Lean baseline: move the fixed app set out of the generic image #25

New issue

Open

opened 2026-06-18 12:36:54 +00:00 by bram.buijs · 0 comments

bram.buijs commented

2026-06-18 12:36:54 +00:00

Collaborator

Following the lean-by-default principle (wiki Home) and ADR-0001/0003, the generic
profile should ship only what every government device needs, not a workplace's app
set.

Today environment-dawo-pkgs is imported by profiles-dawo-generic and pins a
large, opinionated list onto every device: collabora-desktop, element-desktop,
teams-for-linux, thunderbird, gimp/inkscape/krita, penpot-desktop, vscodium,
microsoft-edge, vlc, and more. That is a per-workplace choice, not a generic
baseline, and it bloats the closure and attack surface of the core image.

Proposal: take the app list out of the forced baseline and expose it as opt-in
blocks on the dawo.<block> interface, so a workplace enables what it wants, e.g.

dawo.apps.office (mail, office, pdf)
dawo.apps.creative (gimp, inkscape, krita, ...)
dawo.apps.dev (vscodium, toolchain, ...)

The core keeps only the genuinely universal tools. Org- or vendor-specific apps
(for example microsoft-edge, teams-for-linux) move to the consuming org repo, not
the core.

Question: do you want these coarse app blocks to live in the core (so every org
can reuse them), or should app sets sit entirely in the per-organisation repos and
the core stay app-free apart from the bare essentials?

Following the lean-by-default principle (wiki Home) and ADR-0001/0003, the generic profile should ship only what every government device needs, not a workplace's app set. Today `environment-dawo-pkgs` is imported by `profiles-dawo-generic` and pins a large, opinionated list onto every device: collabora-desktop, element-desktop, teams-for-linux, thunderbird, gimp/inkscape/krita, penpot-desktop, vscodium, microsoft-edge, vlc, and more. That is a per-workplace choice, not a generic baseline, and it bloats the closure and attack surface of the core image. Proposal: take the app list out of the forced baseline and expose it as opt-in blocks on the `dawo.<block>` interface, so a workplace enables what it wants, e.g. - `dawo.apps.office` (mail, office, pdf) - `dawo.apps.creative` (gimp, inkscape, krita, ...) - `dawo.apps.dev` (vscodium, toolchain, ...) The core keeps only the genuinely universal tools. Org- or vendor-specific apps (for example microsoft-edge, teams-for-linux) move to the consuming org repo, not the core. Question: do you want these coarse app blocks to live in the core (so every org can reuse them), or should app sets sit entirely in the per-organisation repos and the core stay app-free apart from the bare essentials?

bram.buijs added the

Kind/Enhancement

Kind/Discussion

labels

2026-06-18 12:39:23 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

MinBZK/DAWO-NixOS#25

No description provided.

Rows
Columns