 || true
     ok "Nerd Font ${family} installed to $dest"
 }
+
+
+#------------------------------------------
+# System: SELinux, Btrfs, snapper
+#------------------------------------------
+# Permanently disable SELinux. Destructive-ish: warn loudly, and remind the
+# user a reboot is needed for the change to take effect.
+disable_selinux() {
+    # FSTAB/SELINUX file overridable for testing on non-Fedora hosts
+    local cfg="${SELINUX_CONFIG:-/etc/selinux/config}"
+    if [[ -f "$cfg" ]] && grep -q '^SELINUX=disabled' "$cfg"; then
+        ok "SELinux already disabled in $cfg."
+        return 0
+    fi
+    warn "Disabling SELinux permanently. This removes a significant layer of"
+    warn "system protection. Only do this if you specifically need it."
+    if [[ -f "$cfg" ]]; then
+        sudo cp "$cfg" "${cfg}.bkp.$(date +%F)"
+        sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' "$cfg"
+    else
+        printf 'SELINUX=disabled\nSELINUXTYPE=targeted\n' | sudo tee "$cfg" >/dev/null
+    fi
+    ok "SELINUX=disabled written to $cfg (backup saved). Reboot to apply."
+}
+
+# Show the btrfs layout, then make sure every btrfs fstab entry compresses
+# with zstd. The sed variant from the SysGuides guide appends ,compress=zstd:1
+# after the subvol= option; we guard it so re-runs cannot stack duplicates.
+ensure_btrfs_compression() {
+    local fstab="${FSTAB_FILE:-/etc/fstab}"
+    info "Current btrfs subvolumes on /:"
+    sudo btrfs subvolume list / 2>/dev/null | sed 's/^/    /' || warn "btrfs subvolume list failed (not btrfs?)"
+
+    info "fstab btrfs entries:"
+    grep ' btrfs ' "$fstab" | sed 's/^/    /' || true
+
+    local fixed=0 line
+    # Only touch btrfs lines that have a subvol= option and no compress= yet.
+    while IFS= read -r line; do
+        if grep -q ' btrfs ' <<<"$line" && grep -q 'subvol=' <<<"$line" && ! grep -q 'compress=' <<<"$line"; then
+            fixed=$((fixed+1))
+        fi
+    done < "$fstab"
+
+    if (( fixed == 0 )); then
+        ok "All btrfs fstab entries already carry a compress= option (or none exist)."
+        return 0
+    fi
+
+    info "Adding compress=zstd:1 to ${fixed} btrfs fstab entrie(s)..."
+    # Backup once per run, then apply the SysGuides sed to every qualifying line.
+    sudo cp "$fstab" "$fstab.bkp.$(date +%F-%H%M)"
+    sudo sed -i '/ btrfs / s/subvol=[^ ,]*/&,compress=zstd:1/' "$fstab"
+    ok "fstab updated. Remount or reboot for compression to take effect:"
+    info "    sudo mount -o remount /  &&  sudo mount -o remount /home"
+}
+
+# Full snapshot setup via the SysGuides installer (snapper + grub-btrfs +
+# DNF5 pre/post snapshot actions). The installer re-validates btrfs itself.
+setup_snapper() {
+    if pkg_installed snapper && [[ -d /.snapshots ]]; then
+        ok "Snapper already configured (config for / exists)."
+        return 0
+    fi
+    if ! findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        warn "Root filesystem is not btrfs; skipping snapshot setup."
+        return 0
+    fi
+    info "Setting up snapper + grub-btrfs (SysGuides installer)..."
+    local tmp
+    tmp=$(mktemp -d)
+    git clone --depth 1 https://github.com/SysGuides/sysguides-snapper-fedora "$tmp/sysguides" \
+        || { err "Could not clone the SysGuides installer."; rm -rf "$tmp"; return 1; }
+    ( cd "$tmp/sysguides" && ./install.sh )
+    local rc=$?
+    rm -rf "$tmp"
+    if (( rc == 0 )); then
+        ok "Snapper + grub-btrfs installed. Every dnf transaction now gets a pre/post snapshot."
+        info "Try it:  snapper ls   |   snapper status 1..2   |   sudo snapper undochange 1..2"
+    fi
+    return $rc
+}

setup.sh

@@ -19,6 +19,8 @@ DEBUG_MODE=false
 ASSUME_YES=false
 DE=""
 TWM=""
+SELINUX_OPT=""
+SNAPPER_OPT=""
 
 usage() {
     cat <<'EOF'
@@ -32,6 +34,8 @@ Usage:
 Options:
   --de=NAME     gnome | plasma | xfce | none
   --twm=NAME    chadwm | hyprland | mango | niri | none
+  --selinux=X   keep | disabled   (asked, default keep)
+  --snapper=X   yes | no          (asked when / is btrfs, default yes)
   -y, --yes     never prompt (requires --de and --twm)
   -d, --debug   pause after each section instead of aborting on error
   -h, --help    show this help
@@ -53,6 +57,8 @@ for arg in "$@"; do
         -d|--debug) DEBUG_MODE=true ;;
         -y|--yes)   ASSUME_YES=true ;;
         --de=*)     DE="${arg#*=}" ;;
+        --selinux=*) SELINUX_OPT="${arg#*=}" ;;
+        --snapper=*) SNAPPER_OPT="${arg#*=}" ;;
         --twm=*)    TWM="${arg#*=}" ;;
         -h|--help)  usage; exit 0 ;;
         *)
@@ -201,8 +207,62 @@ ask_choice() {
     done
 }
 
+# Ask a yes/no question; $2 is the default (yes|no). Honours --yes.
+ask_yes_no() {
+    local prompt="$1" default="$2" answer
+    if [[ "$ASSUME_YES" == "true" ]]; then
+        echo "$default"
+        return 0
+    fi
+    while true; do
+        read -t 60 -rp "$prompt [y/n] (default: $default): " answer || printf "\n"
+        answer="${answer,,}"
+        [[ -z "$answer" ]] && answer="$default"
+        case "$answer" in
+            y|yes) echo "yes"; return 0 ;;
+            n|no)  echo "no";  return 0 ;;
+        esac
+        err "Please answer y or n."
+    done
+}
+
 #------------------------------------------
-# 3 Desktop environment selection
+# 3 System settings
+#------------------------------------------
+SELINUX_DISABLED=false
+BTRFS_SNAPPER=false
+
+if [[ -z "$SELINUX_OPT" ]]; then
+    step "3 System settings"
+    rule
+    printf "\n"
+    printf "\n"
+    choice=$(ask_yes_no "Disable SELinux permanently? (not recommended)" "no")
+    [[ "$choice" == "yes" ]] && SELINUX_DISABLED=true
+    printf "\n"
+    if findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        ok "Root filesystem is btrfs — snapshot support is available."
+        choice=$(ask_yes_no "Set up snapper + grub-btrfs snapshots and zstd compression?" "yes")
+        [[ "$choice" == "yes" ]] && BTRFS_SNAPPER=true
+    else
+        info "Root filesystem is not btrfs; skipping snapshot setup."
+    fi
+fi
+
+case "${SELINUX_OPT:-}" in
+    disabled) SELINUX_DISABLED=true ;;
+    keep|"")  : ;;
+    *) err "Unknown --selinux value: '$SELINUX_OPT' (keep|disabled)"; exit 2 ;;
+esac
+case "${SNAPPER_OPT:-}" in
+    yes)   BTRFS_SNAPPER=true ;;
+    no|"") : ;;
+    *) err "Unknown --snapper value: '$SNAPPER_OPT' (yes|no)"; exit 2 ;;
+esac
+pause_if_debug
+
+#------------------------------------------
+# 4 Desktop environment selection
 #------------------------------------------
 if [[ -z "$DE" ]]; then
     step "3 Desktop environment"
@@ -232,10 +292,10 @@ esac
 pause_if_debug
 
 #------------------------------------------
-# 4 Tiling window manager selection
+# 5 Tiling window manager selection
 #------------------------------------------
 if [[ -z "$TWM" ]]; then
-    step "4 Tiling window manager"
+    step "5 Tiling window manager"
     rule
     printf "\n"
     echo "  1) Niri       (Wayland, scrollable)"
@@ -290,6 +350,17 @@ run_module() {
 step "5 Installation"
 rule
 
+if [[ "$SELINUX_DISABLED" == "true" ]]; then
+    disable_selinux
+    pause_if_debug
+fi
+
+if [[ "$BTRFS_SNAPPER" == "true" ]]; then
+    ensure_btrfs_compression
+    setup_snapper
+    pause_if_debug
+fi
+
 if [[ "$DE" != "none" ]]; then
     run_module "$SCRIPT_DIR/modules/de/${DE}.sh"
     pause_if_debug
@@ -303,10 +374,11 @@ fi
 #------------------------------------------
 # 6 Done
 #------------------------------------------
-step "6 Summary"
+step "7 Summary"
 rule
 ok "DE:  $DE"
 ok "TWM: $TWM"
+ok "SELinux: $([[ "$SELINUX_DISABLED" == "true" ]] && echo disabled || echo keeping)"; ok "Btrfs snapshots: $([[ "$BTRFS_SNAPPER" == "true" ]] && echo yes || echo skipped)"
 DM=$(detect_display_manager)
 ok "Display manager: ${DM:-none}"