Argbed
A hardened, private, minimal, modular kickstart for Fedora
One script assembles the modules into one kickstart file for Fedora's network installer.
What the installed system is
- LUKS2-encrypted root filesystem.
- Signed unified kernel images boot through shim under a key generated at install time; with Secure Boot on, nothing unsigned boots. GRUB has no boot entry and no configuration.
- Default-drop nftables for inbound and outbound traffic, loaded before the network comes up on every boot.
- SELinux enforcing, with confined users and a locked root account.
- systemd-networkd and iwd instead of NetworkManager, with randomized MAC addresses and anonymized DHCP.
- Microphones and cameras disabled: no capture node in the audio server, and their device nodes closed to every unprivileged process.
- Updates installed at boot, before login, never during a session.
- A sway Wayland desktop.
- No
@core: every package is named in a module, a hard dependency of one, or one of the installer's own additions.
How it is built
Each concern lives in its own module under ks.d/, with optional ones under optional/. The build script assembles them in order, substitutes the machine's values and, with pykickstart installed, validates the result: one kickstart file for Fedora's network installer. The README in the repository is the documentation, from the build and the USB stick to Secure Boot enrollment and the trade-offs.