csd4ni3l
released this
2026-10-12 20:43:32 +02:00
| 31 commits to main since this release
- switch all VMs from cachyos to linux mainline, they gained nothing from cachyos
- new kernel_lockdown option that actually works: framework16 gets integrity, VMs get confidentiality
- module.sig_enforce is now enabled too, it works on mainline
- machine-id is random again instead of hardcoded in the config
- faillock now covers run0, no longer silent, 30m unlock time
- replaced nosuid on /nix with a build time suid checker, since nosuid also drops capabilities
- dropped the plaintext NTP pools nixos enables by default
- trimmed unneeded kernel modules from the VMs to shrink the attack surface
- more blacklist entries: thunderbolt_stream, ip_vti, ip6_vti, nfc, radio tuners
- remove host crowdsec on VPS, it never actually worked
- steam is sandboxed now, so games and a compromised client stay in the jail
- every sandboxed app gets a tmpfs ~/.cache, so a poisoned cache cannot persist
- XDG_CONFIG_HOME set in all sandboxes, default jail trimmed of unneeded bind mounts
- zed gets ~/.ssh and the git config read only, plus /usr/bin/env so eslint works
- keyring-access combinator added to the jail lib, jail dirs now split per app so you can pick what you want
- slick added, sandboxed, with declarative settings and a persistent session
- fluxer canary packaged and sandboxed
- mcp-gateway on homelabvm merges all mcps into one image behind one port and one bearer token
- ntfy container plus freshrss, musicbrainz, lrclib, nixos and open-meteo mcps
- open terminal mcp with its own image, more shell tools, works rootless
- playwright mcp is now patchright in isolated mode
- openwebui gets a persistent workdir
- arkenfox user.js tracks master again
- point /etc/ssl/cert.pem at the ca bundle, fixes tools like uv python
- dmemcg-booster bumped to v0.1.3
- forgejo actions bump nixpkgs, flake inputs and pinned container images every three days and open a PR
- daily timer on every VM pulls the repo into /persist and rebuilds if the commit changed
- daily podman auto-update timer for AutoUpdate=registry images
- .gitignore added
- README overhauled
- flake.lock updated
Downloads