My hardened dendritic NixOS configuration for my laptop & VMs. Uses CachyOS kernel, has lots of hardening options, uses modern Wayland, and includes lots of tools and apps.

• Config Layout: Dendritic, everything is modular
• Secrets: Managed by sops, using post-quantum age encryption

Framework16

• WM: niri
• Shell: Noctalia
• Browser: Declarative Firefox managed via Home Manager and Enterprise policies (No AI, no telemetry, anti-fingerprinting, arkenfox, extensions & settings locked to good defaults (ublock, canvasblocker, bitwarden))
• Theme: Catpuccin Mocha Compact
• Gaming: Steam, MangoHud, GameMode, Gamescope, Anime Game Launcher on Linux (AAGL)
• Virtualization: Podman + virt-manager (QEMU)
• Bootloader: Limine with Secure Boot
• File System: ext4 protected by LUKS
• Kernel: CachyOS-latest-zen4
• Jail.nix: GUI (and some CLI) apps are sandboxed and have least-privilege access to system resources and files where possible.
• Impermanence: Only select directories and files are kept on each reboot, / is a tmpfs, and the system remains clean.
• Kernel Hardening: SecureBlue module blacklist, SecureBlue kernel flags and some extras, locked kernel & kernel modules at runtime
• System Hardening: SecureBlue sysctl options and some extras, NTS (Network Time Security), closed firewall, disabling unneccessary services, extensive systemctl hardening, USBGuard is implemented, PAM faillock is in use and locks after 3 wrong tries
• No SUID: no SUID binaries at all, SUIDs replaced by capabilities or removed altogether, run0 instead of sudo, noexec on ~/.cache and /boot, nosuid on all filesystems
• Apps & Tools: Rust, Python(uv), Hacking, OSINT, C debugging, Zed Editor, all the great shell tools, and lots of random stuff

The security part of this configuration is currently incomplete, as NixOS does not currently have stable MAC (Mandatory Access Control) support. Similar sandboxing is being done using jail.nix. Once AppArmor as well as apparmod.d will stabilize on NixOS, it will be implemented for maximum security.

PublicVM & HomeLabVM

• Containers: Rootless podman
• Users: privileged user for management, unprivileged deploy/guest user for deployment
• Bootloader: systemd-boot
• File System: ext4
• Kernel: CachyOS-latest
• No SUID: no SUID binaries at all, SUIDs replaced by capabilities or removed altogether, run0 instead of sudo, noexec on ~/.cache and /boot, nosuid on all filesystems
• Impermanence: Only select directories and files are kept on each reboot, / is a tmpfs, and the system remains clean.
• Kernel Hardening: SecureBlue module blacklist, SecureBlue kernel flags and some extras, locked kernel & modules at runtime
• System Hardening: SecureBlue sysctl options and some extras, NTS (Network Time Security), closed firewall, disabling unneccessary services, extensive systemctl hardening, PAM faillock is in use and locks after 3 wrong tries

Mirrors