Do your policy enforcement at the port level, connect the printer with a physical cable, that way even if the printer gets compromised and changes it’s Mac your rules still apply.

Also setup your network alert system to notify you when a a new driver is available and the printer is behind so you can manually apply security updates.

1 is fine from the port level

2 is great, but more brittle

2.5 only allow incoming connections to the vlan on printer ports, and outgoing mdns

Depending on your threat model, you might need 3, if the printer is malicious, and printer drivers are also malicious, they can proxy information from the printer through a client device to the internet.

I setup a simplex alerting bridge so grafana can create lab alerts to a simplex group, messages disappear when alerts are resolved.

This is great! much more organized then my fever dream local dashboard!

If you want https it’s gotta be a external DNS record anyway, might as well point to internal ips

Depending on how paranoid your setup is not everything will use the DHCP provided DNS servers

In my production systems, and in my home systems, and in my gaming computers, I turn swap off. There’s no good reason to wear out disc writes. In production systems, I’d rather have something fail hard, then get slower and slower and slower falling behind.

Quite frankly, there’s no good reason to have swap on anymore, memory is huge. Most programs don’t need as much as they use. You can set memory pressure in systemd, telling programs to reduce their usage, and giving them individual hard cutoffs, so something like Prometheus can’t take down your whole system just because it’s got a memory leak.

In a gas town type scenario, where a agent is orchestrating a tree of other agents, there maybe many concurrent shells and commands at the same time. Does your output tracking have the ability to show individual sessions / streams coherently?

Ability to track environment variables in this? I can see the utility in debugging. Something like a full closure for the environment of each command (file system snapshot id, environment variables, command, output)

it’s interesting, i see the value for being able to inspect the history and outputs of agents running on dev vms - the web ui is a nice touch for that

What LLM and model and effort generated this code? I see the AI has been working for a week on this.

No mention of total space limitations for the sqlite database overall (rather then per output)

oh yeah, it does that!

Get a ai agent, run it on your server as a un privileged user and ask it to do a security audit for you, delete the account after. If you want to get fancy make a new VM and give it root and ask it to probe your production host.

Everyone’s advice here is great, but you need to test your config and systems for gaps.

https://nixarr.com/

Works a treat for me!

But 100% is a big ask. There are always things to improve or fix

Have one VPN attached in a work profile and another in your private space

I promise you, if you live in an RV, you are not anonymous. You’re the dude who lives in an RV, every body knows who you are in your community.

If you want to be anonymous, blend in with the crowd, do the average thing everybody is doing, you’ll not stand out and people will just forget they’ve ever seen you.

Sure kraken knows you bought moneo, but once it’s off their servers they don’t know what you spent it it. It’s like going to a ATM, the bank knows what you took out, but not where the money went.

Always on vpn, no Google play services, and one of:

New pipe / pipe pipe

Grayjay

Firefox (ironfox) plus unblock origin

Portable phone: GOS

Desk phone (wifi only): opionated apps that won’t run on GoS… so basically banking

Rooting a phone: it changes your security model, so it’s really about the risk reward payoff. Your risk surface area expands greatly.

In general look at something like qubes, even if you won’t run it, it’s a good thought experiment to see how you would segment things into indivisible risk domains and workflows

Sandbox google in a profile you can turn off, use it to install your app through the play store then copy that app to another profile. You can turn off the sandbox profile until you want to update.

I didn’t narrow it down, I suspect it was fdroid

I’ve also had a app refuse to start if another app is installed (not running, just installed). My gos workaround was putting that opinionated app in its own profile.

The anonymous part will depend on how you get your sms verification.