← System

Security

Firewall: nftables, default-drop with SSH open (see Networking).

Mandatory access control: the kernel has both AppArmor and SELinux compiled in but dormant (not in the active LSM set), so they cost nothing until enabled. The AppArmor userland ships so profiles can be loaded without a kernel rebuild; AppArmor is the lighter path, SELinux is available for those who require it.

Intrusion scanning: rkhunter runs a quiet nightly scan via cron, logging warnings to /var/log/rkhunter.log.

Privilege & auth: sudo (wheel = admin) over PAM. TLS trust is the CA bundle + OpenSSL/GnuTLS.

Update integrity: the wgpkg repo index is OpenPGP-signed and verified against a key pinned in the image — see Packaging & updates.