Seneschal

NethServer 7, rebuilt on Rocky Linux 10. Same Server Manager, new machinery underneath.

• Python
• Rocky Linux 10
• Cockpit
• nftables
• RPM/dnf

Why it exists

NethServer 7 was the best small-server distro of its generation. One box handled the domain, mail, files, web, and firewall, and one web UI managed all of it without hiding what it was doing. Then CentOS 7 reached end of life and took NS7 with it. NS8 went its own direction and is a different product than the one we were running, so we faced the usual choice: migrate away and give up the workflow, or rebuild the foundation and keep it. We rebuilt it.

What it is

The web UI is the actual NethServer 7 Server Manager, GPLv3 and rebranded, talking to our reimplementation of the API contract it expects. Everything under that contract is new. The old e-smith layer is gone; a Python control plane owns configuration state, templates, and events, with a sen CLI for driving it from a shell. Services run as native Rocky Linux packages wherever the distro can provide them, and podman covers the one role it can't, the Samba Active Directory domain controller. The firewall is nftables carrying NS7's zone model forward, and SELinux stays enforcing. The target is full capability parity with NS7, feature by feature. If you ran NethServer 7, nothing about running this will surprise you.

 [browser] ──▶ [Cockpit + NS7 Server Manager UI (vendored, GPLv3)]
                        │  the same API contract NS7 spoke
                        ▼
                [Python control plane]
        state store · template engine · events · sen CLI
                        │
        ┌───────────────┼───────────────────┐
        ▼               ▼                   ▼
  native EL10       nftables zones      podman
  services          SELinux enforcing   (Samba AD DC)

Where it stands

Built so far: the control plane, backup and certificates, Samba AD with DNS, the reverse proxy and web edge, the file server, Threat Shield, and the mail stack (Postfix, Dovecot, Rspamd, SOGo). Since late August it also installs like a product instead of a science project: a signed dnf repo, an unattended installer ISO, and a firstboot service that brings the box up configured.

On 2026-10-21 we installed a box unattended from the ISO, joined it to our NethServer 7 domain as a second domain controller, moved every FSMO role to it, then demoted the NS7 box and switched it off the same night. Seneschal has been our domain controller, LAN resolver and public web edge since. We moved mail to a separate server on purpose, so the mail role is built but hasn't carried our mail yet. Still on the list: verifying the file server and Threat Shield on a live box, a renewal timer for certificates (today that's a manual command), and the long tail of NS7 parity, feature by feature.

Get it

The package repo is public and GPG-signed, with install instructions in its README: git.eurekaendeavors.com/seneschal/seneschal-repo. It's version 0.0.5 and runs our domain, but it's still 0.0.x: point it at a test VM, not at anything you love. Seneschal is GPLv3. NethServer is a Nethesis trademark, and Seneschal is an independent rebuild, not affiliated with or endorsed by Nethesis.