GNOME desktop block plus opt-in GNOME hardening #21

New issue

Open

opened 2026-06-18 12:12:54 +00:00 by bram.buijs · 2 comments

bram.buijs commented

2026-06-18 12:12:54 +00:00

Collaborator

The image ships Plasma; some workplaces want GNOME. Propose two blocks following
the #8 interface:

desktop-gnome (GDM) as an alternative a host selects, gated on
dawo.desktop.gnome.enable so importing the block does not force GNOME on every
host.
hardening-gnome, opt-in (hardened tier, default off), shipping a locked dconf
profile: automatic screen lock, privacy (no recent-file history, clean trash and
temp), and lockdown (no user switching, no command line). Keys are locked so a
user cannot relax them. Only meaningful with desktop-gnome. Norm: NCSC
end-user device plus CIS GNOME.

Question: do you want GNOME as a first-class alternative desktop in the core, or
should desktops live in the per-organisation consumer repos and the core stay
desktop-agnostic? PR follows once the direction is clear.

The image ships Plasma; some workplaces want GNOME. Propose two blocks following the #8 interface: - `desktop-gnome` (GDM) as an alternative a host selects, gated on `dawo.desktop.gnome.enable` so importing the block does not force GNOME on every host. - `hardening-gnome`, opt-in (hardened tier, default off), shipping a locked dconf profile: automatic screen lock, privacy (no recent-file history, clean trash and temp), and lockdown (no user switching, no command line). Keys are locked so a user cannot relax them. Only meaningful with `desktop-gnome`. Norm: NCSC end-user device plus CIS GNOME. Question: do you want GNOME as a first-class alternative desktop in the core, or should desktops live in the per-organisation consumer repos and the core stay desktop-agnostic? PR follows once the direction is clear.

bram.buijs added the

Kind/Feature

Kind/Discussion

labels

2026-06-18 12:34:05 +00:00

rutger.putter commented

2026-06-18 13:07:28 +00:00

Collaborator

@bram.buijs wrote in #21 (comment):

Question: do you want GNOME as a first-class alternative desktop in the core, or should desktops live in the per-organisation consumer repos and the core stay desktop-agnostic? PR follows once the direction is clear.

I see GNOME and Plasma as equally mature projects and in the Open-Source spirit I'd like to offer the choice to organizations.

I would, however, like to suggest that we keep Plasma and GNOME mutually exclusive on a system as their .config files might influence each other and could wreak havoc on a user account when both are used.

I would also like to point out that the GNOME interface might feel more at home to Linux or Apple native users while Plasma in the current deployment feels more at home to Windows native users. This might add the the load in documentation in support when supporting both DE's.

@bram.buijs wrote in https://code.overheid.nl/MinBZK/DAWO-NixOS/issues/21#issue-307: > Question: do you want GNOME as a first-class alternative desktop in the core, or should desktops live in the per-organisation consumer repos and the core stay desktop-agnostic? PR follows once the direction is clear. I see GNOME and Plasma as equally mature projects and in the Open-Source spirit I'd like to offer the choice to organizations. I would, however, like to suggest that we keep Plasma and GNOME mutually exclusive on a system as their `.config` files might influence each other and could wreak havoc on a user account when both are used. I would also like to point out that the GNOME interface might feel more at home to Linux or Apple native users while Plasma in the current deployment feels more at home to Windows native users. This might add the the load in documentation in support when supporting both DE's.

bram.buijs commented

2026-06-18 20:24:22 +00:00

Author

Collaborator

@rutger.putter Is it okay to move KDE to a module (opt-out) and make gnome a seperate module (opt -in) with a warning not to install both at once. This would allow us to have them both co-exist in the repo without interfering with eachother

bram.buijs referenced this issue from a commit

2026-06-19 15:21:45 +00:00

feat(desktop): add dawo-t495s-gnome host target

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

MinBZK/DAWO-NixOS#21

No description provided.

Rows
Columns