Workstations

Three operating systems, each for a different job. Void Linux on glibc is the broadly compatible daily environment, with a small, fast base and runit instead of systemd. NixOS is where I work declaratively: the whole system is described in configuration, so it can be rebuilt and rolled back, which is the same property my reproducible-builds research cares about. Windows 11 covers software and testing that needs it.

Storage is kept on a machine that is never on a network. Data crosses the gap only through deliberate, controlled transfer, which makes the exposure of the data a question about that one path instead of about every service on the machine. FreeBSD's native ZFS support makes it a natural fit for storage, and a small, conservative base suits a machine that should do nothing except hold data.

A laptop leaves the building, so it gets the strictest defaults. Void with musl keeps the libc small and simple to audit, which reduces the code that sits under every program. The trade-off is that some glibc-only binaries do not run, and I accept that for the smaller attack surface.

The server is built around exposing as little as possible. FreeBSD provides jails for isolating services from each other and pf for firewalling, both of which match an isolation-first approach: assume a service can be compromised, and limit what that gets an attacker.