netmode is personal infrastructure for a single laptop. Its threat model is mostly about not leaking the owner's own data, plus a few hard runtime guarantees.
- No Wi-Fi password is ever written to disk. Re-homing onto a network uses the macOS keychain and Wi-Fi power-cycle. There is no secrets file with a passphrase.
- No
sudo. netmode never escalates privileges. - No always-on daemon. All launchd agents are
WatchPathsorStartIntervalfire-and-exit. None useKeepAlive. - The dish poller is strictly read-only.
netmode dishreads stats over gRPC and can never enable a link, change preferred networks, or trigger a switch. Reaching the dish must never pull the laptop onto the Starlink. (Asserted:_st_dish_guard.) - Starlink stays LAST in the network service order.
These never enter git — .gitignore ignores everything by default and allow-lists only
source + docs:
| Data | File (git-ignored) |
|---|---|
| Real SSIDs, gateways, caps | config |
| Learned home Wi-Fi set | home_fingerprint |
| Usage meters / history | usage.tsv, history.tsv |
| Location / mode / health | location_state, mode, health* |
| Logs | events.log, *.log |
| Dish status cache | dish_status.json |
Commit config.example (placeholders) — never config.
The engine's default constants still contain personal network identifiers (the owner's real hotspot/Starlink SSID names and a neighbor-SSID denylist). That is fine in a private repo — it's the owner's own backup. It is not safe to publish.
- Run the sanitizer:
It replaces the SSID/Bluetooth defaults in
scripts/sanitize-for-public.sh # dry-run: shows what it would change scripts/sanitize-for-public.sh --writenetmode.shwith generic placeholders and strips personal entries from theUBIQUITOUS_SSIDSdenylist — without touching logic. Your live tool keeps working because the real values stay inconfig. - Verify nothing personal remains:
grep -nEi 'ssid|gateway|iphone|starlink' netmode.sh config.example git log -p | grep -iE '<your name>|<your ssid>' # also scrub history if it ever landed
- Confirm the meter still works and selftest is green:
bash netmode.sh selftest && bash netmode.sh doctor - Only then flip visibility:
gh repo edit 4444J99/netmode --visibility public --accept-visibility-change-consequences
If a real SSID/identifier ever lands in a commit, changing visibility is not enough — the value is in history. Rewrite history (
git filter-repo) or start a fresh repo.
Single-owner repo: open a private issue or note it in the relevant Discussion.