Open BSD, except it doesn’t support flat pack. But it’s everything else you want

But, I wouldn’t recommend using it as a desktop. If you want real security and isolation, look at qubes for your desktop.

Qubes uses xen, a real microkernel, as the hypervisor, which reduces the risk surface of VM escapes tremendously, then you run your untrusted services in their own vms.

In my production systems, and in my home systems, and in my gaming computers, I turn swap off. There’s no good reason to wear out disc writes. In production systems, I’d rather have something fail hard, then get slower and slower and slower falling behind.

Quite frankly, there’s no good reason to have swap on anymore, memory is huge. Most programs don’t need as much as they use. You can set memory pressure in systemd, telling programs to reduce their usage, and giving them individual hard cutoffs, so something like Prometheus can’t take down your whole system just because it’s got a memory leak.

Yes and ask me later : this isn’t informed consent, it’s just badgering

At least the photo isn’t ai generated

oh yeah, it does that!

Get a ai agent, run it on your server as a un privileged user and ask it to do a security audit for you, delete the account after. If you want to get fancy make a new VM and give it root and ask it to probe your production host.

Everyone’s advice here is great, but you need to test your config and systems for gaps.

https://nixarr.com/

Works a treat for me!

But 100% is a big ask. There are always things to improve or fix

There are multiple ways to use the duress PIN/password feature including writing it down on a phone case or a paper kept in a wallet. People should carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device. GrapheneOS doesn’t require it to protect data from being extracted from the device, but it takes recovering it completely off the table even with the PIN/password for each profile on the device.

This is a important distinction. If you don’t volunteer information, but someone guesses that the pin written on the phone unlocks the phone… you haven’t lied, or done any wilfill action to trigger a delete.