Do your policy enforcement at the port level, connect the printer with a physical cable, that way even if the printer gets compromised and changes it’s Mac your rules still apply.

Also setup your network alert system to notify you when a a new driver is available and the printer is behind so you can manually apply security updates.

1 is fine from the port level

2 is great, but more brittle

2.5 only allow incoming connections to the vlan on printer ports, and outgoing mdns

Depending on your threat model, you might need 3, if the printer is malicious, and printer drivers are also malicious, they can proxy information from the printer through a client device to the internet.

You named the community a 4 letter very charged word

I’m glad you have your community but cross posting every one of your posts to every geographic community is rather spamy.

House in the woods near running water with plenty of game

Diet. Many people report reflux resolving when doing ketogenic or zero carb diets.

I was going to say this same thing exactly.

The benefit of being nice is living in a nice place with nice people, not winning some zero sum game of immediate gratification

Play a video game that uses lots of talking and team coordination, and play on the Chinese servers.

Wardogs, hell let loose, etc

I setup a simplex alerting bridge so grafana can create lab alerts to a simplex group, messages disappear when alerts are resolved.

This is great! much more organized then my fever dream local dashboard!

If you want https it’s gotta be a external DNS record anyway, might as well point to internal ips

Depending on how paranoid your setup is not everything will use the DHCP provided DNS servers

Open BSD, except it doesn’t support flat pack. But it’s everything else you want

But, I wouldn’t recommend using it as a desktop. If you want real security and isolation, look at qubes for your desktop.

Qubes uses xen, a real microkernel, as the hypervisor, which reduces the risk surface of VM escapes tremendously, then you run your untrusted services in their own vms.

In my production systems, and in my home systems, and in my gaming computers, I turn swap off. There’s no good reason to wear out disc writes. In production systems, I’d rather have something fail hard, then get slower and slower and slower falling behind.

Quite frankly, there’s no good reason to have swap on anymore, memory is huge. Most programs don’t need as much as they use. You can set memory pressure in systemd, telling programs to reduce their usage, and giving them individual hard cutoffs, so something like Prometheus can’t take down your whole system just because it’s got a memory leak.

In a gas town type scenario, where a agent is orchestrating a tree of other agents, there maybe many concurrent shells and commands at the same time. Does your output tracking have the ability to show individual sessions / streams coherently?

Ability to track environment variables in this? I can see the utility in debugging. Something like a full closure for the environment of each command (file system snapshot id, environment variables, command, output)

it’s interesting, i see the value for being able to inspect the history and outputs of agents running on dev vms - the web ui is a nice touch for that

What LLM and model and effort generated this code? I see the AI has been working for a week on this.

No mention of total space limitations for the sqlite database overall (rather then per output)

oh yeah, it does that!

Get a ai agent, run it on your server as a un privileged user and ask it to do a security audit for you, delete the account after. If you want to get fancy make a new VM and give it root and ask it to probe your production host.

Everyone’s advice here is great, but you need to test your config and systems for gaps.

https://nixarr.com/

Works a treat for me!

But 100% is a big ask. There are always things to improve or fix

Why not a tablet and keyboard?

Run your own Lemmy instance or Mastodon instance. You can say whatever you want, it’s absolute freedom of speech. People don’t have to listen to you, and many people may defederate, but that’s their choice