CustomOS · Obsidian

Network

Network services

Default install: nothing listens, no tunnel is configured.

VPN OFF

Tor

In the image, masked. Opt in at install (CUSTOMOS_TOR=1) or later: customos-netsvc tor enable. A SOCKS proxy on 127.0.0.1:9050, not a system-wide tunnel.

WireGuard

wg / wg-quick installed. No peer and no /etc/wireguard/*.conf out of the box.

SSH server

Masked, port 22 closed. When opted in: hardened config + hybrid post-quantum key exchange.

Kill switch

Opt-in nftables profile. Arms only when a wg*/tun* interface is up — until then egress stays open.

DNS

System resolver. DoH/DoT is declared in config but no script wires it up yet.

Toggles are read-only status, not switches. On CustomOS they reflect systemctl, wg-quick and /sys/class/net.

Leak protection

✓ fail-closed nftables kill switch (protects a tunnel once you configure one) ✓ inbound default-deny, no exposed services○ per-connection MAC randomization — declared, not wired up ○ DNS leak protection — resolver not wired up ○ no dVPN / OpenVPN client

customos-netsvc

$ customos-netsvc tor status tor: masked (not opted in) $ customos-netsvc ssh status ssh: masked · port 22 closed (sample output)