NixOS at Hebeko

A declarative Linux distribution

NixOS is a free Linux distribution. On Debian or Ubuntu, administrators install packages and edit files machine by machine, and the real state of a server ends up drifting from its documentation. On NixOS, they describe the desired state in text files (software, services, accounts, network) and NixOS builds the system from that description.

Every build creates a new generation of the system. Previous ones remain available, and the boot menu lets you go back to one of them if an update causes a problem.

Software comes from nixpkgs, the Nix package repository. It is the largest across all distributions, with about 119,000 packages according to Repology.

Our article Understanding NixOS compares this approach with Debian, Ubuntu and RHEL. Nix flakes covers the most common way to organise a configuration.

Why NixOS for organisations

For a company or a public body, the configuration of every server lives in a Git repository. It is also the documentation, and another provider can take over the infrastructure from these files.

The example below describes a small web server.

{ config, pkgs, ... }:
{
  services.nginx.enable = true;
  services.nginx.virtualHosts."intranet.example.fr" = {
    enableACME = true;
    forceSSL = true;
    root = "/srv/intranet";
  };
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "admin@example.fr";

  users.users.camille = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
  };

  system.autoUpgrade.enable = true;
}

Common uses

NixOS is used on servers as well as desktops.

How a project runs

Moving to NixOS happens in stages, without stopping what already works.

1. Audit: inventory of servers, services and their dependencies, then choice of a first service to migrate.
2. Pilot: that service moves to NixOS, with its whole configuration in a Git repository. The old server stays in place until sign-off.
3. Extension: the other servers follow, with shared modules for accounts, monitoring, backups and hardening.
4. Handover: training and documentation for your teams, who then change the configuration themselves.

Sécurix and Bureautix

Sécurix is a NixOS distribution developed by DINUM for secure system administration, office and development desktops. Bureautix is its example variant for office desktops, with a machine inventory, an installer and settings designed for an IT department.

The project first targets unclassified information, then possibly the Diffusion Restreinte level. It follows ANSSI recommendations with a hardened kernel, Secure Boot and an encrypted disk unlocked with a FIDO2 key. Login also uses a security key, and the password is only a fallback. Thanks to NixOS, the same model adapts to each need, for example a desktop shared by several staff members or one restricted to the intranet.

The next steps announced by DINUM cover further hardening, sending logs to a central log collector, automatic enrolment of new desktops and Secure Boot key rotation.

Our engineers contribute actively to the project. We want to keep contributing upstream, especially on network installation and fleet management, and to support public bodies adopting Sécurix, from the first pilot to deployment.

Sécurix is released under the MIT licence. It is still in alpha, and its developers do not offer support yet. We can run a pilot with you.

NixWall

NixWall is a firewall developed by our teams on NixOS. It is entirely free software, under the AGPL-3.0 licence, and its code is public on GitHub.

The goal is a reproducible firewall. Its whole configuration lives in files, and two machines built from the same files are identical. NixOS keeps every previous state of the system, so a change that cuts the network is undone by rolling back to the previous generation.

NixWall also benefits from nixpkgs, the repository described above. The software it relies on is updated there continuously.

The project is in alpha and not yet ready for production. NixWall will eventually be managed from a web interface, which will go through its API to change the configuration.