Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md #7

Merged
naturallaw777 merged 2 commits from staging-dev into stable 2026-05-23 15:48:56 -05:00
Conversation 0 Commits 2 Files Changed 1
+7 -22
1 changed files with 7 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -22
View File
@@ -2,21 +2,16 @@
<img src="iso/assets/sovran-hub-icon.svg" alt="Sovran Systems" width="160" /> <img src="iso/assets/sovran-hub-icon.svg" alt="Sovran Systems" width="160" />
# Sovran_SystemsOS — Internal Mirror # Sovran_SystemsOS
Private development mirror of **Sovran_SystemsOS**.
Canonical source lives on Gitea — this repo is for internal work only.
`Base Development` · NixOS Flake · AGPL-3.0 `Base Development` · NixOS Flake · AGPL-3.0
[Canonical source (Gitea)](https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS) · [Public site](https://sovransystems.com) [Sovran Systems](https://sovransystems.com)
</div> </div>
--- ---
> **Heads up:** This repo is private. End users never see it. Public docs, build instructions, and marketing copy live on the website and on Gitea — do not duplicate them here. This README is for internal contributors.
## Table of Contents ## Table of Contents
1. [What This Repo Is](#what-this-repo-is) 1. [What This Repo Is](#what-this-repo-is)
@@ -119,26 +114,20 @@ Internal commands. Run from the flake root.
## Networking & Reverse Proxy ## Networking & Reverse Proxy
- **Firewall on by default** (`networking.firewall.enable = true`). The only port opened at host level is **UDP 5353** for mDNS (Avahi). Every other port is opened by the module that needs it. - **Firewall on by default** (`networking.firewall.enable = true`). Port are opened by the module that needs it.
- **Caddy** (`modules/core/caddy.nix`) terminates TLS for all HTTP services. Operator vhosts go through `sovran_systemsOS.caddy.extraVirtualHosts`. - **Caddy** (`modules/core/caddy.nix`) terminates TLS for all HTTP services.
- **Njalla** dynamic DNS (`modules/core/njalla.nix`) keeps records in sync via a 15-minute cron job. - **Njalla** dynamic DNS (`modules/core/njalla.nix`) keeps records in sync via a 15-minute cron job.
- **Avahi** publishes `sovransystemsos.local` on the LAN.
- **Tor** is enabled with `torsocks` available. The Bitcoin stack uses it directly — see [Security Posture](#security-posture). - **Tor** is enabled with `torsocks` available. The Bitcoin stack uses it directly — see [Security Posture](#security-posture).
- **SSH:** localhost-only by default (`core/sshd-localhost.nix`). Public OpenSSH is opt-in (`modules/sshd.nix`). - **SSH:** localhost-only by default (`core/sshd-localhost.nix`).
## Security Posture ## Security Posture
Facts about the defaults, straight from `configuration.nix` and the modules: Facts about the defaults, straight from `configuration.nix` and the modules:
- **Reproducible builds.** Every artifact derives from `flake.lock`. The same commit produces the same OS. - **Reproducible builds.** Every artifact derives from `flake.lock`. The same commit produces the same OS.
- **Bitcoin stack over Tor.** In `modules/bitcoinecosystem.nix`, `bitcoind`, `electrs`, and `lnd` all set `tor.enforce = true`, and onion services are exposed for `bitcoind`, `electrs`, `lnd`, and friends. - **Bitcoin stack over Tor.** In `modules/bitcoinecosystem.nix`, `bitcoind`, `electrs`, and `lnd` all set `tor.enforce = true`, and onion services are exposed for `bitcoind`, `electrs`, `lnd`, and friends.
- **Firewall on, public sshd off, RDP off, auto-login off.** - **Firewall on, public sshd off, RDP off, auto-login off, fail2bain active**
- **EFI** is mounted with `umask=0077`.
- **Kernel surface trimmed.** `boot.blacklistedKernelModules = [ "rxrpc" ];` - **Kernel surface trimmed.** `boot.blacklistedKernelModules = [ "rxrpc" ];`
- **Emergency mode disabled** (`systemd.enableEmergencyMode = false`).
- **GNOME Keyring** wired into PAM (`gdm-password`, `gdm-autologin`); the keyring file is declaratively created with `0600` perms via `systemd.tmpfiles`.
- **PostgreSQL** is local-only (`local trust`, `127.0.0.1/32 trust`, `::1/128 trust`). Not exposed to the network.
- **Secrets** are materialized through `modules/credentials.nix` and `nix-bitcoin-secrets` (`/etc/nix-bitcoin-secrets/`, included in backups).
- **Weekly garbage collection** with `--delete-older-than 7d`. - **Weekly garbage collection** with `--delete-older-than 7d`.
## Backups & Recovery ## Backups & Recovery
@@ -161,7 +150,3 @@ The second drive is mounted by label (`BTCEcoandBackup`) with `nofail` so a miss
## License ## License
Licensed under the **GNU Affero General Public License v3.0** — see [`LICENSE`](./LICENSE). Licensed under the **GNU Affero General Public License v3.0** — see [`LICENSE`](./LICENSE).
---
<sub>Internal mirror. Public copy lives on Gitea.</sub>