Because of recent events, I've been thinking someone should make an s6 based replacement for nixos.

It turns out, it almost exists:
https://www.liminix.org/

"Almost", because this project focuses on routers.

#nix #nixos #liminix #s6 #s6rc

Seriously looking into flashing OpenWRT onto my ER-X since the last firmware upgrade. #Liminix would be even better, but I don't have a spare to test with and it would be a new hardware target. #theFoundary

I'll have to look at my budget, maybe I can replace my main router with one of the supported liminix devices.

#liminix had an external security audit last year (thanks to Radically Open Security for performing and to NGI0 for enabling).

Both of the actual findings they produced were to do with sloppy path handling, and now fixed, but they also offered advice on the default firewall rules

Which I am now working on but haven't actually fixed because when I started looking at it I realised that the default firewall rules have int and ppp0 hardcoded as interface names. Which although usually correct, might not be the actual interfaces if you've had some connectivity problems/failures/general weird shit because it could be ppp1 or ppp23. Or maybe your upstream wasn't a PPP connection in the first place.

So, when I've cleaned this up and merged the branch we're going to have a "zone" notation to the firewall so that you will be able to specify which interface services are associated with which zones. It's backed by a longrun service that maintains some nftables sets called @lan, @wan, @dmz or whatever other names you chose, and adds the interface managed by each service once the service knows what it is. So everything will be fine and dandy even if the interface name isn't static/known at build time.

https://gti.telent.net/dan/liminix/compare/main...firescape#diff-0c73ccdd98654afbd21fe4c4276307a13b604f62