Donate to CanuteTheGreat/patronus

• github.com/sponsors/CanuteTheGreat

---

See the documentation for more details on donation links.

7 releases 8 tags

RSS feed

• daily-status-server-openrc-aarch64 f628986388

  Compare

  patronus daily build status server-openrc aarch64 (machine-readable) Pre-release

  CanuteTheGreat released this 2026-10-30 10:29:05 -07:00 | 88 commits to main since this release

  {"project":"patronus","arch":"aarch64","mode":"daily","variant":"","image":"server-openrc","image_id":"server-openrc-aarch64","result":"pass","failed_step":"","summary":"PASS (aarch64, QEMU TCG emulation, no KVM): 4 QEMU runs (boot, install, reboot; UEFI, USB + optical; answer-file, serial TUI, VGA TUI, graphical installer driven by keyboard + pointer + AT-SPI, no-answer-file fallback) - installed system refuses password root SSH, accepts the key, serves the web UI on the chosen IP (build 1378s, test 9511s)","sha":"d102b1e9d373b199af7e06b289d5408af1bbf492","run_id":"12578","run_url":"https://git.canutethegreat.com/CanuteTheGreat/patronus/actions/runs/12578","time":"2026-11-10T00:03:59Z","build_seconds":1378,"test_seconds":9511}

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    0 downloads
• daily-status-server-openrc-x86_64 f628986388

  Compare

  patronus daily build status server-openrc x86_64 (machine-readable) Pre-release

  CanuteTheGreat released this 2026-10-30 10:29:04 -07:00 | 88 commits to main since this release

  {"project":"patronus","arch":"x86_64","mode":"daily","variant":"","image":"server-openrc","image_id":"server-openrc-x86_64","result":"pass","failed_step":"","summary":"PASS (x86_64, QEMU KVM): 12 QEMU runs (boot, install, reboot; UEFI+USB, BIOS+CD; answer-file, serial TUI, VGA TUI, graphical installer driven by keyboard + pointer + AT-SPI, no-answer-file fallback) - installed system refuses password root SSH, accepts the key, serves the web UI on the chosen IP (build 1515s, test 7147s)","sha":"bcd551302691de29c4c16f82883842c53a21df51","run_id":"12729","run_url":"https://git.canutethegreat.com/CanuteTheGreat/patronus/actions/runs/12729","time":"2026-11-10T06:39:52Z","build_seconds":1515,"test_seconds":7147}

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download
• v0.2.0 55bf050002

  Compare

  Patronus v0.2.0: device segmentation (opt-in) Stable

  Ghost released this 2026-10-30 07:32:21 -07:00 | 95 commits to main since this release

  Patronus 0.2.0: device segmentation

  Everything below is opt-in. A router upgraded from the previous release keeps behaving exactly as it did: isolation is off until you switch a segment on, DNS rebinding protection stays off on an existing store (it is on for new installs), and there are no policies, Wi-Fi networks or time limits until you create them. The five new migrations (1300, 1310, 1320, 1330/1331, 1340) are applied on first boot; upgrade-store.sh proves an upgrade from the previous release's store and from the v0.1.0 layout.

  What is new

  • Device segmentation and isolation (opt-in per segment). Devices have an identity (MAC bound to an address), belong to groups (home, quarantine, your own) and are default-deny between each other. Links between groups and one-way service rules (e.g. NAS -> camera on tcp 554) open exactly what you list. Unknown devices land in quarantine (DHCP, DNS and ping only, never the admin UI). Own nft table inet patronus_seg, same atomic apply as the main ruleset; revoking a device cuts its live connections. Page: Segmentation, API: /api/segmentation.
  • Per-device Wi-Fi credentials (USE=wifi-ap). One passphrase per device on one SSID (hostapd per-MAC PSK). WPA2: live, add / rotate / revoke without restarting the access point. WPA3 (SAE): needs an AP restart whenever a password changes, because stock hostapd reads SAE passwords only at start; the UI says so and every station reconnects for a few seconds. A device created without a MAC is enrolled by its first join. Show-passphrase / QR for phones.
  • DNS rebinding protection. Unbound private-address / dnsmasq stop-dns-rebind, with per-domain exceptions for your split-horizon names. On for new installs, off for upgraded stores.
  • Per-device and per-group DNS policy and query logs. Block lists, allow/block/override rules, family preset (adult + malware lists, safe search), DNS-over-TLS refused for devices under a policy, optional per-policy query log with search and CSV export (needs DNS resolver mode / Unbound).
  • Parental time limits. Allowed windows plus a daily quota of active minutes per device or group, a warning before the cut, a "time's up" page on plain HTTP, DNS and DHCP kept alive while blocked, +N minutes / pause / resume for parents. Own nft table inet patronus_time; the block survives a reboot.
  • Traffic insight history with country and ASN (USE=insight). Hourly per-device totals by country and ASN from DB-IP Lite databases (patronus ipdb update, monthly timer), retention and a "do not record" list for privacy. Insights page: Live, Countries, ASNs, Devices, Uplinks, Settings.
  • Uplink health and SLA alerts. Per-gateway round-trip time, loss and availability history, extra DNS / TCP / HTTP probes sent through each gateway's own interface (an ISP that pings but has dead DNS shows as degraded), outage list, SLA target with alerts in the event log and webhooks.

  Documented limits (please read)

  • Unmanaged switches: wired devices behind an unmanaged switch share one switch port, so the switch forwards between them without the router; they cannot be isolated from each other (put them in one group, or use a managed switch with port isolation).
  • IPv6 binding is next: IPv6 between devices of an isolated segment is denied and an unknown MAC forwards no IPv6, but per-address IPv6 identity binding (SLAAC / privacy addresses) is not done yet.
  • Simulated radios only: the Wi-Fi code is proven on mac80211_hwsim with stock hostapd 2.10 (26/26 checks, nightly CI job). It has not been run on real Wi-Fi hardware yet. DNS-over-HTTPS cannot be blocked reliably.

  Proof

  CI on the release commit: Format + Clippy (whole workspace, -D warnings) + Test, privileged netfilter tests, netlab (journeys, failure/recovery, upgrade), netlab-features (every lane-s-* scenario: segmentation 67 checks, DNS rebinding, time limits, insight, uplink), Gentoo OpenRC and systemd builds, feature matrix. Nightly: Wi-Fi on mac80211_hwsim, previous-release upgrade with 30 power cuts, mutation floors (new floor for seg_rules.rs: 63 of 63 mutants caught).

  Artifacts

  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz (patronus-web, patronus-cli, docs) sha256 93aa2f7a6997e097f5f27bb50031477559775063dc4b09d57944f2e3ff69577f
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz (built with thin LTO) sha256 a0581219c0de4efe206a1a4527af7a4945ca7e68a60a4c2b71f74f725578d3b7
  • Both are glibc builds made on Ubuntu 24.04 (need glibc >= 2.39); no musl or riscv64 archives. The supported ways to run Patronus are the live/installer ISO and the Gentoo ebuild net-firewall/patronus-0.2.0.
  • Live/installer ISOs, both built from the tagged commit and tested in QEMU (boot, install, reboot, web UI; UEFI/BIOS, serial/VGA/graphical installer, rescue/forensic/live modes):
    • patronus-v0.2.0-x86_64.iso sha256 a0f4a44875f43d19a0ee889520c46c49d25f204b3b71cec8ae92257627afdd87 (the tested daily ISO of commit 55bf0500, CI run 7701; the tag run's own x86_64 job hit the runner's 3 h limit)
    • patronus-v0.2.0-aarch64.iso sha256 a13cb776fe52cfe542e62a11ac0ca298f218fa657dbcdf1324ce8faf9fc23a2e (tag run 7716, QEMU TCG)
    • test evidence: *-iso-test-evidence.tgz; the rolling daily pre-release carries the same tree
  • Every archive was started once in CI (patronus-cli --version) from the files inside the archive before it was attached.

  Downloads

  • patronus-v0.2.0-aarch64.iso
    9 downloads · 2026-10-30 18:10:28 -07:00 · 1.5 GiB
  • patronus-v0.2.0-aarch64.iso.sha256
    2 downloads · 2026-10-30 18:10:29 -07:00 · 94 B
  • patronus-v0.2.0-aarch64-iso-test-evidence.tgz
    2 downloads · 2026-10-30 18:10:29 -07:00 · 597 KiB
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz
    3 downloads · 2026-10-30 08:04:26 -07:00 · 21 MiB
  • patronus-v0.2.0-aarch64-unknown-linux-gnu.tar.gz.sha256
    3 downloads · 2026-10-30 08:04:27 -07:00 · 115 B
  • patronus-v0.2.0-x86_64.iso
    2 downloads · 2026-10-30 17:35:17 -07:00 · 1.5 GiB
  • patronus-v0.2.0-x86_64.iso.sha256
    2 downloads · 2026-10-30 17:35:18 -07:00 · 93 B
  • patronus-v0.2.0-x86_64-iso-test-evidence.tgz
    1 download · 2026-10-30 17:35:19 -07:00 · 5.6 MiB
  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz
    3 downloads · 2026-10-30 08:02:40 -07:00 · 23 MiB
  • patronus-v0.2.0-x86_64-unknown-linux-gnu.tar.gz.sha256
    3 downloads · 2026-10-30 08:02:40 -07:00 · 114 B

  ---

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download
• daily-status-aarch64 fb40cad128

  Compare

  patronus daily build status aarch64 (machine-readable) Pre-release

  CanuteTheGreat released this 2026-10-28 17:51:09 -07:00 | 144 commits to main since this release

  {"project":"patronus","arch":"aarch64","mode":"daily","variant":"","result":"pass","failed_step":"","summary":"PASS (aarch64, QEMU TCG emulation, no KVM): 5 QEMU runs (boot, install, reboot; UEFI, USB + optical; answer-file, serial TUI, VGA TUI, graphical installer driven by keyboard + pointer + AT-SPI, no-answer-file fallback) - installed system refuses password root SSH, accepts the key, serves the web UI on the chosen IP (build 1463s, test 8783s)","sha":"55bf0500028cc6c34d4c25c1cb3dd3c5369c25bb","run_id":"7701","run_url":"https://git.canutethegreat.com/CanuteTheGreat/patronus/actions/runs/7701","time":"2026-10-30T15:51:34Z","build_seconds":1463,"test_seconds":8783}

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    3 downloads
• daily-status c372b76281

  Compare

  patronus daily build status (machine-readable) Pre-release

  CanuteTheGreat released this 2026-10-28 09:40:07 -07:00 | 152 commits to main since this release

  {"project":"patronus","arch":"x86_64","mode":"daily","variant":"","result":"pass","failed_step":"","summary":"PASS (x86_64, QEMU KVM): 7 QEMU runs (boot, install, reboot; UEFI+USB, BIOS+CD; answer-file, serial TUI, VGA TUI, graphical installer driven by keyboard + pointer + AT-SPI, no-answer-file fallback) - installed system refuses password root SSH, accepts the key, serves the web UI on the chosen IP (build 4372s, test 5160s)","sha":"55bf0500028cc6c34d4c25c1cb3dd3c5369c25bb","run_id":"7701","run_url":"https://git.canutethegreat.com/CanuteTheGreat/patronus/actions/runs/7701","time":"2026-10-30T19:06:07Z","build_seconds":4372,"test_seconds":5160}

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download
• daily c372b76281

  Compare

  patronus daily ISO (rolling, pre-release) Pre-release

  CanuteTheGreat released this 2026-10-28 09:39:03 -07:00 | 152 commits to main since this release

  Rolling pre-release build of the patronus live/installer ISO from main (92d99ce98b), updated 2026-11-04 23:41:54 UTC.
  Each architecture is replaced in place by its own daily job, only after the QEMU boot + install + reboot + web-probe tests passed on that architecture.

  • Server OpenRC - aarch64: patronus-server-openrc-daily-aarch64.iso (1538 MiB), SHA256 in patronus-server-openrc-daily-aarch64.iso.sha256
  • Server OpenRC - x86_64: patronus-server-openrc-daily-x86_64.iso (1627 MiB), SHA256 in patronus-server-openrc-daily-x86_64.iso.sha256

  Last test result (x86_64): PASS (x86_64, QEMU KVM): 7 QEMU runs (boot, install, reboot; UEFI+USB, BIOS+CD; answer-file, serial TUI, VGA TUI, graphical installer driven by keyboard + pointer + AT-SPI, no-answer-file fallback) - installed system refuses password root SSH, accepts the key, serves the web UI on the chosen IP (build 2586s, test 4882s)

  Write to USB: see docs/ISO-INSTALL.md (Secure Boot must be OFF). x86_64: UEFI or BIOS; aarch64 / riscv64: UEFI only.

  Downloads

  • patronus-server-openrc-daily-aarch64.iso
    6 downloads · 2026-11-04 07:50:48 -08:00 · 1.5 GiB
  • patronus-server-openrc-daily-aarch64.iso.sha256
    1 download · 2026-11-04 07:50:49 -08:00 · 107 B
  • patronus-server-openrc-daily-aarch64-test-evidence.tgz
    2 downloads · 2026-11-04 07:50:50 -08:00 · 596 KiB
  • patronus-server-openrc-daily-x86_64.iso
    1 download · 2026-11-04 15:41:52 -08:00 · 1.6 GiB
  • patronus-server-openrc-daily-x86_64.iso.sha256
    1 download · 2026-11-04 15:41:53 -08:00 · 106 B
  • patronus-server-openrc-daily-x86_64-test-evidence.tgz
    1 download · 2026-11-04 15:41:54 -08:00 · 5.6 MiB

  ---

  • Source code (ZIP)
    3 downloads
  • Source code (TAR.GZ)
    2 downloads
• iso-2026.10.27 47d1ed70a0

  Compare

  iso-2026.10.27 Pre-release

  CanuteTheGreat released this 2026-10-27 23:30:15 -07:00 | 158 commits to main since this release

  Patronus live/installer ISO (Gentoo-based, x86_64, UEFI + BIOS hybrid, USB-writable, patronus-install included). Pre-release / test build - first Patronus ISO (it previously only had an Alpine remaster for CI), built on rw-man-01 with the same builder as Horcrux's ISO (main 47d1ed70 + installer fixes).

  SHA256: 1010018ecc046c9ad9c5c5d600c57397a7550fd35c073a87c2afa6a3f0dc0e28 (patronus-iso-2026.10.27-x86_64.iso, 1430792192 bytes)

  Tested in QEMU/KVM: UEFI (OVMF) booting the ISO as a USB stick and BIOS (SeaBIOS) booting it as CD -> unattended install (patronus-install, ext4) to a blank virtio disk -> reboot from disk -> web UI answered over HTTPS (:8443) and admin login worked. Evidence (serial logs, screenshots) in the -test-evidence.tgz asset.

  Secure Boot: not supported - turn it OFF in firmware setup. Not tested on real hardware. Write to USB and details: docs/ISO-INSTALL.md.

  Downloads

  • patronus-iso-2026.10.27-test-evidence.tgz
    3 downloads · 2026-10-27 23:31:45 -07:00 · 150 KiB
  • patronus-iso-2026.10.27-x86_64.iso
    10 downloads · 2026-10-27 23:31:44 -07:00 · 1.3 GiB
  • patronus-iso-2026.10.27-x86_64.iso.sha256
    2 downloads · 2026-10-27 23:31:44 -07:00 · 101 B

  ---

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download