HardDesk Starter
A curated 'hardened workstation starter kit' for Linux power users — one installer that sets up a Wayland-friendly desktop, an askpass, a TPM-backed keyring, and a secure-update pipeline without forcing the KDE stack.
Linux power users and security-focused IT teams rolling out minimal developer laptops
- Single installer that selects only the security-relevant components (askpass, keyring, firewall, secure-boot tooling)
- Pre-configured dotfiles and systemd units tuned for Sway, Hyprland, and GNOME
- Fleet mode for IT to roll out the same hardened baseline across dozens of laptops
- Optional managed update channel so security patches roll out within 24 hours
The source post shows the friction of assembling this stack by hand on Gentoo; many devs want the result without the multi-day dependency puzzle.
Multiple blog posts and GitHub repos (WillemAchterhof/arch-secure-installer, arch-luks-tpm-secureboot, JPetazzo's writeup, Krin's Arch wiki page) show real, recurring pain for Linux power users hand-rolling TPM+LUKS+SecureBoot stacks, plus government guidance (cyber.gov.au) and CIS Build Kits confirm sustained interest.Installing Archlinux with LUKS, SecureBoot, TPM ↗WillemAchterhof/arch-luks-tpm-secureboot - GitHub ↗WillemAchterhof/arch-secure-installer - GitHub ↗
Most existing solutions are either DIY bash scripts maintained by individuals or heavyweight enterprise offerings (CIQ RLC Pro Hardened, CIS Build Kits, Ubuntu Pro); there is no mainstream curated 'hardened Wayland desktop starter' targeting individual power users and small IT teams in the middle.CIQ | RLC Pro Hardened: Pre-Hardened Enterprise Linux ↗CIS SecureSuite Build Kit Content ↗User:Krin/Secure Boot, full disk encryption, and TPM2 unlocking install - Arch Wiki ↗
Willingness to pay exists at the high end (Ubuntu Pro per-node subscriptions, CIQ enterprise licensing) but Linux power users have a strong DIY/fork culture; Fedora Silverblue/NixOS threads show users preferring to assemble things themselves, making consumer monetization difficult.Ubuntu Pro | plans and pricing ↗Understanding Ubuntu Pro Pricing ↗Would the security benefits alone justify using Silverblue as a desktop OS ↗
TPM-backed disk encryption and reproducible/immutable desktops are durable trends driven by compliance (DISA STIG, CIS), post-quantum prep, and the rise of NixOS/Silverblue; demand will outlast any single HN post.Hardening Linux workstations and servers - Cyber.gov.au ↗
Feasible to build by composing existing mature pieces (sbctl, systemd-cryptenroll, distro installers), but keeping it Wayland-flexible and distro-agnostic across kernel/DE updates is a long maintenance tail; focusing on one base distro (Arch or Fedora) would be much easier.Install Arch with Secure boot, TPM2-based LUKS encryption, and systemd-homed ↗