Infrastructure configured by hand is only known to the people who built it. When the technician leaves or the provider changes, the knowledge leaves with them, and you are locked in without having chosen it. With NixOS, the whole configuration is written in files that stay with you. Another provider can read them, an expert can audit them, and every server can be rebuilt identically.
Configuration done by hand gets lost
A technician who configures a server gives it orders, "install this, change that". The server carries them out, but keeps no list of them. The next provider inherits a machine whose real state is unknown. Changing provider becomes risky, negotiating a rate becomes hard, and forgotten settings become security holes.
With NixOS, the configuration is a document
Installed services, security rules, access rights and network settings are described in text files, kept in one place. These files belong to you. They change three things:
- Audit. An independent expert reads the files and checks every setting, without having to trust anyone.
- Rebuilding. A failed server is rebuilt in minutes with exactly the same configuration.
- Handover. A new provider picks up the work from the files, without starting from scratch.
The French State has made this choice
The French interministerial digital directorate (DINUM) chose NixOS as the base of Sécurix, the hardened system planned for civil servants' computers. Hebeko contributes to this project. The traceability, reproducibility and auditability the State requires apply to any organisation that wants to stay in control of its IT.
Hebeko migrates servers and computers to NixOS, then maintains them. Details are on our NixOS page, and the overall approach on digital sovereignty. To discuss it, contact us.