TacidOS
DevelopersGitHub

Decision 0015

iwd + systemd-networkd + resolved; firewall on, SSH off

Architecture decision record 0015: iwd + systemd-networkd + resolved; firewall on, SSH off

Status
Accepted
Date
2026-09-03

Context

Grok’s Q-10: full NetworkManager, or iwd with a small helper?

The three plans

  • Grok: no NetworkManager if a static/iwd profile will do; net kill with a badge.
  • Fable: not specified; Tailscale in the services allow-list.
  • Codex: no agent socket exposed to LAN or Internet by default; SSH-first remote access; firewall on; SSH off unless selected.

Decision

iwd, systemd-networkd and systemd-resolved. The agent and the shell are the network user interface; VPNs and WireGuard peers are declared in the genome. Firewall on by default, SSH off unless selected, the agent socket never exposed beyond the machine by default. Enterprise Wi-Fi (802.1X) through iwd; captive portals detected and handed to the browser.

Consequences

  • The minimal stack, consistent with headless-first; servers and boards use the same components.
  • NetworkManager’s VPN plugin ecosystem is not available; declared WireGuard and OpenVPN cover the cases that matter to builders.

Alternatives rejected

  • NetworkManager: excellent desktop integration, redundant when the agent is the UI, and a larger, more imperative surface.