Encrypt your computer (which will make it harder for someone to get into it). Use more complex passwords (lowercase, uppercase, numbers and symbols). Use open-source software (or at least the ones that are fully offline / can turn off tracking). Using physical devices (not bluetooth) where possible (as someone could be nearby and see that you use that brand of mouse). Turn off microphone and camera when not using it (physical switch is better, if possible).

switch to temple os

/s

i love that, for homelabbing, NixOS does a lot of secure things by default. firewall ports are opened explicitly and declaratively and services run under their own user with their own data directory. everything, even on the same local machine, communicates over HTTPS.

also, IMO the way people should have been running agents from the beginning: agents get their own user and a pared down list of tools and specific directories with specific read/write access and their own git clone of whatever code i’m working on (i hate working on the same files as an agent). (running a local Qwen 27B with Hermes)

other than that the normal stuff like fail2ban, random SSH port, VPN for remote access, Adguard, etc.

I am also interested in this. I like that the execution of binaries is tied to the nix-store, but I am sure there are some things to be done to harden it further.

https://github.com/buildplan/du_setup

Impermanence

Edit: sorry I didn’t link. It has been an incredible overnight upgrade to security for me. I have all of my stateful directories LUKS encrypted and copying on write to a btrfs subvolume that gets cloned over at boot to each time and as a result, I have a minuscule attack surface. On top of that, all of the machines on my network are fully impermanent and write their state to a local NAS. It’s pretty elegant. I highly recommend rehearsing the switch to impermanent via a QEMU VM and not fully making the switch until your data is backed up.

I did a rehearsal on my home directory that took a few iterations to catch all of the files I needed to declare. A diff on the two btrfs directories each reboot made that fairly easy. I wish I could share the config but it would dox the shit out of me!

Reboot them once in a while

Switched to stable to get my system to fucking build and boot again, so I can get all the fixes