Nostr notes by

🔔 Rusko vyslalo na Kyjev nejvíce balistických raket od ...

2026-07-19T15:08:01+02:00

🔔 Rusko vyslalo na Kyjev nejvíce balistických raket od začátku války:

Nejméně jednu oběť a několik zraněných si vyžádaly ruské noční údery na Kyjev. Podle ukrajinského ministra zahraničí Andrije Sybihy v noci Rusové vypálili na hlavní město čtyři desítky balistických raket, což je nejvíce od roku 2022. Údery zasáhly nejméně pět kyjevských čtvrtí.
https://www.idnes.cz/zpravy/zahranicni/ruske-udery-utok-drony-rakey-ukrajina-kyjev-obeti-moskva.A260719_072420_zahranicni_sahu
#CzechNews #News #Press #Media

Being drunk is massively overrated too.

2026-07-19T15:07:29+02:00

In reply to nevent1q…ks59
_________________________

Being drunk is massively overrated too.

Wild Animals ...

2026-07-19T15:06:03+02:00

Wild Animals

#AnimalKingdom

Good Morning Big Brother is watching you, flock safety, EU chat ...

2026-07-19T15:06:57+02:00

Good Morning
Big Brother is watching you, flock safety, EU chat control, and Palantir are running to monitor you 24/7 because you’re just so cute.

Anya Hello Kitty Meme 1984

#中国人民为何穷感觉最近都在发 ...

2026-07-19T15:05:55+02:00

#中国人民为何穷

感觉最近都在发人世几回伤往事这个tag，不负面的学习使我快乐都用不上了。
而且能发人世的内容，基本都是中国负面信息，也都能叫做 #中国人民为何穷系列······
——
冷仙 :verified: (anitya@go5.dev)
Nostr: nprofile1qyt8wumn8ghj7un9d3shjtnyd968gmewwp6kytcqyz4x9wq235fsec8dtssyxu7qa4c4033fmgh4dwk0usk0wfql5hgts3mnltg
https://go5.dev/@anitya/116946784034973655

Nostr event nevent1qqsvuyf3pdewnfp7lyqyt3k7c54rdgdmd0mxq5j0aknqzywt2kd8g4qpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyzwl0a7

2026-07-19T15:05:55+02:00

我家在仙山

——
在双黄线处调头的瘪三 (linhardt@m.otter.homes)
Nostr: nprofile1qyt8wumn8ghj7un9d3shjtnyd968gmewwp6kytcqyzylskywt0yqgeuqjylhr42gpyl75m3gcn5gw3hq87m2r00ntmr42akcx6f
https://m.otter.homes/@linhardt/116946784340207291

Nostr event nevent1qqsfv82rmwzckltzk5fv792s5c7hhsw3g2e97qm7ynnzht0sdne8xlcpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdety4qa9mw

2026-07-19T15:05:51+02:00

https://x.com/Karamomo912/status/2078684619436855317?s=20
好地狱的御守…
——
𝕾𝖊𝖎𝖒𝖊𝖎｜化石より古い日のキミから届くエコー (clear_ship@m.cmx.im)
Nostr: nprofile1qyv8wumn8ghj7un9d3shjtnpwf6xjmmnw3ezucmg9uqs6amnwvaz7tmwdaejumr0dsq3qamnwvaz7tmzdaehgu3wwd5x7uqpz4mhxue69uhhyetvv9ujumn0wd68ytnwv46qz9thwden5te0dehhxarj9ejxzarp9e5xzatnqqsplhgpv9knvtlump96qcx73lvyd2gcsyf4mw8ferxjl283yne4l9cwj6y5q
https://m.cmx.im/@clear_ship/116946770161474427

自己採点では法律科目過去最高点や —— なゆも ...

2026-07-19T15:05:54+02:00

自己採点では法律科目過去最高点や
——
なゆも ‮c＾ω＾っ ‮ (qzbx@waha.work)
Nostr: nprofile1qyt8wumn8ghj7un9d3shjtnyd968gmewwp6kytcqyzh6gwwg6ypjr6e7xmxt3fwhnpct59wvfy9ehel35ywlv74r0kaeyjsgw3z
https://waha.work/@qzbx/116946782767345431

Nostr event nevent1qqstrdkgg5lsyw5r085gztmwt689erl0a350rxdnmvy436t928ayxmgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyumtqj3

2026-07-19T15:05:50+02:00

密老／宋・赵琥
匹马飘然似转蓬，一年两度过湘东。
襟裙润带黄梅雨，枕簟凉生若楝风。
急急穷途将底用，区区苟禄有何功。
输他燕坐长厅老，点对浓香丈室中。
——
唐诗宋词 (cnpoem@m.cmx.im)
Nostr: nprofile1qyv8wumn8ghj7un9d3shjtnpwf6xjmmnw3ezucmg9uqs6amnwvaz7tmwdaejumr0dsq3qamnwvaz7tmzdaehgu3wwd5x7uqpz4mhxue69uhhyetvv9ujumn0wd68ytnwv46qz9thwden5te0dehhxarj9ejxzarp9e5xzatnqqs0a486cqszp6xangdfzcnvj30qep2avqczvym3e7nh5vjlds3qvaq55udfa
https://m.cmx.im/@cnpoem/116946764216750038

持续卖淫中 —— 本药店不攻特受药 ...

2026-07-19T15:05:51+02:00

持续卖淫中
——
本药店不攻特受药 (babysharkdodooo@wxw.moe)
Nostr: nprofile1qyt8wumn8ghj7un9d3shjtnyd968gmewwp6kytcqyrwd96qd5ehadklyk63crvczd9aw0kg0pf9qks5dxk564ct7ktczqdkvqq6
https://wxw.moe/@babysharkdodooo/116946765125392904

等我小了我也要从爸爸逼里生出来 —— ...

2026-07-19T15:05:50+02:00

等我小了我也要从爸爸逼里生出来
——
家攻的裸替 (Sixteenounce@wxw.moe)
https://wxw.moe/@Sixteenounce/116946758385815330

Nostr event nevent1qqsra2uz8flj0glecycwa0ux4c00476v3q0pxgccsnhkqapelhex5mqpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyp358nf

2026-07-19T15:05:49+02:00

王妮娜看我操丁嘉琳说人生就是离开自己的爸爸然后操别人的爸爸，我。
——
家攻的裸替 (Sixteenounce@wxw.moe)
https://wxw.moe/@Sixteenounce/116946749050463415

Nostr event nevent1qqsgrszkj4jg2weuw6elapdxcsemcxzh9k6quudkmq4xc999ejymthcpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetywetz0n

2026-07-19T15:05:50+02:00

谁囡囡

——
本药店不攻特受药 (babysharkdodooo@wxw.moe)
Nostr: nprofile1qyt8wumn8ghj7un9d3shjtnyd968gmewwp6kytcqyrwd96qd5ehadklyk63crvczd9aw0kg0pf9qks5dxk564ct7ktczqdkvqq6
https://wxw.moe/@babysharkdodooo/116946753977759279

🤖 Tracking strings detected and removed! 🔗 Clean URL(s): ...

2026-07-19T15:05:48+02:00

In reply to nevent1q…600z
_________________________

🤖 Tracking strings detected and removed!

🔗 Clean URL(s):
https://www.instagram.com/reel/Da9RU8ZNDtK/

❌ Removed parts:
igsh=d2ZoaHYzM2dyNm45

Wild Animals ...

2026-07-19T15:05:03+02:00

Wild Animals

#NostrAnimals

DeFi — это не финансовая революция, а ...

2026-07-19T15:04:58+02:00

DeFi — это не финансовая революция, а очередной способ перераспределить деньги от новичков к тем, кто уже в теме. Да, ethereum.org пишет, что это "доступно каждому", но реальность проще: 90% пользователей теряют деньги на impermanent loss, а остальные 10% — это те, кто пишет гайды "как заработать на DeFi". Solana уже обогнала Ethereum по TVL, но спросите себя: если всё так д...

Body of missing crew worker found after boat sinks in Amsterdam A ...

2026-07-19T15:05:00+02:00

Body of missing crew worker found after boat sinks in Amsterdam

A body was recovered overnight during a search in the Coenhaven in Amsterdam, police said.

https://nltimes.nl/2026/07/19/body-missing-crew-worker-found-boat-sinks-amsterdam

:locked: 1. Ephemeral Encrypted Volatile DVMs (for devices up to ...

2026-07-19T15:04:49+02:00

In reply to nevent1q…vhtk
_________________________

:locked: 1. Ephemeral Encrypted Volatile DVMs (for devices up to 16 GB RAM)

Script deploys a systemd service that creates a fresh LUKS-encrypted LVM thin pool on every boot, clones all DVM templates into it as ephemeral -ephemeral variants, and completely destroys the pool - including all VM volumes, encryption keys, and the underlying image file - on shutdown. This guarantees that all DVM session data resides exclusively on encrypted volatile storage that is cryptographically irrecoverable after poweroff, leaving no forensic traces on disk.

This solution does not impose any additional memory load, which is critical for devices with less than 16 GB of RAM. My friends with 16 GB devices experienced severe issues when running DVMs entirely in RAM - DVMs would crash unexpectedly, or dom0 would start glitching: panel and app menu artifacts, cursor freezes.

Make sure there is sufficient free space (more than 4 GB) in dom0. You can resize dom0 these commands:

sudo lvresize --size 4G /dev/mapper/qubes_dom0-root
sudo resize2fs /dev/mapper/qubes_dom0-root
sudo lvresize -L +4G qubes_dom0/root-pool

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/ephemeral-pool.service << 'EOF'
[Unit]
Description=Fresh ephemeral encrypted LVM pool with DVM auto-clone
After=local-fs.target qubesd.service
Requires=qubesd.service
Before=qubes-vm@sys-net.service qubes-vm@sys-firewall.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/local/bin/ephemeral-pool-destroy.sh
ExecStart=/usr/local/bin/ephemeral-pool-create.sh
ExecStop=/usr/local/bin/ephemeral-pool-destroy.sh

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/ephemeral-pool-create.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="ephemeral_pool"
MOUNT_BASE="/var/tmp/ephemeral"
KEY_FILE="/dev/shm/ephemeral.key"
IMG_FILE="${MOUNT_BASE}/pool.img"
LUKS_NAME="ephemeral_crypt"
POOL_SIZE="4G"

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram0)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Destroying old ephemeral VMs and artifacts..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
rm -f "${KEY_FILE}" "${IMG_FILE}"

echo "[+] Cleanup completed. Pool creation skipped in amnesiac mode."
exit 0
fi

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
rm -f "${KEY_FILE}" "${IMG_FILE}"

mkdir -p "${MOUNT_BASE}"
install -m600 /dev/null "${KEY_FILE}" && dd if=/dev/urandom bs=1 count=4096 of="${KEY_FILE}" iflag=fullblock
truncate -s "${POOL_SIZE}" "${IMG_FILE}"
LOOP_DEV=$(losetup -f --show "${IMG_FILE}")
cryptsetup luksFormat -q --key-file "${KEY_FILE}" "${LOOP_DEV}"
cryptsetup open --key-file "${KEY_FILE}" "${LOOP_DEV}" "${LUKS_NAME}"
pvcreate "/dev/mapper/${LUKS_NAME}"
vgcreate "ephemeral_vg" "/dev/mapper/${LUKS_NAME}"
lvcreate -T -n "thin_pool" -l +100%FREE "ephemeral_vg"
losetup -d "${LOOP_DEV}" || true

if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi
qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group=ephemeral_vg --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group=ephemeral_vg,thin_pool=thin_pool

echo "[*] Copying DVM templates..."
qvm-ls --raw-list 2>/dev/null | grep -i 'dvm' | grep -v '\-ephemeral$' | while read vm; do
[ -n "$vm" ] || continue
clone_name="${vm}-ephemeral"
qvm-check -q "$clone_name" 2>/dev/null && {
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
}
echo " -> $vm -> ${clone_name}"
qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name" && {
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
}
done

echo "[+] Done!"
EOF

sudo tee /usr/local/bin/ephemeral-pool-destroy.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="ephemeral_pool"
LUKS_NAME="ephemeral_crypt"
KEY_FILE="/dev/shm/ephemeral.key"
IMG_FILE="/var/tmp/ephemeral/pool.img"

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
for loop in $(losetup -j "${IMG_FILE}" 2>/dev/null | cut -d: -f1 || true); do
[ -n "$loop" ] && losetup -d "$loop" 2>/dev/null || true
done
rm -f "${KEY_FILE}" "${IMG_FILE}"
EOF

sudo chmod +x /usr/local/bin/ephemeral-pool-create.sh
sudo chmod +x /usr/local/bin/ephemeral-pool-destroy.sh
sudo systemctl daemon-reload
sudo systemctl enable --now ephemeral-pool.service

To remove pool and disable the systemd service:

sudo systemctl stop ephemeral-pool.service
sudo systemctl disable ephemeral-pool.service

Start the service and pool again:

sudo systemctl enable --now ephemeral-pool.service

:card_index_dividers: 2. RAM-based DVMs on a Zram disk (for devices with 20-24 GB of RAM)

This script creates a compressed RAM disk (zram) that acts as a super-fast ephemeral storage pool for your DVMs. On every boot, it sets aside a portion of your RAM - compressed with lz4 algorithm to save space - builds an LVM thin pool on top of it, and clones all your DVM templates there as -ephemeral variants. When you shut down the system, everything in that RAM disk vanishes instantly without ever touching your physical disk. The key advantage of zram is built-in compression: your 3 GB pool can hold 6-7 GB of actual VM data, giving you more usable space than raw RAM would allow. It is also significantly faster than disk-based storage, so DVMs launch and run with near-native speed. Unlike tmpfs, zram does not compete with your system memory for cache.

First, increase the maximum dom0 memory in this file
sudo nano /etc/default/grub
edit this value dom0_mem=max:4096M to dom0_mem=max:6144M,
update GRUB sudo grub2-mkconfig -o /boot/grub2/grub.cfg and reboot Qubes OS.

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/zram-pool.service << 'EOF'
[Unit]
Description=ZRAM Ephemeral Pool
After=qubesd.service
Before=qubes-vm@sys-net.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/zram-pool-create.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/zram-pool-create.sh << 'EOF'
#!/bin/bash
set -euo pipefail

POOL_NAME="zram_pool"
ZRAM_SIZE="4G"
VG_NAME="zram_vg"

EXTRA_VMS=(
#"whonix"
#"sys-whonix"
)

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram0)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Cleaning up old VMs..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

for dev in /dev/zram*; do
[ -b "$dev" ] || continue
zramctl --reset "$dev" 2>/dev/null || true
done

echo "[+] Cleanup completed."
exit 0
fi

if [ "$EUID" -ne 0 ]; then
echo "[!] Root privileges required"
exit 1
fi

echo "[*] Creating zram device (${ZRAM_SIZE})..."
modprobe zram 2>/dev/null || true

ZRAM_DEV=""
for dev in /dev/zram*; do
[ -b "$dev" ] || continue
if ! zramctl "$dev" 2>/dev/null | grep -q "mounted\|active"; then
ZRAM_DEV="$dev"
break
fi
done

if [ -z "$ZRAM_DEV" ]; then
ZRAM_DEV=$(zramctl --find --size "$ZRAM_SIZE" --algorithm lz4)
else
zramctl --reset "$ZRAM_DEV" 2>/dev/null || true
ZRAM_DEV=$(zramctl --find --size "$ZRAM_SIZE" --algorithm lz4)
fi

echo " Device: $ZRAM_DEV"

echo "[*] Removing VMs from pool ${POOL_NAME}..."
for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 30 "$vm" 2>/dev/null || {
echo " -> Force killing: $vm"
qvm-kill "$vm" 2>/dev/null || true
}
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

echo "[*] Cleaning up old infrastructure..."
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

# Detach old loops on zram
for loopdev in $(losetup -a 2>/dev/null | grep "$ZRAM_DEV" | cut -d: -f1); do
echo " -> Detaching loop: $loopdev"
losetup -d "$loopdev" 2>/dev/null || true
done

echo "[*] Creating loop on ${ZRAM_DEV}..."
LOOP_DEV=$(losetup -f --show "$ZRAM_DEV")
echo " Loop: $LOOP_DEV"

echo "[*] Creating LVM on ${LOOP_DEV}..."
pvcreate -q "$LOOP_DEV"
vgcreate -q "${VG_NAME}" "$LOOP_DEV"
lvcreate -q -T -n "thin_pool" -l +100%FREE "${VG_NAME}"

echo "[*] Registering pool ${POOL_NAME}..."
if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi

qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group="${VG_NAME}" --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group="${VG_NAME}",thin_pool=thin_pool

echo " Pool created:"
qvm-pool info "${POOL_NAME}"

echo "[*] Cloning VMs into ephemeral pool..."

echo " [DVM templates]"
qvm-ls --raw-list 2>/dev/null | while read -r vm; do
[ -n "$vm" ] || continue

is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done

if [ ${#EXTRA_VMS[@]} -gt 0 ]; then
echo " [Extra VMs]"
for vm in "${EXTRA_VMS[@]}"; do
if ! qvm-ls --raw-list 2>/dev/null | grep -q "^${vm}$"; then
echo " [!] VM not found: $vm"
continue
fi

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Skipping (already in zram): $vm"
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms False 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done
fi
EOF

sudo chmod +x /usr/local/bin/zram-pool-create.sh
sudo systemctl daemon-reload
sudo systemctl enable --now zram-pool.service

To remove zram pool and disable the systemd service run this script:

#!/bin/bash

# Step 1: Stop and disable the systemd service
sudo systemctl stop zram-pool.service
sudo systemctl disable zram-pool.service

# Step 2: Remove all VMs from zram_pool
echo "[*] Removing VMs from zram_pool..."
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "zram_pool"; then
echo " -> Removing: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Step 3: Remove the Qubes storage pool
echo "[*] Removing zram_pool..."
qvm-pool remove zram_pool 2>/dev/null || true

# Step 4: Deactivate and remove LVM volume group
echo "[*] Cleaning up LVM..."
vgchange -an zram_vg 2>/dev/null || true
vgremove -f zram_vg 2>/dev/null || true

# Step 5: Detach loop device from zram
echo "[*] Detaching loop devices..."
for loopdev in $(losetup -a 2>/dev/null | grep "/dev/zram" | cut -d: -f1); do
echo " -> Detaching: $loopdev"
losetup -d "$loopdev" 2>/dev/null || true
done

# Step 6: Reset zram device
echo "[*] Resetting zram device..."
for dev in /dev/zram*; do
[ -b "$dev" ] || continue
zramctl --reset "$dev" 2>/dev/null || true
done

echo "[+] zram pool completely removed. Reboot to clear all traces from memory."

Start the service and pool again:

sudo systemctl enable --now zram-pool.service

:tornado: 3. RAM-based DVMs on TMPFS (for devices with 32 GB of RAM)

This variant creates a pure RAM-based ephemeral pool using tmpfs. On every boot, it allocates a portion of your system memory as a temporary filesystem, builds an LVM thin pool inside it, and clones all your DVM templates there as ephemeral variants. When you shut down or reboot, the entire pool and all its VMs vanish instantly. Direct RAM access means DVMs launch faster than any other storage type. No encryption overhead, no zram compression delays or disk I/O bottlenecks - just RAM and LVM. The entire pool size is reserved from RAM immediately, making this best suited for systems with 32 GB or more.

First, increase the maximum dom0 memory in this file
sudo nano /etc/default/grub
edit this value dom0_mem=max:4096M to dom0_mem=max:8192M,
update GRUB sudo grub2-mkconfig -o /boot/grub2/grub.cfg and reboot Qubes OS.

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/tmpfs-pool.service << 'EOF'
[Unit]
Description=TMPFS Ephemeral Pool
After=qubesd.service
Before=qubes-vm@sys-net.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/tmpfs-pool-create.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/tmpfs-pool-create.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="tmpfs_pool"
MOUNT_BASE="/dev/shm/ephemeral"
IMG_FILE="${MOUNT_BASE}/pool.img"
POOL_SIZE="4G"
VG_NAME="ephemeral_vg"

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Destroying old ephemeral VMs and artifacts..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true
rm -rf "${MOUNT_BASE}"

echo "[+] Cleanup completed. Pool creation skipped in amnesiac mode."
exit 0
fi

echo "[*] Phase 1: Removing ALL VMs from ephemeral pool..."

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Pool in RAM — simply delete files
echo "[*] Phase 2: Cleaning old pool from RAM..."

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

# Remove old files (if any remain)
rm -rf "${MOUNT_BASE}"

echo "[*] Phase 3: Creating fresh ephemeral pool in RAM..."

mkdir -p "${MOUNT_BASE}"

# New image in RAM
truncate -s "${POOL_SIZE}" "${IMG_FILE}"

# Loop device
LOOP_DEV=$(losetup -f --show "${IMG_FILE}")

# LVM thin pool directly on loop (no encryption)
pvcreate "$LOOP_DEV"
vgcreate "${VG_NAME}" "$LOOP_DEV"
lvcreate -T -n "thin_pool" -l +100%FREE "${VG_NAME}"

# Detach loop
losetup -d "${LOOP_DEV}" || true

echo "[*] Phase 4: Registering pool..."

if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi

qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group="${VG_NAME}" --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group="${VG_NAME}",thin_pool=thin_pool

if ! qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
echo "[!] Pool registration failed"
exit 1
fi

echo "[+] Pool ready in RAM"

echo "[*] Phase 5: Copying DVM templates..."

echo " [DVM templates]"
qvm-ls --raw-list 2>/dev/null | while read -r vm; do
[ -n "$vm" ] || continue

is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done

echo "[+] Done!"
echo ""
echo "VMs in ephemeral pool:"
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " - $vm"
fi
done
EOF

sudo chmod +x /usr/local/bin/tmpfs-pool-create.sh
sudo systemctl daemon-reload
sudo systemctl enable --now tmpfs-pool.service

To remove zram pool and disable the systemd service run this script:

#!/bin/bash

# Step 1: Stop the service (prevents auto-restart on boot)
sudo systemctl stop tmpfs-pool.service
sudo systemctl disable tmpfs-pool.service

# Step 2: Remove all VMs from tmpfs_pool
echo "[*] Removing VMs from tmpfs_pool..."
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "tmpfs_pool"; then
echo " -> Removing: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Step 3: Remove the Qubes storage pool
echo "[*] Removing tmpfs_pool..."
qvm-pool remove tmpfs_pool 2>/dev/null || true

# Step 4: Clean up LVM
echo "[*] Cleaning up LVM..."
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true

# Step 5: Free RAM by removing the image
echo "[*] Freeing RAM..."
rm -rf /dev/shm/ephemeral

echo "[+] tmpfs pool stopped and cleaned up."

Start the service and pool again:

sudo systemctl enable --now tmpfs-pool.service

:gear: 4. Modifying default DVMs

This solution is for those who want to configure the default DVMs for amnesic operation - without creating new pools or new DVMs.

Сreate a systemd service that remounts the root in the DVM as an ephemeral encrypted volatile volume:

#!/bin/bash

sudo tee /etc/systemd/system/dvm-root.service << 'EOF'
[Unit]
Description=DVM root rw False
After=qubesd.service
Requires=qubesd.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/dvm-root.sh

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/dvm-root.sh << 'EOF'
#!/bin/bash
set -euo pipefail

while read -r vm; do
[ -n "$vm" ] || continue
is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue
qvm-volume config "${vm}:root" rw false
done < <(qvm-ls --raw-list)
EOF

sudo chmod +x /usr/local/bin/dvm-root.sh
sudo systemctl daemon-reload
sudo systemctl enable dvm-root.service
qvm-pool set vm-pool -o ephemeral_volatile=True

TMPFS Script for Debian/Fedora/Kicksecure-based DVM templates:

OVERLAY_BASE="/run/home-overlay"
LOWERDIR="/home"
UPPERDIR="$OVERLAY_BASE/upper"
WORKDIR="$OVERLAY_BASE/work"
MOUNTPOINT="/home"

# Create directories
mkdir -p "$UPPERDIR" "$WORKDIR"

# Mount tmpfs for overlay upper+work layers
mount -t tmpfs -o size=2G,mode=0755 tmpfs "$OVERLAY_BASE"

# Recreate upper/work inside tmpfs after mount
mkdir -p "$UPPERDIR" "$WORKDIR"

# Mount overlayfs
mount -t overlay overlay \
-o lowerdir="$LOWERDIR",upperdir="$UPPERDIR",workdir="$WORKDIR" \
"$MOUNTPOINT"

Or alternative Script: Zram-disk for Debian/Fedora/Kicksecure-based DVM templates (If you want an overlay with memory compression - saves RAM, but adds slight CPU overhead):

ZRAM_DEV=""
ZRAM_SIZE="2G"
LOWERDIR="/home"
OVERLAY_BASE="/run/home-overlay"
UPPERDIR="$OVERLAY_BASE/upper"
WORKDIR="$OVERLAY_BASE/work"
MOUNTPOINT="/home"

# --- 1. Create and configure zram device ---

# Load zram module if not loaded
if ! lsmod | grep -q "^zram"; then
modprobe zram num_devices=1 || modprobe zram
fi

# Wait for zram control interface
for _ in {1..10}; do
if [ -d /sys/class/zram-control ]; then
break
fi
sleep 0.1
done

# Find first free zram device
for i in /sys/block/zram*; do
[ -e "$i" ] || continue
if [ "$(cat "$i"/disksize)" = "0" ]; then
ZRAM_DEV="/dev/$(basename "$i")"
break
fi
done

if [ -z "$ZRAM_DEV" ]; then
# No free device; try to add one via hot_add
if [ -f /sys/class/zram-control/hot_add ]; then
idx=$(cat /sys/class/zram-control/hot_add)
ZRAM_DEV="/dev/zram$idx"
else
echo "ERROR: no free zram device found and hot_add not available" >&2
exit 1
fi
fi

echo "Using $ZRAM_DEV"

# Configure compression and size
echo lz4 > /sys/block/$(basename "$ZRAM_DEV")/comp_algorithm 2>/dev/null || true
echo "$ZRAM_SIZE" > /sys/block/$(basename "$ZRAM_DEV")/disksize

# Format and mount zram as ext4 (needed for overlay upper+work)
mkfs.ext4 -q "$ZRAM_DEV"

mkdir -p "$OVERLAY_BASE"
mount -t ext4 "$ZRAM_DEV" "$OVERLAY_BASE"

# --- 2. Prepare overlay directories ---

mkdir -p "$UPPERDIR" "$WORKDIR"

# --- 3. Mount overlayfs ---

mount -t overlay overlay \
-o lowerdir="$LOWERDIR",upperdir="$UPPERDIR",workdir="$WORKDIR" \
"$MOUNTPOINT"

For additional anti-forensic protection, you can use this script and redirect all system journal logs to memory (volatile storage). Additionally, this script deletes files containing metadata about removed VMs (this is simple file deletion, which has anti-forensic value only in the context of TRIM/discard on NVMe SSD, but is not direct anti-forensics). The basis of this script (files removing) is the second script from this guide:

#!/bin/bash

sudo tee /etc/systemd/journald.conf << EOF
[Journal]
Storage=volatile
EOF
sudo systemctl restart systemd-journald

sudo tee /etc/systemd/system/clean.service << 'EOF'
[Unit]
Description=Clean logs of removed Qubes VMs
After=qubesd.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/clean.sh
RemainAfterExit=no

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/clean.sh << 'EOF'
#!/bin/bash

set -euo pipefail

readonly LOGDIR='/var/log'
readonly TEMPDIR_ROOT='/home/user/tmp'
readonly MENUDIR='/home/user/.config/menus/applications-merged'

existing_qubes=$(qvm-ls --fields=name --raw-data | sort)

all_qube_names=''

all_qube_names+=$(find "${LOGDIR}/libvirt/libxl/" \
-type f \
-regextype posix-egrep \
-regex '.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^(guid|qrexec|qubesdb)\.//g' \
| sort | uniq)$'\n'

all_qube_names+=$(find "${LOGDIR}/qubes/" \
-type f \
-regextype posix-egrep \
-regex '.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^(guid|qrexec|qubesdb)\.//g' \
| sort | uniq)$'\n'

all_qube_names+=$(find "${LOGDIR}/xen/console/" \
-type f \
-regextype posix-egrep \
-regex '.*\/guest-.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^guest-//g' \
| sort | uniq)$'\n'

set +e
ram_pools=$(qvm-pool list | grep -Eio '^ram_pool_[^ ]+' | sort | uniq)
set -e
all_qube_names+=$(echo "${ram_pools}" | sed -r 's/^ram_pool_//g')$'\n'

if [ -d "${TEMPDIR_ROOT}" ]; then
all_qube_names+=$(find "${TEMPDIR_ROOT}" \
-mindepth 1 -maxdepth 1 -type d \
-exec basename "{}" \; \
| sort | uniq)$'\n'
fi

all_qube_names+=$(find "${MENUDIR}" \
-regextype posix-egrep \
-regex '.*\/user-qubes-.*\.menu$' \
-exec basename "{}" \; \
| sed -r 's/\.menu$//g' \
| sed -r 's/^user-qubes-(disp)?vm-directory(_|-)//g' \
| sort | uniq)$'\n'

all_qube_names=$(echo "${all_qube_names}" \
| sed -r 's/^(Domain-0|libxl-driver)$//g' \
| sed -r '/^\s*$/d' \
| sort | uniq)

set +e
qubes_to_remove=$(diff --new-line-format='' --unchanged-line-format='' \
<(echo "${all_qube_names}") <(echo "${existing_qubes}") \
| sed -r '/^\s*$/d')
set -e

for qube_name in ${qubes_to_remove}; do
decoded_qube_name=$(echo "${qube_name}" \
| sed -r 's/_d/-/g' \
| sed -r 's/_u/_/g')

log_pattern="${qube_name}\.log((\.old)|(-[0-9]{8}))?(\.gz)?"
menu_pattern="user-qubes-(disp)?vm-directory(_|-)${qube_name}\.menu"

declare -A targets
targets=(["${LOGDIR}/libvirt/libxl"]="${log_pattern}"
["${LOGDIR}/qubes"]="((guid|qrexec|qubesdb)\.)?${log_pattern}"
["${LOGDIR}/xen/console"]="guest-${log_pattern}"
["${MENUDIR}"]="${menu_pattern}")

if [ -d "${TEMPDIR_ROOT}" ]; then
targets+=("${TEMPDIR_ROOT}"="${qube_name}")
fi

for search_dir in "${!targets[@]}"; do
mapfile -d $'\0' found_files < <(find "${search_dir}" \
-regextype posix-egrep \
-regex ".*\/${targets[${search_dir}]}$" \
-print0)
for file in "${found_files[@]}"; do
[ -z "${file}" ] && continue
rm -rf "${file}"
done
done
done

for pool_name in ${ram_pools}; do
qube_name=$(echo "${pool_name}" | sed -r 's/^ram_pool_//')
if ! echo "${existing_qubes}" | grep -qx "${qube_name}"; then
pool_mountpoint=$(qvm-pool info "${pool_name}" \
| grep -E '^dir_path' \
| sed -r 's/^dir_path\s+//g')
qvm-pool remove "${pool_name}" 2>/dev/null || true
umount "${pool_mountpoint}" 2>/dev/null || true
rm -rf "${pool_mountpoint}" 2>/dev/null || true
fi
done

find "${LOGDIR}/qubes/" -maxdepth 1 -type f -name '*.log.old' -delete
EOF

sudo chmod +x /usr/local/bin/clean.sh
sudo systemctl daemon-reload
sudo systemctl enable clean.service

Nostr event nevent1qqs0thfflkdq6p25622exjk0lw8sym4fg40f5zvrfrq7u4sff95uaxgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqazl2arm5rhn7wzluz9w7fkdhf56evufa4asl9yptfs5cydcx9mjc6rekh

2026-07-19T15:04:38+02:00

Nostr event nevent1qqspxczc3yuyeqr4gh9ugu0apyaarnfhx2vptshev5q2whd73vz74tgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqazl2arm5rhn7wzluz9w7fkdhf56evufa4asl9yptfs5cydcx9mjtka3rf

2026-07-19T15:04:24+02:00

Above All Things, Respect Yourself ...

2026-07-19T15:04:31+02:00

Above All Things, Respect Yourself

**"#the" is trending—because we’re all waiting for ...

2026-07-19T15:04:01+02:00

**"#the" is trending—because we’re all waiting for the *real* narrative shift.**

Everyone’s fixated on the next 10% move, the next halving cycle, the next "Bitcoin to $100K" headline. But here’s the thing: **we’re still stuck in the same old story.** Satoshi’s whitepaper dropped in 2008, Bitcoin launched in 2009 (per Binance’s recap), and 15 years later? We’re still debatin...

Und ne Reihe ehemaliger Sowjetrepubliken sicherer als ...

2026-07-19T15:03:12+02:00

In reply to nevent1q…dmy4
_________________________

Und ne Reihe ehemaliger Sowjetrepubliken sicherer als Deutschland. Wie sieht eigentlich die Weltkarte des Auswärtigen Amtes aus?

Supposedly King Solomon was overthrown by a Demon for a few ...

2026-07-19T15:02:38+02:00

Supposedly King Solomon was overthrown by a Demon for a few years.

Supposedly also King Solomon had the ability to control many demons.

Encrypted AppVMs and Templates. Encrypted pool. Secret vault in a ...

2026-07-19T15:02:32+02:00

In reply to nevent1q…vhtk
_________________________

Encrypted AppVMs and Templates. Encrypted pool. Secret vault in a LUKS-Pool.

:gear: Install:

Make sure there is sufficient free space (more than 3 GB) in dom0. You can resize dom0 these commands:

sudo lvresize --size 3G /dev/mapper/qubes_dom0-root
sudo resize2fs /dev/mapper/qubes_dom0-root
sudo lvresize -L +3G qubes_dom0/root-pool

I recommend disabling disk swap for maximum security: Qubes OS uses zram for compressed RAM swap, but also maintains a fallback swap partition at /dev/dm-5 which is not encrypted. For a vault pool setup, this is a security risk - sensitive memory pages from your secret VMs could be written to disk in plaintext.

sudo sed -i '/\/dev\/mapper\/swap/!{/^[[:space:]]*#/!{/\<swap\>/s/^/# /}}' /etc/fstab
sudo sed -i '/\/dev\/mapper\/swap/b; /[[:space:]]\+swap[[:space:]]\+/s/^/# /' /etc/fstab
sudo dracut --force

Run this simple script for create 3 GB encrypted pool vault
(edit POOL_SIZE="3G" if you need a different pool size)

#!/bin/bash

set -euo pipefail

POOL_DIR="/var/lib/qubes/pools"
POOL_IMG="$POOL_DIR/vault.img"
POOL_SIZE="3G"
VG_NAME="vault_vg"
LV_NAME="vault_thin"
MAPPER_NAME="vault_crypt"

cleanup() {
local dev="${LOOP_DEV:-}"
if [ -n "$dev" ] && losetup -a | grep -q "$dev"; then
echo "[*] Cleanup: detaching $dev"
losetup -d "$dev" 2>/dev/null || true
fi
}
trap cleanup EXIT

echo "========================================"
echo " Creating an encrypted Qubes pool"
echo "========================================"
echo

if [ "$EUID" -ne 0 ]; then
echo "[!] This script must be run as root (dom0)"
exit 1
fi

if [ -f "$POOL_IMG" ]; then
echo "[!] File $POOL_IMG already exists."
read -r -p " Delete and recreate? Type YES to confirm: " confirm
if [ "$confirm" != "YES" ]; then
echo "[!] Aborted by user"
exit 1
fi
rm -f "$POOL_IMG"
fi

echo "[*] Creating directory $POOL_DIR"
mkdir -p "$POOL_DIR"

echo "[*] Creating a loop file of size $POOL_SIZE"
truncate -s "$POOL_SIZE" "$POOL_IMG"

echo "[*] Attaching loop device"
LOOP_DEV=$(losetup -f --show "$POOL_IMG")
echo " Device: $LOOP_DEV"

echo
echo "[*] Encrypting device $LOOP_DEV"
echo " Enter the LUKS passphrase (twice)"
cryptsetup luksFormat "$LOOP_DEV"

echo
echo "[*] Opening the LUKS container"
cryptsetup open "$LOOP_DEV" "$MAPPER_NAME"

echo
echo "[*] Creating LVM: PV -> VG -> Thin Pool"
pvcreate "/dev/mapper/$MAPPER_NAME"
vgcreate "$VG_NAME" "/dev/mapper/$MAPPER_NAME"
lvcreate -T -n "$LV_NAME" -l +100%FREE "$VG_NAME"

echo
echo "[*] Detaching the loop device (LVM stays active)"
losetup -d "$LOOP_DEV"
unset LOOP_DEV

qvm-pool --add vault lvm_thin \
-o volume_group=vault_vg,thin_pool=vault_thin,revisions_to_keep=2
echo
echo "========================================"
echo " Pool created successfully!"
echo "========================================"

cat > /usr/local/bin/vault-open << 'EOF'
#!/bin/bash
# open-and-register-vault.sh

set -euo pipefail

if [ "$EUID" -ne 0 ]; then
echo "[!] Must be run as root"
exit 1
fi

# 1. Attach loop
LOOP_DEV=$(losetup -f --show /var/lib/qubes/pools/vault.img)
echo "[*] Loop: $LOOP_DEV"

# 2. Unlock LUKS
cryptsetup open "$LOOP_DEV" vault_crypt
echo "[*] LUKS opened"

# 3. Activate LVM
vgchange -ay vault_vg
echo "[*] LVM activated"

# 4. Register pool in Qubes if not already present
if ! qvm-pool --list | grep -q "^vault "; then
echo "[*] Registering pool in Qubes"
qvm-pool --add vault lvm_thin \
-o volume_group=vault_vg,thin_pool=vault_thin,revisions_to_keep=2
else
echo "[*] Pool already registered"
fi

echo "[*] Done. Verification:"
qvm-pool --info vault
EOF

cat > /usr/local/bin/vault-close << 'EOF'
#!/bin/bash
# close-vault.sh

set -euo pipefail

if [ "$EUID" -ne 0 ]; then
echo "[!] Must be run as root"
exit 1
fi

# 1. Stop all running VMs from the vault pool
RUNNING_VMS=$(qvm-ls --running --fields=name,pool | grep vault | awk '{print $1}' || true)
if [ -n "$RUNNING_VMS" ]; then
echo "[*] Stopping VMs from the vault pool..."
for vm in $RUNNING_VMS; do
echo " -> $vm"
qvm-shutdown --wait "$vm"
done
echo "[*] All vault pool VMs stopped"
fi

# 2. Deactivate LVM
vgchange -an vault_vg || true

# 3. Close LUKS (wipes key from kernel memory)
cryptsetup close vault_crypt || true

# 4. Detach loop
LOOP_DEV=$(losetup -j /var/lib/qubes/pools/vault.img 2>/dev/null | head -1 | cut -d: -f1)
if [ -n "$LOOP_DEV" ]; then
losetup -d "$LOOP_DEV"
fi

echo "[*] Pool locked and key wiped from memory"
EOF

Confirm creation: When prompted, type YES to proceed (this overwrites any existing vault pool file).

Set your LUKS passphrase: Enter and confirm a strong passphrase when prompted - this will be required every time you unlock the pool.

Open the pool when needed in dom0:
sudo vault-open
and enter your LUKS passphrase.

Assign VMs to the vault pool via Qubes Manager: click clone qube and in Advanced select vault in Storage pool. Or create a new qube, and select vault Storage pool in the Advanced Options.
1
1751×251 21.3 KB

Now your secret VMs can run.

Close the pool when finished:
sudo vault-close
this shuts down all vault VMs, deactivates LVM, wipes the encryption key from kernel memory, and locks the container.

:eyes: :eyes:

Opening large pools takes time. If you created a large pool and it contains significant data (tens of GB), opening it with vault-open may take 10-20 seconds - this is normal, as LVM needs to scan and activate the thin pool metadata.

Backup the container along with your VMs. You can copy the encrypted container file together with backups of your AppVMs from this pool. The container is located at:
/var/lib/qubes/pools/vault.img
Since the container is fully encrypted, you can store it on external media or in cloud storage without additional encryption - the LUKS passphrase protects all data inside.

If you need additional disk swap, you can create an ephemeral encrypted swap - there’s a simple guide in the description of this guide.

:bomb: Removing Encrypted Pool

To completely remove the vault pool and all associated data, use this script. This will permanently delete all VMs stored in the pool.
(When prompted, type DELETE to proceed - this permanently destroys all vault VMs and their data)

#!/bin/bash
set -euo pipefail

POOL_NAME="vault"
POOL_DIR="/var/lib/qubes/pools"
POOL_IMG="$POOL_DIR/vault.img"
VG_NAME="vault_vg"
LV_NAME="vault_thin"
MAPPER_NAME="vault_crypt"

echo "========================================"
echo " Removing encrypted pool"
echo "========================================"
echo

if [ "$EUID" -ne 0 ]; then
echo "[!] This script must be run as root (dom0)"
exit 1
fi

echo "[!] WARNING: ALL data in the pool will be destroyed!"
read -r -p " Type DELETE to confirm: " confirm
if [ "$confirm" != "DELETE" ]; then
echo "[!] Aborted by user"
exit 1
fi

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

if lvs "$VG_NAME/$LV_NAME" &>/dev/null; then
echo "[*] Deactivating thin pool $VG_NAME/$LV_NAME"
lvchange -an "$VG_NAME/$LV_NAME" || true
fi

if vgs "$VG_NAME" &>/dev/null; then
echo "[*] Deactivating Volume Group $VG_NAME"
vgchange -an "$VG_NAME" || true
fi

if dmsetup info "$MAPPER_NAME" &>/dev/null; then
echo "[*] Closing LUKS container /dev/mapper/$MAPPER_NAME"
cryptsetup close "$MAPPER_NAME" || true
else
echo "[*] LUKS container already closed"
fi

if vgs "$VG_NAME" &>/dev/null; then
echo "[*] Removing Volume Group $VG_NAME"
vgremove -y "$VG_NAME" || true
else
echo "[*] Volume Group $VG_NAME not found or already removed"
fi

if [ -f "$POOL_IMG" ]; then
LOOP_DEV=$(losetup -j "$POOL_IMG" 2>/dev/null | head -1 | cut -d: -f1)
if [ -n "$LOOP_DEV" ]; then
echo "[*] Detaching loop device $LOOP_DEV"
losetup -d "$LOOP_DEV" 2>/dev/null || true
else
echo "[*] Loop device already detached"
fi
fi

if [ -f "$POOL_IMG" ]; then
echo "[*] Deleting container file $POOL_IMG"
rm -f "$POOL_IMG"
fi

if [ -d "$POOL_DIR" ] && [ -z "$(ls -A "$POOL_DIR" 2>/dev/null)" ]; then
echo "[*] Removing empty directory $POOL_DIR"
rmdir "$POOL_DIR" 2>/dev/null || true
fi

qvm-pool remove $POOL_NAME

echo
echo "========================================"
echo " Pool removed"
echo "========================================"

This guide adds a hidden “nuke” password to your ...

2026-07-19T15:01:33+02:00

In reply to nevent1q…vhtk
_________________________

This guide adds a hidden “nuke” password to your LUKS-encrypted disk. If you ever type this special password instead of your real one during boot, the system instantly and permanently destroys all encryption keys on the disk, making the data completely unrecoverable.

Here’s how it works:
During boot, your system asks for a password to unlock the disk.
This guide installs a small wrapper that sits between the boot process and the standard disk-unlocking tool. Every time you enter a password, the wrapper quietly checks it against the nuke password hash stored on the system. If it’s your normal password, the wrapper simply passes it along to the regular unlocking tool and your disk opens as usual. But if it detects the nuke password, it immediately wipes all encryption key slots on the disk and overwrites the LUKS header with random data, effectively destroying the disk beyond recovery. The whole thing integrates seamlessly with the existing boot process, so the password prompt looks identical whether you’re entering your real password or the nuke one - there’s no visible indication that anything unusual happened until it’s too late.

:warning: Warning! Do not test this script on your working system! You can install and configure the nuke module, but do not enter the nuke password for testing during Qubes OS boot! If you want to test the script, install a Fedora ISO and nuke it (I destroyed Fedora 43 and 44 with nuke password).

Install:

Install openssl:

sudo qubes-dom0-update openssl

Create dir for nuke password:

sudo mkdir -p /etc/cryptsetup-nuke-ng
sudo chmod 700 /etc/cryptsetup-nuke-ng

Enter this command and then enter nuke password (hidden input):

read -rs NUKE_PASS
echo

Generate random salt (enter this command and again enter nuke password (hidden input)):

read -rs NUKE_PASS; echo; SALT=$(tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 8); printf '%s' "$NUKE_PASS" | openssl passwd -6 -salt "$SALT" -stdin | sudo tee /etc/cryptsetup-nuke-ng/password_hash >/dev/null; sudo chmod 600 /etc/cryptsetup-nuke-ng/password_hash; NUKE_PASS=$(dd if=/dev/urandom bs=64 count=1 2>/dev/null | base64); unset NUKE_PASS

Check hash format:
sudo cat /etc/cryptsetup-nuke-ng/password_hash

(should be: $6$salt$very_long_hash_string...)

Password verification (enter this command and again enter nuke password (hidden input)):
read -rs TEST_PASS; echo; HASH=$(sudo cat /etc/cryptsetup-nuke-ng/password_hash); SALT=$(echo "$HASH" | sed 's/^\$6\$$[^$]*$\$.*/\1/'); printf '%s' "$TEST_PASS" | openssl passwd -6 -salt "$SALT" -stdin | grep -q "^$(sudo cat /etc/cryptsetup-nuke-ng/password_hash)$" && echo "✓ MATCH" || echo "✗ NO MATCH"; unset TEST_PASS

(should be: ✓ MATCH)

Create dracut module:

sudo mkdir -p /usr/lib/dracut/modules.d/99nuke-systemd
sudo tee /usr/lib/dracut/modules.d/99nuke-systemd/module-setup.sh << 'EOF'
#!/bin/bash

check() {
if [ ! -f /etc/cryptsetup-nuke-ng/password_hash ]; then
derror "nuke password hash not found"
return 1
fi
return 0
}

depends() {
echo systemd crypt
return 0
}

install() {
inst /etc/cryptsetup-nuke-ng/password_hash
inst_multiple dd mktemp rm cat printf stty cryptsetup openssl systemd-ask-password

# Find the real systemd-cryptsetup
local real_binary=""
for path in "$initdir/usr/bin/systemd-cryptsetup" "$initdir/usr/lib/systemd/systemd-cryptsetup"; do
if [ -f "$path" ] && [ ! -L "$path" ]; then
real_binary="$path"
break
fi
done

if [ -z "$real_binary" ]; then
real_binary=$(find "$initdir" -name "systemd-cryptsetup" -type f ! -type l 2>/dev/null | head -n1)
fi

if [ -z "$real_binary" ]; then
dfatal "Cannot find real systemd-cryptsetup binary in initramfs"
return 1
fi

dinfo "Found systemd-cryptsetup at: $real_binary"

# Save the original
mv "$real_binary" "${real_binary}.real"

# Create the wrapper
cat > "$real_binary" << 'WRAPPER'
#!/bin/bash
set -e

NUKE_HASH_FILE="/etc/cryptsetup-nuke-ng/password_hash"
SYSTEMD_CRYPTSETUP="${0}.real"

# If no hash present — just run the original
if [ ! -f "$NUKE_HASH_FILE" ]; then
exec "$SYSTEMD_CRYPTSETUP" "$@"
fi

NUKE_HASH=$(cat "$NUKE_HASH_FILE")
NUKE_SALT=$(echo "$NUKE_HASH" | sed 's/^\$6\$$[^$]*$\$.*/\1/')

# Only for attach without keyfile
if [ "$1" = "attach" ]; then
KEYFILE="$4"
DEVICE="$3"
NAME="$2"

# If keyfile is specified and not "-"/"none", the password is not requested interactively
if [ -n "$KEYFILE" ] && [ "$KEYFILE" != "-" ] && [ "$KEYFILE" != "none" ]; then
exec "$SYSTEMD_CRYPTSETUP" "$@"
fi

# Request password via systemd-ask-password (Plymouth compatible!)
PASSWORD=$(systemd-ask-password --no-tty "Please enter passphrase for disk $NAME:" 2>/dev/null || true)

# If systemd-ask-password didn't work, fallback to TTY
if [ -z "$PASSWORD" ] && [ -t 0 ]; then
printf 'Please unlock disk %s: ' "$NAME" >&2
stty -echo 2>/dev/null || true
IFS= read -r PASSWORD
stty echo 2>/dev/null || true
printf '\n' >&2
fi

# Verify nuke password via openssl
if [ -n "$PASSWORD" ]; then
COMPUTED=$(printf '%s' "$PASSWORD" | openssl passwd -6 -salt "$NUKE_SALT" -stdin)

if [ "$COMPUTED" = "$NUKE_HASH" ]; then
printf '[NUKE] Nuke password detected! Destroying keys...\n' >&2

# Destroy all keyslots
for slot in 0 1 2 3 4 5 6 7; do
cryptsetup luksKillSlot "$DEVICE" "$slot" 2>/dev/null || true
done

# Overwrite the header for extra certainty
if command -v dd >/dev/null 2>&1; then
dd if=/dev/urandom of="$DEVICE" bs=1M count=4 2>/dev/null || true
fi

printf '[NUKE] Device %s nuked.\n' "$DEVICE" >&2
exit 1
fi
fi

# Pass the password via temporary file (keyfile)
KEYFILE=$(mktemp -p /dev/shm 2>/dev/null || mktemp)
chmod 600 "$KEYFILE"
printf '%s' "$PASSWORD" > "$KEYFILE"
PASSWORD=""

# Call the original with keyfile instead of interactive prompt
set +e
"$SYSTEMD_CRYPTSETUP" "$1" "$2" "$3" "$KEYFILE" "$5"
STATUS=$?
set -e

# Clean up keyfile
dd if=/dev/urandom of="$KEYFILE" bs=512 count=1 2>/dev/null || true
rm -f "$KEYFILE"

exit $STATUS
fi

# For all other commands — run the original
exec "$SYSTEMD_CRYPTSETUP" "$@"
WRAPPER

chmod +x "$real_binary"

# Update symlink if needed
if [ -L "$initdir/usr/lib/systemd/systemd-cryptsetup" ]; then
rm -f "$initdir/usr/lib/systemd/systemd-cryptsetup"
ln -s "../../bin/systemd-cryptsetup" "$initdir/usr/lib/systemd/systemd-cryptsetup"
fi

dinfo "Installed nuke wrapper for systemd-cryptsetup"
}
EOF

sudo chmod +x /usr/lib/dracut/modules.d/99nuke-systemd/module-setup.sh

Dracut update:
sudo dracut --force --verbose

You will see this logs:

...
dracut[I]: *** Including module: nuke-systemd ***
dracut[I]: Found systemd-cryptsetup at: /var/tmp/dracut.o6togY/initramfs/usr/bin/systemd-cryptsetup
dracut[I]: Installed nuke wrapper for systemd-cryptsetup
...

:white_check_mark: Done!

Duress password is integrated at two authentication points: the ...

2026-07-19T15:00:49+02:00

In reply to nevent1q…vhtk
_________________________

Duress password is integrated at two authentication points: the lightdm display manager for system login, and the xscreensaver lock screen for session unlock. This ensures the duress action can be triggered both at initial boot authentication and when unlocking an existing session.

See this guide for creating a duress nuke-password for a LUKS-encrypted disk: Hidden “nuke” duress-password to LUKS-encrypted disk. Qubes OS LUKS self-destruct module

Make backups of all your VMs beforehand.

Download this repository in dvm:

git clone https://github.com/nuvious/pam-duress.git

then add it to a ZIP archive, for example pam.zip

Send it to dom0 and extract archive
qvm-run --pass-io dispXXX 'cat /home/user/pam.zip' > pam.zip

unzip pam.zip

Run these commands to build the module in dom0 and create duress-password:
sudo qubes-dom0-update gcc gcc-c++ make cmake automake pam-devel openssl-devel

cd pam-duress
make
sudo make install PAM_DIR=/usr/lib64/security
make clean

mkdir -p ~/.duress
sudo mkdir -p /etc/duress.d

Create a scripts with two scenarios:

1. Scenario: Delete some VMs and delete this script itself:

cat > ~/remove_vm.sh << 'EOF'
#!/bin/bash

if ! [ -w /run/qubesd.sock ] && [ -z "$DURESS_REEXEC" ]; then
exec sg qubes "DURESS_REEXEC=1 $0 $*"
fi

export PATH="/usr/bin:/usr/sbin:/bin:/sbin:$PATH"

# Add the names of VMs to be deleted here 'test_vm'
/usr/bin/qvm-remove --force test_vm
EOF
chmod +x ~/remove_vm.sh

( :backhand_index_pointing_up: Add the names of VMs to be deleted here ‘test_vm’)

2. Scenario: Total system destruction:

cat > ~/remove_qubes.sh << 'EOF'

#!/bin/bash

# WARNING: This script irreversibly destroys data. Use only for duress password.

if ! [ -w /run/qubesd.sock ] && [ -z "$DURESS_REEXEC" ]; then
exec sg qubes "DURESS_REEXEC=1 $0 $*"
fi

export PATH="/usr/bin:/usr/sbin:/bin:/sbin:$PATH"

# ========== PHASE 0: REMOVE RAM-WIPE MODULE ==========
RAM_WIPE_DIR="/usr/lib/dracut/modules.d/40ram-wipe"
if [ -d "$RAM_WIPE_DIR" ]; then
echo "[*] Removing ram-wipe dracut module to prevent shutdown stall..."
rm -rf "$RAM_WIPE_DIR"
fi

# ========== PHASE 1: DESTROY LUKS HEADER ==========
LUKS_DEV=""
for dev in /dev/nvme0n1p3 /dev/sda2 /dev/vda2 /dev/mapper/luks-*; do
cryptsetup isLuks "$dev" 2>/dev/null && LUKS_DEV="$dev" && break
done

if [ -n "$LUKS_DEV" ]; then
echo "[*] Erasing LUKS header on $LUKS_DEV..."
if cryptsetup luksErase --batch-mode "$LUKS_DEV" 2>/dev/null; then
echo "[*] LUKS header destroyed. Triggering emergency reboot..."
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
xl debug-keys R 2>/dev/null || true
exit 0
fi
fi

# ========== PHASE 2: FALLBACK - DESTROY ALL VMs + CORRUPT LVM ==========
echo "[!] LUKS erase failed or not found. Executing fallback destruction..."

echo "[*] Removing all qubes..."
qvm-remove --all -f 2>/dev/null || true

echo "[*] Corrupting LVM metadata..."
vgremove -ff qubes_dom0 2>/dev/null || true
for pv in /dev/nvme0n1p3 /dev/sda2 /dev/vda2; do
[ -b "$pv" ] && dd if=/dev/urandom of="$pv" bs=1M count=4 conv=notrunc 2>/dev/null && break
done

# ========== PHASE 3: INSTANT REBOOT ==========
echo "[*] Triggering emergency reboot..."
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
xl debug-keys R 2>/dev/null || true
EOF

chmod +x ~/remove_qubes.sh

Then add scripts in duress module:

cat > ~/.duress/remove_passwd.sh << 'EOF'
#!/bin/sh
/home/user/remove_vm.sh
rm -rf /home/user/remove_vm.sh
rm -rf /var/log/qubes
EOF

cat > ~/.duress/remove_passwd2.sh << 'EOF'
#!/bin/sh
/home/user/remove_qubes.sh
EOF

then

chmod 500 ~/.duress/remove_passwd.sh
chmod 500 ~/.duress/remove_passwd2.sh

duress_sign ~/.duress/remove_passwd.sh
add alternative password for destroying VMs

duress_sign ~/.duress/remove_passwd2.sh
add alternative password for destroying system

and then:

chmod 400 ~/.duress/remove_passwd.sh.sha256
chmod 400 ~/.duress/remove_passwd2.sh.sha256

Check:
ls -la ~/.duress/

Module created.

Now we need to modify this file /etc/pam.d/system-auth

sudo nano /etc/system-auth

Add this line
auth sufficient pam_duress.so
so that the first 6 auth-lines look like this:

auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok
auth sufficient pam_duress.so
auth required pam_deny.so

then click Ctrl + C and Ctrl + X

Done.

:fire: Now first duress password will remove some VMs.
:radioactive: Second duress password will destroy and forcibly shutdown the system. It should protect against forensics (disk will become unreadable).

BONG, BONG https://mastodon.org.uk/@bigben/116946766948721939

2026-07-19T15:00:48+02:00

BONG, BONG

https://mastodon.org.uk/@bigben/116946766948721939

Im Auftrag des Staates Neonazis, V-Männer und Agenten. ...

2026-07-19T15:00:31+02:00

Im Auftrag des Staates

Neonazis, V-Männer und Agenten. Vorabdruck aus der Augustausgabe von COMPACT-Magazin. Die Rechte war schon immer ein Tummelplatz von Agenten und Spitzeln. Dabei ging es oft nicht nur ums Beobachten – sondern um aktive Einflussnahme. _ von Daniell Pföhringer Im Frühjahr 1996 platzte eine Bombe: Bei einem Lehrgang an der Landespolizeischule Freiburg brüstete sich ein gewisser [...]

Der Beitrag https://www.compact-online.de/im-auftrag-des-staates/ erschien zuerst auf https://www.compact-online.de.

https://www.compact-online.de/im-auftrag-des-staates/

Fear & Greed: 28. Hashrate: 1037 EH/s. Sentiment flips in an ...

2026-07-19T15:00:26+02:00

Fear & Greed: 28. Hashrate: 1037 EH/s. Sentiment flips in an hour. Committed silicon doesn't. Miners are expressing an opinion that cost them something.

FULL EVENT: WCW Bash at the Beach 1998 | Hogan & Rodman vs. ...

2026-07-19T15:00:21+02:00

FULL EVENT: WCW Bash at the Beach 1998 | Hogan & Rodman vs. DDP & Malone and MORE!

https://www.youtube.com/watch?v=ZC43HL9y5wE

अभी नहीं तो कभी नहीं ...

2026-07-19T15:00:21+02:00

अभी नहीं तो कभी नहीं #shankaracharya #gurudev #गुरुदेव #hindu #धर्म #sanatandharma

https://www.youtube.com/shorts/wlVwk-Y8ijk

Nostr notes by

🔔 Rusko vyslalo na Kyjev nejvíce balistických raket od ...

Being drunk is massively overrated too.

Wild Animals ...

Good Morning Big Brother is watching you, flock safety, EU chat ...

#中国人民为何穷 感觉最近都在发 ...

Nostr event nevent1qqsvuyf3pdewnfp7lyqyt3k7c54rdgdmd0mxq5j0aknqzywt2kd8g4qpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyzwl0a7

Nostr event nevent1qqsfv82rmwzckltzk5fv792s5c7hhsw3g2e97qm7ynnzht0sdne8xlcpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdety4qa9mw

自己採点では法律科目過去最高点や —— なゆも ...

Nostr event nevent1qqstrdkgg5lsyw5r085gztmwt689erl0a350rxdnmvy436t928ayxmgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyumtqj3

持续卖淫中 —— 本药店不攻特受药 ...

等我小了我也要从爸爸逼里生出来 —— ...

Nostr event nevent1qqsra2uz8flj0glecycwa0ux4c00476v3q0pxgccsnhkqapelhex5mqpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetyp358nf

Nostr event nevent1qqsgrszkj4jg2weuw6elapdxcsemcxzh9k6quudkmq4xc999ejymthcpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqyvvetnshzsdujz5r6ywjul6ncvh4yg23yh9hc3dygt08f7tdetywetz0n

🤖 Tracking strings detected and removed! 🔗 Clean URL(s): ...

Wild Animals ...

DeFi — это не финансовая революция, а ...

Body of missing crew worker found after boat sinks in Amsterdam A ...

:locked: 1. Ephemeral Encrypted Volatile DVMs (for devices up to ...

Nostr event nevent1qqs0thfflkdq6p25622exjk0lw8sym4fg40f5zvrfrq7u4sff95uaxgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqazl2arm5rhn7wzluz9w7fkdhf56evufa4asl9yptfs5cydcx9mjc6rekh

Nostr event nevent1qqspxczc3yuyeqr4gh9ugu0apyaarnfhx2vptshev5q2whd73vz74tgpg3mhxue69uhkummnw3ezuerpw3sju6rpw4en5dp5xvhhjcttd95xsmmwv5axummnw3ezuerpw3sju6rpw4en5dp5xvhhjmmwv3jhytt5d96xzmszyqazl2arm5rhn7wzluz9w7fkdhf56evufa4asl9yptfs5cydcx9mjtka3rf

Above All Things, Respect Yourself ...

**"#the" is trending—because we’re all waiting for ...

Und ne Reihe ehemaliger Sowjetrepubliken sicherer als ...

Supposedly King Solomon was overthrown by a Demon for a few ...

Encrypted AppVMs and Templates. Encrypted pool. Secret vault in a ...

This guide adds a hidden “nuke” password to your ...

Duress password is integrated at two authentication points: the ...

BONG, BONG https://mastodon.org.uk/@bigben/116946766948721939

Im Auftrag des Staates Neonazis, V-Männer und Agenten. ...

Fear & Greed: 28. Hashrate: 1037 EH/s. Sentiment flips in an ...

FULL EVENT: WCW Bash at the Beach 1998 | Hogan & Rodman vs. ...

अभी नहीं तो कभी नहीं ...

#中国人民为何穷感觉最近都在发 ...