Blog on Bor

Bor at CfgMgmtCamp 2027 in Ghent

Mon, 02 Nov 2026 05:00:00 +0200

From 1 to 3 February 2027, Bor goes to CfgMgmtCamp in Ghent, Belgium, and I will give a talk there: Bor: Centralized Policy Management for Linux Desktops.

CfgMgmtCamp is the conference of the infrastructure automation community. It started around configuration management and has grown to cover provisioning, orchestration and everything else that keeps infrastructure in a known state. It takes place at HoGent’s Campus Schoonmeersen, a short walk from Gent-Sint-Pieters station, in the days right after FOSDEM, so a lot of people make the two a single trip.

Bor v0.10.0 released

Mon, 02 Nov 2026 02:30:00 +0200

Bor v0.10.0 is out, and it is the largest release so far. Five policy types arrive at once - Disk encryption, Services & timers, SELinux, AppArmor and Software updates - the KDE Plasma type is rebuilt on a catalogue of settings, signing in asks for the second factor before the password, and the documentation has its own site. It is also the first release under the AGPL, as announced in October, and the first one with a commercial edition, Bor Enterprise, next to it; that part is at the end of this post. The complete changelog is on the GitHub release page.

Bor moves to the AGPL: what changes, and what never will

Fri, 16 Oct 2026 00:00:00 +0300

Starting with the upcoming v0.10.0 release, Bor will be licensed under the GNU Affero General Public License, version 3 (AGPL-3.0) instead of the LGPL. At the same time, we’re introducing a Contributor License Agreement for contributions, and a commercial edition, Bor Enterprise, for organizations that need features like single sign-on.

License changes in open source projects often come with bad news, so let me start with the part that matters most:

Come meet Bor at OpenFest 2026

Thu, 15 Oct 2026 00:00:00 +0300

On 7 and 8 November, Bor goes to OpenFest in Sofia. We’ll have a stand for the whole weekend, and on Saturday I’ll be giving a talk about the project.

OpenFest has been the meeting point of the Bulgarian free software community for many years, and it’s where a lot of us first met the people we still work with today. Bringing Bor there feels a bit like bringing it home.

Managed full-disk encryption: the Disk encryption policy type coming in Bor v0.10.0

Thu, 24 Sep 2026 00:23:22 +0300

The upcoming Bor v0.10.0 release will add a Disk encryption policy type: managed LUKS2 full-disk encryption for the whole fleet. It verifies that the volumes that should be encrypted actually are, enrolls unattended unlocking through the TPM 2.0 chip and Tang network servers, and escrows a per-volume recovery key on the Bor server - the role Active Directory plays for BitLocker on Windows, now for Linux desktops.

This post walks through what will ship and the security design behind it.

Bor v0.9.0 released

Sat, 05 Sep 2026 16:42:00 +0300

Bor v0.9.0 is out. This release adds two new policy types - Session Access and Flatpak - and turns every Bor server into a distribution point for its own agent packages, with a copy-paste deploy wizard. Policies can now be exported and imported as YAML bundles, and creating a policy is a guided four-step wizard. The complete changelog is on the GitHub release page.

Thank you, Hacker News !

Shortly after v0.8.0 shipped, the release post went up on Hacker News as a Show HN and spent a while at the top of the front page. The thread brought a lot of good questions - push versus pull delivery, how locked settings survive a curious user, mTLS versus SSH, what happens when two policies touch the same key - and one feature request that became the headline feature of this release. jimmcslim asked whether Bor could enforce “screen time” on laptops given to children, hopefully more effectively than the built-in equivalents on iOS and Android.

Policies as YAML: the export/import format coming in Bor v0.9.0

Sat, 05 Sep 2026 00:00:00 +0300

Policy export and import will be published in the upcoming Bor v0.9.0 release. Any policy - or any set of policies, with their bindings - can be downloaded as a YAML bundle, kept in git, reviewed in a pull request, and imported into another Bor instance. The feature is already merged on master, and you can try it today on the demo instance.

This post is about the file format itself: what it looks like, why it is shaped the way it is, what was rejected along the way, and what happens at the import boundary.

Bor v0.8.0 released

Sun, 02 Aug 2026 00:00:00 +0300

Bor v0.8.0 is out. This release adds three new policy types — Thunderbird, Microsoft Edge for Business, and Firewalld zones — alongside a full web UI overhaul, finer-grained RBAC, and a dedicated security hardening pass. The complete changelog is on the GitHub release page.

Thunderbird policy type

Mozilla Thunderbird can now be managed on enrolled desktops with the same mechanism used for Firefox ESR. The agent writes the managed policies.json that Thunderbird expects, merged from all bound policies, and removing the last policy restores the original file. Flatpak installations are detected and enforced alongside RPM/DEB installations, and the managed file is protected by the tamper watcher — external edits are detected and immediately restored. The web UI ships a full policy editor with the complete Thunderbird policy catalogue.

Bor v0.7.0 released

Thu, 14 May 2026 00:00:00 +0300

Bor v0.7.0 is out. This release introduces Package Management Policy — a new policy type that lets administrators control software repositories and installed packages on enrolled Linux desktops, using the same publish-and-stream workflow as existing policies.

Package policy

A Package policy has three sections:

Repositories — add APT (deb822 .sources), DNF/YUM (.repo INI), or Zypper (.repo INI) repositories. The agent auto-detects the node’s package manager and writes the correct file format to the right location. GPG signing keys are supported for all repository types and are written to the appropriate keyring directory.

Bor v0.6.0 released

Mon, 11 May 2026 00:00:00 +0300

Bor v0.6.0 is out. The two headline features are automatic TLS certificate provisioning via ACME and self-service password management for users.

ACME / Let’s Encrypt support

The server can now automatically obtain and renew TLS certificates from Let’s Encrypt or any RFC 8555-compatible CA. This removes the need to manage certificates manually or run a separate reverse proxy just for TLS termination.

To enable it, set three environment variables before starting the server:

Bor Video Tutorials on YouTube

Sat, 18 Apr 2026 21:33:18 +0300

I’ve started a YouTube playlist with video tutorials covering how to install, configure, and use Bor. The series walks through the main workflows step by step — from setting up the server to enrolling nodes and publishing policies.

New videos will be added to the playlist as the project evolves. You can follow the full playlist on YouTube.

Announcing Bor: Open Source Linux Desktop Policy Management

Sat, 18 Apr 2026 00:00:00 +0000

This is the original announcement published on LinkedIn on April 14, 2026.

I’m happy to announce Bor! — an open source Linux desktop policy manager I’ve been quietly building for the past several months. Today it’s finally available for download 🎉

If you’ve ever managed a fleet of Linux desktops in an enterprise or government environment, you know the pain: no native equivalent of Group Policy, no central way to enforce browser settings, restrict system access, or prove to an auditor that your configuration is consistent across hundreds of machines.

Introducing Bor

Sun, 01 Jun 2025 00:00:00 +0000

Bor is an open-source policy management system for Linux desktops. It gives IT administrators a central web console to define configuration policies and push them to managed workstations in real time.

Why Bor?

Managing desktop configuration at scale on Linux has traditionally meant choosing between heavyweight enterprise suites and ad-hoc scripting. Bor fills the gap with a focused, purpose-built tool:

Web-based policy management — create, version, and organize policies from a browser. Assign them to groups of machines with a few clicks.
Real-time delivery — policy changes reach agents the moment they happen. No polling intervals, no waiting for a configuration run to complete.
Zero-touch enrollment — generate a one-time token, pass it to the agent on first run. The agent provisions its own certificates automatically.
Role-based access control — fine-grained permissions let you delegate policy authoring and node management to different teams.

How Bor differs from Foreman, Uyuni, and configuration management tools

Systems like Foreman and Uyuni are built around Infrastructure-as-Code engines — Ansible, Puppet, Salt, or Chef. These tools are powerful and flexible: you write code (playbooks, manifests, states) that can do virtually anything on a target machine. That flexibility comes with complexity. Someone has to write and maintain the code, review changes for safety, and reason about ordering, idempotency, and drift detection. For desktop fleets managed by IT teams rather than DevOps engineers, this is often more machinery than the problem requires.