I have a mini PC server that can’t be physically locked away from people in the house, because I do not have the ability or space to install a rack and physically secure it.

There is a housekeeper that is sometimes not the same person.

There is a curious child in the house.

The server needs to be rebooted remotely occasionally.

Some disks are removable.

I am not concerned about an APT posing as my maid to steal the key from RAM. It’s not part of my threat model.

I do want to know if my UEFI, bootloader or UKI has been fucked with without my knowledge.

I generally find writing a good role takes longer than doing it manually. Especially as you have to keep testing failure conditions as you think of them.

However, the point is, that once you’re finished with the role, you never have to do that process again.

Not if you want to rebuild Not if you want to migrate to a new os Not if you build a second server Not if you move to a newcloud hosting provider

Porting to a new OS or after an update that changes how the software works is about as fast as doing it manually

Maybe it’s only one server today, but how many times would you need to rebuild it over the running lifetime?

The killer feature is that having something like ansible lets you kill your darlings, and keep servers aa cattle, not pets.

Manual setup chops isn’t a different skill here. I view ansible as a combination setup and documentation. If you’re going to figure out how, why not write down how you did it? If you’re going to write it down complete with code lines to run, why not script it?

And there was me thinking that my old google TV remote was just damaged in some way, causing battery drain…

I used to work for an MSP (Managed Service Provider), can confirm. Security is something I had to redirect attention to on a day-to-day basis. Even then, the company was more concerned with appearance and audit compliance than security.

I have worked at IT companies that really did care about security, but those companies were driven by management and staff that personally cared about IT security. One of them was a certificate authority.

Here’s a story about physical security from before that time.

I once had equipment in a Data Center that was embedded in the 4th floor of an office building. There was a mantrap at the entrance, designed to prevent you from walking away with the main DC door open, or letting people tailgate in to it. One of the doors of the mantrap was a sliding door, disguised as a bit of the hallway.

The sliding door was locked with a maglock on the thin end, so when it fully closed, it locked and you couldn’t slide it open without a key card, from inside or out.

…unless you bumped in to it with your shoulder, which separated the lock and opened the door. Which, after it was figured out (about 1 month), happened all the time. People would get let in to the DC without a card that opened that specific door. (DC security control provisioned the main door was separate from building control, which managed the sliding door).

When they tried to get out later, they’d get stuck in the mantrap, then they’d wait for someone to let them out (pre-cellphones). That person would then show them the trick. This was so common they turned off the forced-lock alarm. This lead to the mantrap being useless, and people propping the DC door open for ease of access when moving stuff in and out.

This was put in place in 2001, and I visited the building last year in 2025, it’s still in place today.

It’s worth noting that this DC was shared by multiple competitive reinsurers, ISPs and financial agencies. The were no cameras outside or inside, and you could poke most server reset buttons through the rack cages with the ink cartridge of a ball point pen. Not everyone was shown that trick.

I’ve seen the recommendations of software raid0. The answers are all technically correct.

Don’t do this. Especially with real hardware. If you lose one drive, you will lose both the drives.

Could you give us more info on how your other encrypted drive is mounted and meant to be used?

• It is possible to get the second encrypted drive to decrypt and mount automatically, without logging in.
• It’s possible to do it without leaving a key for your second drive on your primary hard drive using a TPM
• It is possible to get both drives to decrypt automatically and mount

It all depends how the encryption is being done, and where the mount points are.

Could you give us:

• The rough dimensions of the drive partitions (fdisk -l)
• Your current mount points after mounting the second drive (df -h)

In my experience, those apps don’t detect immediately, sometimes only alarming beyond 5 mins after contact. I have to assume by default to save power the scans are rate limited, like with WiFi scans.

Those apps have to be allowed to scan when the glasses are transmitting to detect them, providing limited success.

The trouble is the bootloader is often not relockable with a custom avb key

The only OEM with official support for relocking the boot loader with a custom avb key is Google sadly

Very much dependent on the particular hardware - here, the pinetab2 has some support. The danctnix mobile linux community maintains builds for it, so it’s a subset of Arch on Arm.

https://github.com/dreemurrs-embedded/danctnix-packages/tree/main/pine64/device-pine64-pinetab2

outside of that, there’s some limited support for postmarketOS and mobian

A good place to start understanding the challenges you’d face would be on the wiki:

https://wiki.pine64.org/wiki/PineTab2_Releases

I just bought one. The default KDE is a bit heavyweight for it, I’m thinking something lighter might be better.

I would say that they perfectly nailed the description, this is not a beginner device. You’ll not be distrohopping without knowing how to patch your own WiFi drivers and fix the auto rotate (90° clockwise further than it should be out of the box).

I love it, really cool. But not an easy in for beginners.

Feel free to ask me questions or check something, or send a picture of something!

I would dearly love to know how many if statements are between me and the brakes.

Also, being able to prove that that the CAN bus and RTOS system was air-gapped from whatever bullshit uplink to the internet ends up in there would be worth ~20K extra to me.