Hardware-rooted boot verification, custom PKI keys, and rollback safety across NixOS generations using Lanzaboote and sbctl.
Published Articles
Balancing kernel memory protections, strict IOMMU DMA isolation, and stable MAC address randomization without breaking suspend-then-hibernate.
Running CachyOS Kernels on NixOS ↗
PerformanceHow to configure CachyOS BORE kernels with pre-built Attic binary caches in Nix Flakes to avoid hours of local compilation.
Building a Declarative Multi-Host NixOS Fleet ↗
ArchitectureStructuring multi-machine Nix flakes with custom option namespaces, age-encrypted SOPS secrets, and automated BorgBackup with udev rules.