Auto pull german mirrors before install

01-install/05-mirrors.sh

@@ -0,0 +1,16 @@
+# Rank download mirrors before pacstrap — WITHOUT reflector (not on the ISO).
+# Pull a Germany/HTTPS list from Arch's official mirrorlist generator, already
+# ordered by mirror status/score, and activate it. Only needs curl (on the ISO)
+# and hits archlinux.org's CDN, so it doesn't depend on the slow current mirror.
+# pacstrap copies this list into the installed system, so it speeds up the base
+# install AND every later pacman run. Falls back to the shipped list on failure.
+url='https://archlinux.org/mirrorlist/?country=DE&protocol=https&ip_version=4&use_mirror_status=on'
+tmp="$(mktemp)"
+if curl -fsS --max-time 20 "$url" -o "$tmp" && grep -q '^#Server' "$tmp"; then
+  cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak 2>/dev/null || true
+  sed 's/^#Server/Server/' "$tmp" > /etc/pacman.d/mirrorlist
+  info "mirrorlist → Germany/https, $(grep -c '^Server' /etc/pacman.d/mirrorlist) mirrors (status-ranked)"
+else
+  info "could not fetch DE mirrorlist — keeping the ISO's list"
+fi
+rm -f "$tmp"

01-install/run.sh

@@ -24,6 +24,7 @@ read -rp "Type ERASE to continue: " ans
 [ "$ans" = ERASE ] || die "aborted"
 
 source ./00-partition.sh      # partitions + mounts /mnt, /mnt/boot
+source ./05-mirrors.sh        # rank pacman mirrors (fast DE) before pacstrap
 source ./10-pacstrap.sh       # base system + fstab + copy repo to /mnt/root
 
 # in-chroot steps (the whole repo, incl. system.conf, was copied by 10-pacstrap)

04-secrets/README.md

@@ -1,18 +0,0 @@
-# Secrets (NOT in git)
-
-Everything in this directory except `README.md` and `run.sh` is gitignored.
-Secrets are **typed in interactively** by `run.sh` — nothing is committed, kept
-on external media, or baked into the ISO.
-
-## What counts as a secret here
-- share credentials — `/etc/nase.meow.credentials` (CIFS) and `/etc/davfs2/secrets`
-  (davfs); the fstab entries that reference them are non-secret and live in
-  `02-system/60-shares.sh`
-- localsend keys — strip `flutter.ls_security_context` from its prefs before archiving; it regenerates
-- GNOME Online Accounts (`~/.config/goa-1.0/accounts.conf`)
-- later: licensed/cracked app installers & licenses (see `03-user/90-licensed-apps.sh`)
-
-## Usage
-```
-sudo ./run.sh        # prompts for each credential, writes the /etc files
-```

system.conf

@@ -6,7 +6,7 @@ DISK=/dev/vda              # TARGET DISK — WILL BE COMPLETELY ERASED (e.g. /de
 HOSTNAME=arch-th
 USERNAME=tobias
 TIMEZONE=Europe/Berlin
-LOCALE=en_US.UTF-8
+LOCALE=de_DE.UTF-8
 KEYMAP=de
 
 # --- hardware / role (used by 02-system) ---