1. Intro⌗

I formerly self-hosted my services on a Kubernetes cluster with FluxCD inside openSUSE MicroOS VMs hosted by Proxmox. While that was really flexible, it became a burden maintaining it in my freetime and demanded too much RAM and storage on my resource-constrained servers. I still want to keep my K8s cluster around for tinkering in my homelab, but for a personal setup that I need to “just work” for NAS, git hosting, and backups, the complexity didn’t justify the benefits.

Yet, I loved my former workflows: GitOps, infrastructure as code, and declarative container management. I wanted to manage my self-hosting from a git repository. That’s how I landed on etckeeper for managing my base system and Podman quadlets for managing my container services declaratively with systemd.

There was one more criteria I wanted to meet…

2. Why Kicksecure?⌗

I also don’t have enough time in my day to exhaustively follow hardening guides. I’d prefer an opinionated, secure by default system. I evaluated several options before choosing Kicksecure.

Secureblue looks promising! But I’m more comfortable with Debian-based systems, and I wasn’t familiar with its development background and whether the project is reputable.

NixOS and Gentoo were considered. Gentoo could be a really secure option but would have been another maintenance burden. NixOS might have worked since I daily drive it on my gaming PC and I’ve already gone through some hardening guides so I could copy my existing configs. Unfortunately I ran into a known bug preventing NixOS/GuixSD from booting with Heads on my server. Heads is a security focused distribution based on the coreboot open source BIOS based with features to prevent boot tampering, and rather than toiling against this bug I opted to go with the next option:

Kicksecure is connected to the same team behind Whonix which I already use! Whonix is a well-established project and it currently fits my constraints.

Kicksecure does need extra configuration to work with podman, but it turned out to be much more manageable than my old stack.

3. Retrospective⌗

By the end of this project, I had assembled:

  • An etckeeper managed Kicksecure server
  • An encrypted BTRFS storage with subvolumes for backing up extremely critical stuff
  • Rootless Podman containers managed with git tracked systemd quadlets
  • A running Gitea instance with SSH access on port 4022
  • Firewall rules restricting access to only necessary ports

3.1 Posts in this series⌗

I’m documenting my journey through the setup process in these posts:

Step Article Description
1 Etckeeper GitOps on Kicksecure Keep track of all my Kicksecure configuration changes from the start
2 Encrypted BTRFS Storage on Kicksecure Configuring server storage on BTRFS subvolumes with LUKS encryption
3 Podman Permissions on Kicksecure Allowing rootless Podman to use newuidmap/newgidmap via Kicksecure’s Permission Hardener
4 Podman Quadlets on Kicksecure Deploying containers with Git-tracked Podman quadlets and UFW firewall

Additionally, I flashed and locked down Heads/coreboot, installed an open source zero trust mesh VPN for remote access, deployed host-based IDS, moved server management to Ansible roles, and set up a Nextcloud instance utilizing storage on a ZFS RAID 10 array with 4x 8TB HDD’s. In the future I hope to expand this series with posts detailing those efforts, as well as posts further exploring Kicksecure’s nifty security features.