Hi, I'm Abdelmonem. I build self-hosted software for hardware that is supposed to look after itself — and, lately, drivers for hardware that refuses to be driven at all. Most of it is Python, TypeScript and C, and almost all of it ships in Arabic as well as English, because the people running this hardware do not all read English.
Install OPNsense on a Sophos XGS and it boots with no network interfaces at all: every front port belongs to a coprocessor behind PCIe, with drivers for Linux and the vendor's own OS only. os-xgs-npu is the FreeBSD drivers and the OPNsense plugin that hand those ports back, then give the coprocessor the firewall's own connections and IPsec, so they no longer cross the host. Two of the six coprocessor families answer now.
npuforge.org · the guide · ready-made images · releases · the story · in Arabic
| Measured | |
|---|---|
| 9,837 Mbit/s | a thousand connections through an XGS 3300, its processors 7.8 % busy |
| 941 Mbit/s | through an XGS 136 in hardware at 0.4 %, against 19.6 % through the host |
| 9,019 Mbit/s | sixteen IPsec tunnels at once between two XGS 3300s |
| 10 frames, not 610,533 | what a UDP flood cut in hardware still sent the host |
| 29 discoveries | in the vendor's own sources, every one measured within three days |
- Fast, and still a firewall. Block lists, JA4 fingerprints, IPsec policies, the Traffic Shaper and the Captive Portal still decide over a connection in hardware, and with Inspect, then hardware, Suricata sees each connection's start before the coprocessor carries the rest.
- Two roads onto an appliance. A ready-made image with every release, or one built to order in the browser, and a guide from nothing to the first sign-in. Updates come from its own page in OPNsense.
- Owners run it too. It is an alpha: the XGS 136 and the XGS 3300 run here, an XGS 126 runs for two owners, and every other model installs and checks its own ports, untested until someone reports back. Tell me how yours goes.
- It keeps its own score. Every figure has a page saying how it was measured, and the completion figures went down when the discoveries were found. Both appliances stand at 96 %.
The repository went public on 25 September 2026; the work behind it took close to two years. The whole story is on the site.
How each family is driven
Ten plugins, BSD-2 licensed and packaged as FreeBSD ports. Each works on its own. With os-xgs-npu installed, their pages join the XGS section of the menu, and the project's own update keeps them current and adds the ones that suit the appliance.
| Plugin | What it does |
|---|---|
| os-linkhealth | names the cable or transceiver that is going bad, before the link drops |
| os-netreport | scheduled network reports and new-device alerts by email, in the GUI's language |
| os-frontpanel | the appliance's LCD and buttons, through LCDproc |
| os-fanctl | fan control and every readable temperature sensor |
| os-theme-xgs | XGS Silicon: a light, a dark and an automatic theme, Arabic included |
| os-kernelfollow | rebuilds an out-of-tree driver for the new kernel before an update's reboot |
| os-watchdog | arms the host's hardware watchdog, and reads why it last reset |
| os-fallbackcrypto | chooses the kernel's crypto driver for the tunnels the host carries itself |
| os-blocklists | address, DNS, country and JA4 block lists on one page |
| os-portguard | Layer 2 rules: a device blocked by its MAC address |
Planned: traffic priority.
They follow OPNsense's own shape, so they are backed up, upgraded and translated like every other part of the system.
- opnsense-arabic — the Arabic translation of the OPNsense 26.7 web interface, the XGS plugins' strings included.
- opnsense-rtl — right-to-left layout for Arabic and Persian.
npuforge.org has an Arabic edition of its own, and every page the XGS work adds to OPNsense is photographed in both languages.
FilaMind is an open-source, self-hosted suite for makers running Klipper and Moonraker.
- filamind-core — the TypeScript foundation: a Moonraker client, a fail-closed write arbiter, 19 locales.
- filamind-flow — the control panel: firmware flashing, input shaping, TMC tooling.
- filamind-screen — the on-printer touch interface, with Tauri 2.
- filamind-3d — the web control UI.
- filamind-ai — private AI on a Synology NAS, in Arabic and English.
- filamind-setup — one installer, as a CLI and as a widget.
Most of my Odoo work is client projects in private repositories. The public part is the device side:
- filamind-iot — a self-hosted IoT gateway addon for Odoo 19.
- filamind-iotbox — an Odoo IoT Box image that takes a server URL directly.
- filamind-iot-proxy — pairing, certificates and a reverse tunnel, on your own machine.
cadenza curates music libraries on a Synology NAS: acoustic fingerprinting for real duplicates, metadata from several sources, format conversion. It never deletes anything; suspect files go to quarantine.
Python, C for the kernel side, TypeScript and Vue 3, PHP and Volt for OPNsense, Rust where Tauri needs it. Underneath: FreeBSD and its ports tree, Synology DSM 7, Docker, FastAPI and GitHub Actions. iOS and Android apps and the Odoo client work stay in private repositories.
Questions about the XGS drivers are best asked in the project's Discussions, where the answer stays for the next person. If the XGS work is useful to you, sponsoring it pays for the appliances, modules and test gear the next families need.
- Release 0.1.0-alpha.8.9 — os-xgs-npu, 26 Oct
- Problem reports: a panic that wrote no dump is read from the message buffer — os-xgs-npu, 26 Oct
- Release 0.1.0-alpha.8.8 — os-xgs-npu, 26 Oct
- octep: with IPsec associations on the coprocessor, its device is taken up again in place (#768) — os-xgs-npu, 26 Oct
- Release 0.1.0-alpha.8.7 — os-xgs-npu, 26 Oct
- #768: the coprocessor's console asked to reboot it - busybox's reboot, a host UART that lost its interrupt, the console left to the recovery — os-xgs-npu, 26 Oct