Boot chain
systemd-boot + lanzaboote-signed UKIs on a removable key; LUKS2 with a detached header; YubiKey FIDO2 (PIN + touch) unlock.
cobalt
Full-disk encryption with the header on a USB key, FIDO2 unlock, Secure Boot, an ephemeral root — declared in Nix, documented end to end.
Ephemeral root
btrfs root rolled back to a blank snapshot on every boot; only /home, /nix and an explicit /persist allowlist survive.
Network
nftables default-deny, MAC and IPv6 address privacy, rule-based egress proxy, encrypted DNS fallback.
Honest limits
Nothing here defeats coercion or a live attacker. Every protection documents what it does not do.