CustomOS3.1 OBSIDIAN
System posture
Sample values for a default install. On CustomOS this panel reads the running system.
Firewall
nftables active
inbound default-deny · always on
Kill switch
Not armed
arms when a wg*/tun* tunnel is up
IDS
Suricata · IDS
installed by default · detection, not blocking
Live medium
dm-verity
squashfs verified at boot · fail-closed
Disk
LUKS2 unlocked
argon2id · TPM2 sealing opt-in
Boot chain
Secure Boot
shim → GRUB → kernel (installed, amd64)
| Control | Default install | Ref. |
|---|---|---|
| Full-disk encryption (LUKS2, argon2id) | on | §2.1 |
| LUKS key sealed to TPM2 | opt-in, post-install | §2.1bis |
| Secure Boot of the installed system | on (amd64) | §2.1ter |
| Signed UKI (kernel + initrd + cmdline) | opt-in (amd64 + UEFI) | §2.19 |
| nftables inbound default-deny | on | §2.2 |
| Tunnel-only kill switch | opt-in profile | §2.2 |
| AppArmor enforcing · auditd · sysctl hardening | on | §2.3–2.5 |
| Signed updater (TUF, Ed25519) + TPM anti-rollback | on | §2.6 |
| dm-verity of the live medium | on | §2.9 |
| Block dm-verity of /usr (installed) | opt-in | §2.17 |
| AIDE file integrity + Suricata IDS | on (detection, not blocking) | §2.13 · §2.16 |
| Post-quantum crypto in traffic | SSH key exchange only, SSH opt-in | §3.4 |
| VPN tunnel / Tor | clients in image, nothing configured | §3.5 |
Source of truth: docs/THREAT_MODEL.md in the repository — not this demo.
$ harden-audit --live
press Run to see the (demo) output
The installer minimum: 12+ characters and 3+ character classes. Checked as a pure function; nothing is stored.