wren-linux / docs / extras / README.md (as plain text)
The extras, explained
One page per extra. The short list of all of them is in ../extras.md; general advice is in ../opsec.md.
Every page has the same shape:
- SYNOPSIS: the commands to install, remove and use it.
- One paragraph on what it is.
- LIMITS: what it does not protect against.
- MANUAL INSTALL: every step to do by hand what the script does, each with
what it is for.
wrenctl manual NAMEprints this section and changes nothing. In the page,@NAME@stands for a value frompins.shor the script (a key's fingerprint, an address, a package list) and@WREN_DIR@for your Wren Linux folder;--manualfills them in.
Installed by hand, an extra has no Wren Linux marker package, so its --remove
doesn't know what to take out: undo it with the steps at the end of its page.
apt purge also removes every package that depends on what you purge, so the
undo steps purge only the extra's own programs and mark shared ones
"automatic" (apt-mark auto), for apt autoremove to take out only if
nothing needs them. Either way, read the list apt shows before you say yes.
Browsing
- Firefox's hardening, and a throwaway window
- Firefox as its own locked-down user
- One Firefox profile per site
- PDF viewer in a sandbox:
docs/extras/pdf-viewer.md - GIMP image editor, in a sandbox
- Archive tools:
docs/extras/archive-tools.md - Console-only, tmux instead of sway:
docs/extras/console-only.md - w3m, a web browser for the terminal:
docs/extras/w3m.md - vim, with colors for each programming language
- Tor Browser, as its own user
- A second Tor Browser, at Safer
- Mullvad Browser, as its own user
Anonymity and network privacy
- Mullvad VPN
- Debian's packages through Tor
- Whonix, Tor in a virtual machine
- Share files over Tor with OnionShare
- Your own onion site
- Remote access over Tor
- Other systems' install images, checked, onto a USB stick
- Tails on a USB stick
Sandboxes and test machines
- Claude Code inside a disposable virtual machine
- A disposable practice server
- Images and video in a sandbox
- yt-dlp as its own locked-down user
Passwords, keys and backups
- A password manager
- Hardware security keys: SSH, website logins and sudo
- Encrypted backups of your home folder
- An encrypted ~/Vault that locks itself
Messaging and sharing
- Signal Desktop
- Metadata Cleaner, to strip hidden data from files
- Wallpapers to pick from: NASA, Webb, Earth Observatory, Budgie, or your own
Devices and hardware
- Sound and the microphone switch
- Bluetooth, off until you want it
- Phone tethering over USB
- Closing the lid locks but doesn't suspend
- Compressed memory
- One workspace: no workspace keys or buttons
- Logging in on tty1 without the password
- A webcam switch, off at every boot