#liminix — Public Fediverse posts

Because of recent events, I've been thinking someone should make an s6 based replacement for nixos.

It turns out, it almost exists:
https://www.liminix.org/

"Almost", because this project focuses on routers.

#nix #nixos #liminix #s6 #s6rc

Because of recent events, I've been thinking someone should make an s6 based replacement for nixos.

It turns out, it almost exists:
https://www.liminix.org/

"Almost", because this project focuses on routers.

#nix #nixos #liminix #s6 #s6rc

#liminix had an external security audit last year (thanks to Radically Open Security for performing and to NGI0 for enabling).

Both of the actual findings they produced were to do with sloppy path handling, and now fixed, but they also offered advice on the default firewall rules

Which I am now working on but haven't actually fixed because when I started looking at it I realised that the default firewall rules have int and ppp0 hardcoded as interface names. Which although usually correct, might not be the actual interfaces if you've had some connectivity problems/failures/general weird shit because it could be ppp1 or ppp23. Or maybe your upstream wasn't a PPP connection in the first place.

So, when I've cleaned this up and merged the branch we're going to have a "zone" notation to the firewall so that you will be able to specify which interface services are associated with which zones. It's backed by a longrun service that maintains some nftables sets called @lan, @wan, @dmz or whatever other names you chose, and adds the interface managed by each service once the service knows what it is. So everything will be fine and dandy even if the interface name isn't static/known at build time.

https://gti.telent.net/dan/liminix/compare/main...firescape#diff-0c73ccdd98654afbd21fe4c4276307a13b604f62

Adding "revert to previous config" instructions to #liminix that effectively include "reboot into a rescue system (this part is left as an exercise for the reader)" feels like a bit of a cheat, but I have made it substantially more straightforward to do anything useful once you have rebooted into some alternate maintenance system, so it's still an improvement

https://gti.telent.net/dan/liminix/src/branch/main/doc/admin.rst#L207 raw link because I'm going to bed while the docs format. At least, I hope that's what they're going to do

# uname -a
Linux rotuer 5.15.137 #1 SMP Mon Dec 23 23:16:37 UTC 2024 aarch64

(Belkin RT3200 aka Linksys E8450)

In my brain there was a lot more work left to do to get a useful #liminix aarch64 working.

(I am sure there is more work left to do, but the current state is that it boots from flash with only a little manual uboot fiddling, so that's further along than I'd incorrectly remembered it to be)

I thought it would be good if I could allow my #liminix devices to log somewhere central without also allowing the rest of the internet to log there too.

The plan is to put the logging socket behind TLS and require client certs, but that then only transforms the problem into "how do I get client certs onto all these basically ephemeral devices"

I've borrowed the pattern from the Puppet CA setup: the clients generate their own private keys and CSRs, and then send them to the server which signs them automatically if if they look legit (which basically means, if they have some kind of pre-shared key embedded in them). But I don't need or want the rest of Puppet, couldn't find anything else that would do it (there is step-ca which looks otherwise to be good and useful and might do this thing but honestly I couldn't tell) so I went old-school-NIH and wrote a small #Fennel program for it.

It did require a brief detour into making a PR for luaossl and it's little more than PoC-quality so far, but that notwithstanding I am once again pleasantly surprised at just how straightforward it is to get things done in Fennel

https://gti.telent.net/dan/certifix

Two new sections of #liminix documentation

• https://www.liminix.org/doc/admin.html#reinstalling-on-a-running-system finally, I have written some instructions for "levitate", the mechanism for reflashing an installed system over the network without writing to the flash that the system is running from

• https://www.liminix.org/doc/admin.html#services-on-a-running-system the s6-rc cheat sheet that I wish I'd had two months ago (though tbf https://www.skarnet.org/software/s6-rc/faq.html is close)

https://www.liminix.org/2024/07/09/surfeit-of-surfaces.html #liminix updates have been conspicuous by their absence lately, mostly because oh god not that thing again. But here's some recent news.

feels a bit yak-shavey, but I have written an expect script to reduce the number of manual steps involved in tftpbooting a #liminix device

https://gti.telent.net/dan/liminix/commit/58bec8a40f49104db1b3143630c5163ddea87263

I think I'm only a few steps away from making it able to use an LTE modem for wan connectivity, but it's not impossible that one of those steps will need 3.5 league boots

You only need:

- https://github.com/RaitoBezarius/colmena/tree/custom-activation
- https://github.com/RaitoBezarius/liminix/tree/colmena--compat

But that's not the end of it. Once you can evaluate #Liminix systems, you kind of want to be able to activate them.

Activate refers to the operation of "setting" a new deployment in place on a target, you often hear about switch-to-configuration.pl (click on the link) for the #NixOS ecosystem.

Things like #Liminix have the same problem, except that on an embedded system, you cannot do a lot of actions. 3/???

You only need:

- https://github.com/RaitoBezarius/colmena/tree/custom-activation
- https://github.com/RaitoBezarius/liminix/tree/colmena--compat

But that's not the end of it. Once you can evaluate #Liminix systems, you kind of want to be able to activate them.

Activate refers to the operation of "setting" a new deployment in place on a target, you often hear about switch-to-configuration.pl (click on the link) for the #NixOS ecosystem.

Things like #Liminix have the same problem, except that on an embedded system, you cannot do a lot of actions. 3/???

In the deployment ecosystem, we have tools like colmena that enable you to deploy a set of expressions to a target.

The issue again is that colmena is NixOS-specific.

But it does not have to be! Things like #Liminix share the NixOS module system (yeah confusing naming) with #NixOS.

Thus, it should be possible to make Colmena evaluate Liminix systems!

And yes, it is!

You get to be able to **evaluate** with Colmena, #Liminix systems such as https://git.dgnum.eu/DGNum/infrastructure/src/commit/bf499a4336a818db10cc7b3b4821fe5088e84413/hive.nix#L125-L143 2/???

In the deployment ecosystem, we have tools like colmena that enable you to deploy a set of expressions to a target.

The issue again is that colmena is NixOS-specific.

But it does not have to be! Things like #Liminix share the NixOS module system (yeah confusing naming) with #NixOS.

Thus, it should be possible to make Colmena evaluate Liminix systems!

And yes, it is!

You get to be able to **evaluate** with Colmena, #Liminix systems such as https://git.dgnum.eu/DGNum/infrastructure/src/commit/bf499a4336a818db10cc7b3b4821fe5088e84413/hive.nix#L125-L143 2/???

I have been working on something, which is not totally ready.

Most of the deployment tools in the #NixOS ecosystem are tailored to... NixOS. NixOS can run in a bunch of places, but not easily on 256MB RAM devices and 32MB disk.

For that, you have plenty of options, one of them is #Liminix (https://www.liminix.org/).

Liminix is currently tailored to OpenWRT-class APs/routers and I worked on bringing support for the Zyxel NWA50AX (https://openwrt.org/inbox/toh/zyxel/nwa50ax). 1/???

I have been working on something, which is not totally ready.

Most of the deployment tools in the #NixOS ecosystem are tailored to... NixOS. NixOS can run in a bunch of places, but not easily on 256MB RAM devices and 32MB disk.

For that, you have plenty of options, one of them is #Liminix (https://www.liminix.org/).

Liminix is currently tailored to OpenWRT-class APs/routers and I worked on bringing support for the Zyxel NWA50AX (https://openwrt.org/inbox/toh/zyxel/nwa50ax). 1/???

#liminix weekly update isn't even monthly any more :-( Here is my brain dump from the last ~ 6 weeks

https://www.liminix.org/2024/04/30/no-u-dev.html

tl;dr : lashings of NIH

I finally completed this mission.

Zyxel NWA50AX is usable with #Liminix now.

https://github.com/telent/liminix/pull/2

You can build the Zyxel NWA FIT format then `ftp` it to the target (even with the stock OS!) or the web UI and you will be booted in a Liminix system.

Obviously, some caveats apply, for example: no true A/B support (it's trivial to fix when I have a bit of time).

In the future, I will show a bit what I can do with this AP (and a lot of them).

#NixOS

Tomorrow, we finish the NWA50AX port and take it for a walk in home maybe. Next on the list is to bring usteer outside of OpenWrt and use it in #liminix

Then, we submit all the pending ZFS patches to upstream while polishing them.

That will be a productive weekend. 🙂

#NixOS

#liminix video update. On Youtube (boo…) while I wait to see if my diode.zone application is approved

https://www.youtube.com/watch?v=oyeRNkL-sR0

This week in #liminix, version 0 of a working wifi AP/router

https://www.liminix.org/2023/02/26/order-order.html

#nix