# paulinotech1/lock_down architecture

> Architecture diagram of the GitHub repository paulinotech1/lock_down, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/paulinotech1/lock_down
- Repository: https://github.com/paulinotech1/lock_down

## Overview

Lock_Down is a hardware-specific set of Linux kernel configurations, host-security controls, and operating procedures for turning a stock Ubuntu installation on one ThinkPad model into a hardened workstation. The intended outcome is a bootable, recoverable system for daily desktop use, with network, authentication, power, and VM controls. The README documents these capabilities, but no source excerpts were provided, so implementation-level calls and several operational links are omitted.

Main entry points: [`docs/KDE.md`](https://github.com/paulinotech1/lock_down/blob/main/docs/KDE.md) (KDE workstation), [`scripts/build-kernel.sh`](https://github.com/paulinotech1/lock_down/blob/main/scripts/build-kernel.sh) (Kernel build), [`config`](https://github.com/paulinotech1/lock_down/tree/main/config) (Kernel profiles), [`docs/SECURE_BOOT.md`](https://github.com/paulinotech1/lock_down/blob/main/docs/SECURE_BOOT.md) (Secure Boot)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_kernel["Kernel and boot"]
  node_kernel_config["Kernel profiles"]
  node_kernel_builder["Kernel build<br/>[build-kernel.sh]"]
  node_secure_boot["Secure Boot<br/>[SECURE_BOOT.md]"]
  node_rescue["Rescue kernel<br/>[RECOVERY.md]"]
end

subgraph group_host["Host hardening"]
  node_apparmor["AppArmor policy"]
  node_sysctl["Kernel sysctls"]
  node_firewall["nftables firewall<br/>[workstation.nft]"]
  node_usb_policy["USB policy<br/>[rules.conf]"]
  node_host_checks["Security checks"]
end

subgraph group_identity["Storage and identity"]
  node_encrypted_storage["LUKS2 storage"]
  node_tpm["TPM2 and PIN<br/>[TPM.md]"]
  node_pam["YubiKey PAM<br/>[YUBIKEY_PAM.md]"]
  node_offline_recovery["Recovery credential<br/>[RECOVERY.md]"]
end

subgraph group_workstation["Workstation use"]
  node_desktop["KDE workstation<br/>[KDE.md]"]
  node_power["Power policy"]
  node_vm_profiles["VM profiles"]
  node_libvirt["KVM and libvirt<br/>[KVM_SECURITY.md]"]
  node_hardware["Verified hardware<br/>[HARDWARE.md]"]
end

node_owner(("System owner"))
node_ubuntu["Ubuntu LTS"]

node_owner -->|"starts with"| node_ubuntu
node_kernel_config -->|"configures"| node_kernel_builder
node_ubuntu -->|"builds for"| node_kernel_builder
node_kernel_builder -->|"signs for boot"| node_secure_boot
node_secure_boot -->|"retains fallback"| node_rescue
node_tpm -->|"unlocks with PIN"| node_encrypted_storage
node_offline_recovery -->|"recovers access"| node_encrypted_storage
node_apparmor -->|"confines processes"| node_desktop
node_sysctl -->|"hardens host"| node_desktop
node_firewall -->|"filters traffic"| node_desktop
node_usb_policy -->|"restricts devices"| node_desktop
node_pam -->|"authenticates users"| node_desktop
node_vm_profiles -->|"profiles guests"| node_libvirt
node_power -->|"sets power policy"| node_desktop
node_hardware -->|"guides tailoring"| node_kernel_config
node_owner -->|"runs checks"| node_host_checks

click node_kernel_config "https://github.com/paulinotech1/lock_down/tree/main/config"
click node_kernel_builder "https://github.com/paulinotech1/lock_down/blob/main/scripts/build-kernel.sh"
click node_secure_boot "https://github.com/paulinotech1/lock_down/blob/main/docs/SECURE_BOOT.md"
click node_rescue "https://github.com/paulinotech1/lock_down/blob/main/docs/RECOVERY.md"
click node_apparmor "https://github.com/paulinotech1/lock_down/tree/main/apparmor"
click node_sysctl "https://github.com/paulinotech1/lock_down/blob/main/sysctl/99-workstation-hardening.conf"
click node_firewall "https://github.com/paulinotech1/lock_down/blob/main/nftables/workstation.nft"
click node_usb_policy "https://github.com/paulinotech1/lock_down/blob/main/usbguard/rules.conf"
click node_host_checks "https://github.com/paulinotech1/lock_down/blob/main/scripts/preflight-security.sh"
click node_encrypted_storage "https://github.com/paulinotech1/lock_down/blob/main/docs/STORAGE_SECURITY.md"
click node_tpm "https://github.com/paulinotech1/lock_down/blob/main/docs/TPM.md"
click node_pam "https://github.com/paulinotech1/lock_down/blob/main/docs/YUBIKEY_PAM.md"
click node_desktop "https://github.com/paulinotech1/lock_down/blob/main/docs/KDE.md"
click node_power "https://github.com/paulinotech1/lock_down/tree/main/power"
click node_vm_profiles "https://github.com/paulinotech1/lock_down/tree/main/vm-profiles"
click node_libvirt "https://github.com/paulinotech1/lock_down/blob/main/docs/KVM_SECURITY.md"
click node_hardware "https://github.com/paulinotech1/lock_down/blob/main/docs/HARDWARE.md"
click node_offline_recovery "https://github.com/paulinotech1/lock_down/blob/main/docs/RECOVERY.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kernel_config,node_kernel_builder,node_secure_boot,node_rescue toneBlue
class node_apparmor,node_sysctl,node_firewall,node_usb_policy,node_host_checks toneAmber
class node_encrypted_storage,node_tpm,node_pam,node_offline_recovery toneMint
class node_desktop,node_power,node_vm_profiles,node_libvirt,node_hardware toneRose
class node_owner,node_ubuntu toneIndigo
```

## Components

### Kernel and boot

- [Kernel profiles](https://github.com/paulinotech1/lock_down/tree/main/config): `config`
- [Kernel build](https://github.com/paulinotech1/lock_down/blob/main/scripts/build-kernel.sh): `scripts/build-kernel.sh`
- [Secure Boot](https://github.com/paulinotech1/lock_down/blob/main/docs/SECURE_BOOT.md): `docs/SECURE_BOOT.md`
- [Rescue kernel](https://github.com/paulinotech1/lock_down/blob/main/docs/RECOVERY.md): `docs/RECOVERY.md`

### Host hardening

- [AppArmor policy](https://github.com/paulinotech1/lock_down/tree/main/apparmor): `apparmor`
- [Kernel sysctls](https://github.com/paulinotech1/lock_down/blob/main/sysctl/99-workstation-hardening.conf): `sysctl/99-workstation-hardening.conf`
- [nftables firewall](https://github.com/paulinotech1/lock_down/blob/main/nftables/workstation.nft): `nftables/workstation.nft`
- [USB policy](https://github.com/paulinotech1/lock_down/blob/main/usbguard/rules.conf): `usbguard/rules.conf`
- [Security checks](https://github.com/paulinotech1/lock_down/blob/main/scripts/preflight-security.sh): `scripts/preflight-security.sh`

### Storage and identity

- [LUKS2 storage](https://github.com/paulinotech1/lock_down/blob/main/docs/STORAGE_SECURITY.md): `docs/STORAGE_SECURITY.md`
- [TPM2 and PIN](https://github.com/paulinotech1/lock_down/blob/main/docs/TPM.md): `docs/TPM.md`
- [YubiKey PAM](https://github.com/paulinotech1/lock_down/blob/main/docs/YUBIKEY_PAM.md): `docs/YUBIKEY_PAM.md`
- [Recovery credential](https://github.com/paulinotech1/lock_down/blob/main/docs/RECOVERY.md): `docs/RECOVERY.md`

### Workstation use

- [KDE workstation](https://github.com/paulinotech1/lock_down/blob/main/docs/KDE.md): `docs/KDE.md`
- [Power policy](https://github.com/paulinotech1/lock_down/tree/main/power): `power`
- [VM profiles](https://github.com/paulinotech1/lock_down/tree/main/vm-profiles): `vm-profiles`
- [KVM and libvirt](https://github.com/paulinotech1/lock_down/blob/main/docs/KVM_SECURITY.md): `docs/KVM_SECURITY.md`
- [Verified hardware](https://github.com/paulinotech1/lock_down/blob/main/docs/HARDWARE.md): `docs/HARDWARE.md`

### Other components

- **System owner**
- **Ubuntu LTS**

## Connections

- System owner → Ubuntu LTS: starts with
- Kernel profiles → Kernel build: configures
- Ubuntu LTS → Kernel build: builds for
- Kernel build → Secure Boot: signs for boot
- Secure Boot → Rescue kernel: retains fallback
- TPM2 and PIN → LUKS2 storage: unlocks with PIN
- Recovery credential → LUKS2 storage: recovers access
- AppArmor policy → KDE workstation: confines processes
- Kernel sysctls → KDE workstation: hardens host
- nftables firewall → KDE workstation: filters traffic
- USB policy → KDE workstation: restricts devices
- YubiKey PAM → KDE workstation: authenticates users
- VM profiles → KVM and libvirt: profiles guests
- Power policy → KDE workstation: sets power policy
- Verified hardware → Kernel profiles: guides tailoring
- System owner → Security checks: runs checks