Decisions
The architecture decision records of IbexWall: the choice, the options and the reasons.
- ADR-0001: Product and organization (D-001)
- ADR-0002: Canonical naming and spelling (D-002)
- ADR-0003: Desktop first; Fedora, Ubuntu, Debian, Arch (D-003)
- ADR-0004: Rust for the whole client, eBPF with aya (D-004)
- ADR-0005: varlink over unix socket with per-method polkit (D-005)
- ADR-0006: Plugins as separate sandboxed processes (D-006)
- ADR-0007: Plugins propose, the core executes (D-007)
- ADR-0008: Own nftables table; inbound via adapters (D-008)
- ADR-0009: Local DNS resolver behind native backends (D-009)
- ADR-0010: Change engine with snapshots and timed confirmation (D-010)
- ADR-0011: Monorepo for the open source client (D-011)
- ADR-0012: Client licensing: GPL-3.0-or-later, DCO, no CLA (D-012)
- ADR-0013: Permissive proto/sdk; dual-licensed eBPF (D-013)
- ADR-0014: Managed mode via open contracts (D-014)
- ADR-0015: MCP assistant as an isolated, powerless client (D-015)
- ADR-0016: Protections never disabled by billing state (D-016)
- ADR-0017: Website and docs on Cloudflare (D-017)
- ADR-0018: FOSS first, managed later (D-018)
- ADR-0019: Single web UI in a Tauri shell (D-019)
- ADR-0020: i18n with Fluent, en source, pt-BR mandatory (D-020)
- ADR-0021: Reverse-DNS prefix com.ibexwall (D-021)
- ADR-0022: Confidential business material stays out (D-022)
- ADR-0023: CI runs no VM jobs at F0 (deviation)
- ADR-0024: In-repo varlink framing (spike S1-a)
- ADR-0025: Caller identity and polkit subject (spike S1-b)
- ADR-0026: Transient-unit executor (spike S1-c)
- ADR-0027: ibexwall-varlink is Apache-2.0 OR MIT
- ADR-0028: ibexwall-dns is a forwarding stub on hickory 0.26
- ADR-0029: DNS backend adapters live in the net.dns plugin
- ADR-0030: Captive portals are detected and announced, never auto-relieved
- ADR-0031: the connect monitor uses cgroup/connect hooks on aya
- ADR-0032: the connection monitor is its own hardened unit
- ADR-0033: the Flatpak network block writes the override file
- ADR-0034: firewalld and ufw are driven by fixed argv
- ADR-0035: Ask mode holds the first packet in NFQUEUE
- ADR-0036: Ask is driven by the core, and its nft chains are derived state
- ADR-0037: Without eBPF there is no per-app enforcement, and the UI says so
- ADR-0038: Plugin ids use hyphens
- ADR-0039: The MCP stdio protocol is implemented in
ibexwall-mcp - ADR-0040: OpenVPN profiles are imported as a documented subset
- ADR-0041: Official plugins ship as one multicall binary
- ADR-0042: Nothing leaves the machine in the clear
- ADR-0043: Plugins start by socket activation, in a unit of their own
- ADR-0044: What the SELinux and AppArmor policies confine