Show HN: Bor – Open-source policy management for Linux desktops

📝 Discussion Summary (Click to expand)

Top 3 Themes from the Hacker News thread

A need for a centralized Linux management solution that integrates with existing identity systems
“What other open source or enterprise solutions is this potentially competing with? What made you write your own, as in, what you weren’t able to do or didn’t like about existing solutions?” — stasiu
Push‑based, real‑time policy delivery with built‑in drift detection
“Delivery is push, not pull. Each agent holds a persistent gRPC stream… Policy changes are broadcast over that stream the moment they're released — agents apply them in real time.” — eniac111
“The agent rewrites the file from its cached policy state and re‑reports compliance to the server… drift isn’t just corrected — it’s auditable.” — eniac111
Enrollment & identity handling (temp tokens, LDAP/AD integration, non‑domain machines)
“The default enrollment is based on temporary (5 min lifetime) tokens, generated from the UI. Domain‑joined machines use Kerberos, but this is optional.” — eniac111
“Is there a lightweight path for personal machines that aren’t LDAP‑joined, or is the temp‑token enrollment strictly for domain boxes?” — teddzfr

🚀 Project Ideas

[Centralized web UI to author per‑desktop Linux policies, map Authentik users to local accounts, and safely execute sandboxed script templates.]

Key	Value
Target Audience	Linux system administrators, MSPs, non‑profit IT staff
Core Feature	Policy authoring for GNOME/KDE/Cinnamon, user‑to‑Linux account mapping, temporary‑token enrollment, sandboxed script execution via env‑var
Tech Stack	React front‑end, Node.js/Express API, gRPC agent, Authentik OAuth, SQLite DB
Difficulty	Medium
Monetization	Revenue-ready: Subscription

[HN comment: “I would love to see configurations for Linux Mint’s Cinnamon… can I map a user in Authentik to a Linux account?”]
[Addresses manual configuration and drift concerns highlighted throughout the discussion.]

[Platform that integrates SCAP/DISA STIG enforcement with conflict‑resolution and real‑time drift audit for Linux fleets.]

Key	Value
Target Audience	Security‑focused enterprises, compliance teams
Core Feature	SCAP XCCDF policy engine, priority‑based conflict resolution, inotify‑driven drift correction, audit‑ready logs
Tech Stack	Python backend, PostgreSQL, gRPC, OpenSCAP library, mTLS
Difficulty	High
Monetization	Revenue-ready: Tiered licensing

[Directly satisfies HN user request for SCAP support to enforce DISA STIGs.]
[Provides built‑in policy conflict handling analogous to package postinstall race issues discussed.]
[Adds enterprise‑grade audit trail for tamper events, appealing to compliance officers.]

[Lightweight SaaS that enforces screen‑time limits and content filtering on Linux laptops, with per‑user enrollment tokens.]

Key	Value
Target Audience	Parents, NGOs, small schools managing children’s devices
Core Feature	PAM‑based time limits, DNS‑over‑HTTPS adult‑content blocking, policy push via mTLS, enrollment token support
Tech Stack	Go microservice, SQLite, Node.js UI, Linux PAM, Cloudflare DNS filter
Difficulty	Medium
Monetization	Revenue-ready: Monthly per‑device subscription

[Answers HN user query about enforcing “screen time” for laptops given to children.]
[Simplifies parental control compared to manual lockdown methods discussed.]
[Potential to later add safe script execution for broader management use cases.]