NixOS training (3 days)

The programme follows current NixOS practice, with a flake-based configuration, secrets encrypted with sops-nix, automated installation with nixos-anywhere and disko, and deployment with deploy-rs or colmena.

Objectives

By the end of the course, each participant can:

• install NixOS, change its configuration and roll back to a previous generation
• organise the configuration of several machines in a flake, with modules and encrypted secrets
• install a machine end to end with nixos-anywhere, disko and a custom ISO
• deploy and update a fleet in push or pull mode, and fix common errors

Who this course is for

A local authority or public body

NixOS is the base the French government's digital agency (DINUM) chose for Sécurix, a desktop hardened along ANSSI recommendations, and for Bureautix, which derives an office desktop from it. The course gives the IT team the basics to follow these projects and to run its own NixOS servers, with a configuration that is known, reviewed and reproducible.

A company or DevOps team

The infrastructure is described in a Git repository, reviewed like code, and every machine rebuilds identically. The course goes as far as deploying a server fleet and updating it from GitLab.

A team already using NixOS

The programme can start from your own configuration, to reorganise it as a flake, manage secrets or automate deployments.

Custom training

The three-day programme below is the starting point. It can be shortened to a one-day introduction for a team evaluating NixOS, or refocused on what your team needs.

Organisation

The details to record in your training plan.

Sécurix and Bureautix

Hebeko follows Sécurix and Bureautix and contributes to their development. These projects are still experimental at DINUM and change quickly, so we do not offer a dedicated course. The NixOS course covers the concepts they rely on (flakes, modules, disko, secrets). They are enough to read their configuration and follow their changes.

Program

Day 1: Discover and install NixOS

Morning

• Nix and NixOS: declarative, reproducible, atomic upgrades
• Installation with the graphical ISO on a virtual machine
• The configuration: configuration.nix and hardware-configuration.nix

Afternoon

• Generations and rollback: switch, boot, test
• The store: paths, hashes, closures, profiles
• The Nix language: reading and writing configuration expressions
• Basic hardening: firewall, SSH, users, sudo

Day 2: From one machine to a fleet

Morning

• Moving the configuration to a flake: flake.nix, inputs, flake.lock
• Shared modules and per-host modules, multi-host layout
• Writing your own module with options, using an "admin account" module as the example

Afternoon

• Secrets with sops-nix: age keys, host keys, encrypted secrets in the repository
• Declarative WireGuard tunnel: the machine joins the VPN server at boot, with its private key managed by sops-nix
• Declarative partitioning with disko, LUKS encryption included
• Custom ISO built from the flake, with key-based SSH access

Day 3: Deploy and run the fleet

Morning

• End-to-end installation in a single step with nixos-anywhere
• Push deployment with deploy-rs and colmena, and how they differ
• Maintenance: nix.gc, nix.optimise, and configurationRevision to know which commit runs on each machine

Afternoon

• Pull updates from GitLab (system.autoUpgrade on the flake)
• Troubleshooting: evaluation errors, nix log, full store or /boot, back to a healthy generation
• Time permitting: Home Manager, backups, monitoring, custom systemd services

Frequently asked questions

Can the course be delivered remotely?

Yes. It takes place on your premises or remotely by video call.

What are the prerequisites?

Solid Linux command-line experience. No prior knowledge of Nix is required.

Can a session be run for our team only?

Yes. Each session is run for a single organisation, with exercises adapted to your context. The programme and price are set on quote.

Next steps

For Linux administration basics: Linux administrators training. To automate an existing infrastructure: DevOps, Ansible, Terraform and CI/CD training. For NixOS at Hebeko: NixOS.